Network security testing method, system and storage medium for information system

Abstract

The present application provides a network security testing method, system and storage medium for information systems, which relates to the field of data processing technology. The method includes collecting detailed information of each communication and identifying the type of communication, which is divided into first and second types of communication; for the first type of communication, calculating the risk index; if the risk index exceeds the preset threshold, terminating the communication with the relevant communication terminal and notifying other terminals; if the risk index is lower than or equal to the threshold, adjusting the communication path so that the first type of communication terminal must communicate with the information system through a specific node; after receiving the communication data, the specific node simulates the interaction in an isolated environment to determine whether the communication is malicious communication. If it is malicious communication, the information is recorded and the communication is stopped; if it is not malicious communication, the data is forwarded to the information system. The present application can effectively identify and respond to potential network threats and protect the security of information systems.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a network security testing method, system and storage medium for an information system. Background Art

[0002] With the rapid development of information technology, information systems have become the core of enterprise and organizational operations, carrying a large amount of sensitive data. Faced with the ever-evolving network attack technologies, traditional security measures such as firewalls and intrusion detection systems are unable to cope with new and unknown threats effectively. These traditional methods rely on static rules and lack the ability to adapt to the rapidly changing threat environment. Therefore, there is an urgent need for a new, dynamic, and proactive security testing method to comprehensively evaluate the security status of information systems, promptly discover and repair security vulnerabilities, and enhance the system's defense capabilities against complex network attacks.

[0003] The Chinese invention application with publication number CN116775496A provides a computer network testing system and method based on big data, including obtaining network programs where network security incidents occur in the platform respectively; obtaining development data corresponding to the network programs; based on the development data corresponding to the network programs, screening the network programs corresponding to historical network security incidents to obtain target network programs; evaluating the correlation between various data in the target network security data to obtain correlation data of various data in the target network security data; sending message prompts to the corresponding network program developers to remind the development organization to make network security adjustments to the risky network programs; performing network security testing on the risky network programs uploaded again by the development organization, and adjusting the platform's security policy for the network programs.

[0004] In addition, the Chinese invention application with publication number CN115470139A discloses a fuzzy test system and terminal device, including a core fuzzy test engine, an anomaly detection engine and an anomaly reporting engine. The core fuzzy test engine is used to generate test vectors for inputting target test objects; the anomaly detection engine is used to detect undefined and potentially unsafe behaviors of target test objects; and the anomaly reporting engine is used to report all information related to the target test object when an anomaly occurs in the target test object.

[0005] However, the above invention applications lack the ability to adapt to the rapidly changing threat environment. Based on this, a new technical solution is needed. Summary of the invention

[0006] In view of this, the embodiments of this specification provide a network security testing method, system and storage medium for an information system.

[0007] The embodiments of this specification provide the following technical solutions:

[0008] Step S1, collecting communication related information of each communication of the information system, and identifying the communication type of each communication based on the communication related information, wherein the communication type includes a first type of communication and a second type of communication;

[0009] Step S2, calculating a risk index when the information system performs the first type of communication, and when the risk index is greater than a preset first threshold, acquiring a first communication terminal corresponding to the first type of communication, stopping communication with the first communication terminal, and notifying a second communication terminal that performs normal communication with the information system;

[0010] Step S3: when the risk index is less than or equal to the first threshold, modify the communication path between the first communication terminal and the information system corresponding to the first type of communication, so that the first communication terminal communicates with the information system through a specific communication node;

[0011] Step S4: After receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and determines whether the current communication is malicious communication based on the dynamic interaction. If so, record the communication-related information of the current communication and stop communicating with the first communication terminal. Otherwise, forward the communication data to the information system normally.

[0012] Preferably, identifying the communication type of each communication based on the communication related information comprises the following steps:

[0013] Step S11, learning and identifying communication feature data of different communication modes based on historical communication related information, wherein the communication modes include normal communication and abnormal communication, and further extracting key data of each communication with the information system from the communication related information, wherein the key data includes header information, IP address, communication protocol, communication time and communication data length;

[0014] Step S12: During each communication, compare the key data of the current communication with the first key data of abnormal communications that occurred in the past; if the similarity between the key data of the current communication and the first key data is greater than or equal to a preset second threshold, identify the current communication as the first type of communication; otherwise, identify the current communication as the second type of communication.

[0015] Preferably, learning and identifying communication feature data of different communication modes based on historical communication related information includes the following steps:

[0016] Step S111, pre-constructing a test environment for the information system, wherein the test environment includes multiple system facilities of the information system, wherein the system facilities include a server of the information system, a client interacting with the information system, a communication device and a security device, wherein the communication device includes a hub, a switch and a router, and the security device includes a firewall;

[0017] Step S112: running the test environment, implementing normal network interactive communication on the test environment, collecting second communication data of the information system in the case of normal communication, implementing multiple preset network simulation attacks on the test environment, and recording first communication data during the attack process;

[0018] Step S113: identifying second communication characteristic data during normal communication based on the second communication data, and identifying first communication characteristic data during network attack based on the first communication data.

[0019] Preferably, identifying first communication feature data when a network attack occurs based on the first communication data includes the following steps:

[0020] Extract header information from the first communication data, and based on the header information, divide the communications with the same header information into the same interactive communication. For each interactive communication, calculate the key value of the communication data length of the interactive communication, the key value includes the average value, standard deviation, minimum value and maximum value. Also obtain the communication time interval, communication port and communication protocol of each interactive communication, set a corresponding communication identifier for each interactive communication, associate the communication identifier with the corresponding key value and save it, and the key value is recorded as the communication characteristic data.

[0021] Preferably, calculating the risk index of the information system when performing the first type of communication comprises the following steps:

[0022] Step S21, collecting relevant data of the information system, the information system includes multiple system facilities, the relevant data includes the facility identification, facility name and security configuration data of each of the system facilities, and regularly updating the security configuration data and the network security data;

[0023] Step S22: obtaining facility risks of the system facilities based on the security attack data and the security configuration data of each of the system facilities, obtaining the communication relationship between each of the system facilities in the information system, analyzing multiple intrusion patterns based on the communication relationship, calculating the intrusion score of each of the system facilities based on the intrusion pattern and empirical data, and calculating the risk index based on the intrusion score of each of the system facilities.

[0024] Preferably, calculating the intrusion score of each of the system facilities comprises the following steps:

[0025] Step S221, obtaining experience data of the system facility, obtaining a first number of times the system facility is attacked based on the experience data, and calculating a first value based on the first number of times;

[0026] Step S222: classify the system facilities, obtain a plurality of different facility types, obtain relevant industry data for each facility type, obtain a second value of the system facilities based on the industry data, and obtain a third value of the system facilities;

[0027] Step S223, respectively set corresponding weight values ​​for the first value, the second value and the third value, calculate the corresponding weighted results as the first result value, and use the first result value as the intrusion score of the system facility.

[0028] Preferably, calculating the risk index based on the intrusion score of each of the system facilities comprises the following steps:

[0029] Obtain the intrusion score corresponding to each of the system facilities, obtain the related system facilities of each of the system facilities, obtain the impact probability of the related system facilities affecting the system facilities, for each of the system facilities, calculate a comprehensive intrusion score based on the intrusion score and the impact probability, and add up the comprehensive intrusion scores of each of the system facilities as the risk index of the information system when performing the first type of communication.

[0030] The present invention also provides a network security testing system for an information system, comprising the following modules:

[0031] An analysis module, configured to collect communication related information of each communication of the information system, and identify a communication type of each communication based on the communication related information, wherein the communication type includes a first type of communication and a second type of communication;

[0032] a first protection module, configured to calculate a risk index when the information system performs the first type of communication, and when the risk index is greater than a preset first threshold, obtain a first communication terminal corresponding to the first type of communication, stop communicating with the first communication terminal, and notify a second communication terminal that performs normal communication with the information system;

[0033] a second protection module, configured to modify, when the risk index is less than or equal to the first threshold, a communication path between the first communication terminal and the information system corresponding to the first type of communication, so that the first communication terminal communicates with the information system via a specific communication node;

[0034] The judgment module is configured such that after receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and judges whether the current communication is malicious communication based on the dynamic interaction. If so, the communication-related information of the current communication is recorded and the communication with the first communication terminal is stopped. Otherwise, the communication data is forwarded to the information system normally.

[0035] The present invention also provides a storage medium, wherein the storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute any one of the above-mentioned network security testing methods for information systems.

[0036] Compared with the prior art, the at least one technical solution adopted in the embodiments of this specification can achieve the following beneficial effects:

[0037] The present invention obtains and analyzes the communication-related information of each communication in real time, identifies abnormal communication, and then calculates the risk index of abnormal communication. When the calculated risk index exceeds the first threshold, it is judged that the information system is more likely to be attacked by malware, and timely measures are taken to block malicious communication. When the risk index does not exceed the first threshold, the communication path of the current communication is changed, and the specific communication node performs detailed and in-depth analysis and detection of the current communication through the specific communication node, and then makes subsequent processing measures. The above method can quickly identify and respond to potential network security attacks, prevent the spread of attacks, prevent secondary attacks and information leakage, reduce the impact of network security attacks on information systems, and improve the overall network security of information systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 is a flowchart of the steps of the network security testing method for an information system in an embodiment of the present application;

[0040] Figure 2 It is a composition structure diagram of a network security testing system for an information system in an embodiment of the present application. DETAILED DESCRIPTION

[0041] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0042] The following describes the implementation methods of the present application through specific examples, and those skilled in the art can easily understand other advantages and effects of the present application from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The present application can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present application. It should be noted that, in the absence of conflict, the following embodiments and the features in the embodiments can be combined with each other. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work belong to the scope of protection of the present application.

[0043] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present application, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number and aspect described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0044] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present application. The drawings only show components related to the present application rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0045] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the examples can be practiced without these specific details.

[0046] For ease of understanding, the network security testing method for an information system in an embodiment of the present application is described below. Figure 1 In the embodiment of the present application, a network security testing method for an information system is implemented by the following steps:

[0047] Step S1: collect communication related information of each communication of the information system, and identify the communication type of each communication based on the communication related information, where the communication type includes a first type of communication and a second type of communication.

[0048] Specifically, in order to quickly identify and respond to potential network attacks, communication-related information is collected each time the information system communicates, and the communication type is identified based on the communication-related information. The communication types include first-category communication and second-category communication. The first-category communication refers to abnormal communication, and the second-category communication is normal communication. The specific process of identifying the communication type will be explained in detail later, and the information system will be further analyzed based on the communication type.

[0049] Step S2, calculate the risk index of the information system when performing the first type of communication. When the risk index is greater than a preset first threshold, obtain the first communication terminal corresponding to the first type of communication, stop communicating with the first communication terminal, and notify the second communication terminal that communicates normally with the information system.

[0050] Specifically, a risk index of the information system when performing the first type of communication is calculated based on historical communication data. If the risk index is greater than a preset first threshold, it means that the possibility of the information system being attacked is very high, and the first communication terminal currently communicating with the information system is obtained. The malicious communication of the first communication terminal to the information system may cause serious impact on the information system, so the information system immediately stops communicating with the first communication terminal at this time. Since there may be multiple other terminals communicating with the information system, that is, the second communication terminal, the first communication terminal may switch to communicating with the second communication terminal after the communication with the information system is stopped, and attack the information system through the second communication terminal. Therefore, it is necessary to notify the second communication terminal that communicates normally with the information system about the information of the first communication terminal and stop communicating with the first communication terminal. The above method can timely cut off malicious communications and prevent secondary attacks on the information system.

[0051] Step S3: When the risk index is less than or equal to the first threshold, modify the communication path between the first communication terminal and the information system corresponding to the first type of communication so that the first communication terminal communicates with the information system through a specific communication node.

[0052] Specifically, when the risk index is greater than the first threshold, it means that the possibility of malicious communication is very high and the degree of harm caused is relatively large. Therefore, when the risk index is less than or equal to the first threshold, the communication of the information terminal that blocks and sends malicious communication is unlikely to be malicious communication. However, since the current communication belongs to the first category of communication, that is, abnormal communication, the communication path corresponding to the first communication terminal and the information system is modified so that the first communication terminal communicates with the information system through a specific communication node. When the first communication terminal communicates with the specific communication node, the current communication is simulated to further determine whether the current communication is malicious communication. The specific determination method will be explained in detail later.

[0053] Step S4: After receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and determines whether the current communication is malicious communication based on the dynamic interaction. If so, the communication-related information of the current communication is recorded and the communication with the first communication terminal is stopped. Otherwise, the communication data is forwarded to the information system normally.

[0054] Specifically, in order to make a more rigorous judgment on communications with relatively low risk indexes, communication is performed between a specific communication node and a first communication terminal. After receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, and simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment. Based on the dynamic interaction, it can be determined whether the first communication terminal attempts to attack the information system. If so, it means that the current communication is malicious communication, which will attack or cause damage to the information system. The communication-related information of the current communication is recorded to provide data support for future judgments on whether it is malicious communication, and the communication with the first communication terminal is immediately stopped. At the same time, other communication terminals communicating with the information system are also notified. Otherwise, it means that the current communication is not malicious communication, and the specific communication node normally forwards the communication data of the current communication to the information system.

[0055] The above steps obtain and analyze the communication-related information of each communication in real time, identify abnormal communications, and then calculate the risk index of abnormal communications. When the calculated risk index exceeds the first threshold, it is determined that the information system is more likely to be attacked by malware, and timely measures are taken to block malicious communications. When the risk index does not exceed the first threshold, the communication path of the current communication is changed, passing through a specific communication node, and the specific communication node performs detailed and in-depth analysis and detection of the current communication, and then makes subsequent processing measures. The above method can quickly identify and respond to potential network security attacks, prevent the spread of attacks, prevent secondary attacks and information leakage, reduce the impact of network security attacks on information systems, and improve the overall network security of information systems.

[0056] Further, identifying the communication type of each communication based on the communication related information includes the following steps:

[0057] Step S11, learning and identifying communication feature data of different communication modes based on historical communication related information, the communication modes include normal communication and abnormal communication, and also extracting key data of each communication with the information system from the communication related information, the key data including header information, IP address, communication protocol, communication time and communication data length;

[0058] Step S12: During each communication, compare the key data of the current communication with the first key data of abnormal communications that occurred in the past. If the similarity between the key data of the current communication and the first key data is greater than or equal to a preset second threshold, the current communication is identified as a first type of communication; otherwise, the current communication is identified as a second type of communication.

[0059] Specifically, in order to identify the communication type of each communication, firstly, the communication feature data of different communication modes are learned and identified based on the historical communication-related information. The specific learning and identification process will be explained in detail later. The communication mode includes normal communication and abnormal communication. The key data of each communication with the information system is also extracted from the communication-related information. The key information includes header information, IP address, communication protocol, communication time, communication data length and other information. The first key information refers to the key information during abnormal communication. Subsequently, the key information is compared with the first key information of abnormal communication that occurred in the past. If the similarity between the first communication-related information and the first key information is greater than or equal to the preset second threshold, it means that the current communication is likely to be abnormal communication, and the current communication is identified as the first type of communication. Otherwise, the current communication is identified as the second type of communication, that is, normal communication. Through the above method, the key data during normal communication and the key data during abnormal communication are first identified based on the historical communication-related information, and then the key data of the current communication is extracted and compared with the historical first key information. The above method can quickly identify the communication type of the current communication.

[0060] Further, learning and identifying communication feature data of different communication modes based on historical communication related information includes the following steps:

[0061] Step S111: pre-build a test environment for the information system, where the test environment includes multiple system facilities of the information system, including a server of the information system, a client interacting with the information system, communication equipment and security equipment, where the communication equipment includes a hub, a switch and a router, and the security equipment includes a firewall;

[0062] Step S112: running the test environment, implementing normal network interactive communication on the test environment, collecting second communication data of the information system under normal communication conditions, implementing multiple preset network simulation attacks on the test environment, and recording first communication data during the attack process;

[0063] Step S113: identifying first communication characteristic data during normal communication based on the first communication data, and identifying second communication characteristic data during network attack based on the second communication data.

[0064] Specifically, in order to identify the communication characteristic data of different communication modes, a test environment of the information system is pre-constructed. The test environment includes multiple system facilities of the information system. The system facilities include the server of the information system, the client that interacts with the information system, the communication equipment and the security equipment. The communication equipment includes a hub, a switch and a router, and the security equipment includes a firewall. By setting the test environment with the same configuration as the formal environment, the test environment can completely simulate the formal environment. Then, the test environment is first run without malicious communication or attack to collect the second communication data of the information system. Then, by introducing known attack samples, such as DDos attack, unauthorized access, malware propagation and other network attacks, a variety of network simulation attacks are implemented on the test environment. The first communication data during the attack process is also recorded. Based on the first communication data and the second communication data, the communication characteristic data when the information system is subjected to a network attack and the communication characteristic data when the information system is in normal communication are learned and identified. The specific learning and identification method will be explained in detail later. Then, the second communication characteristic data during normal communication is extracted from the second communication data, and the first communication characteristic data during abnormal communication is extracted from the first communication data. The first communication characteristic data and the second communication characteristic data are also saved to help identify the first type of communication and the second type of communication later.

[0065] Further, identifying the second communication characteristic data when a network attack occurs based on the second communication data includes the following steps:

[0066] Extract header information from the first communication data, and based on the header information, divide the communications with the same header information into the same interactive communication. For each interactive communication, calculate the key value of the communication data length of the interactive communication, the key value includes the average value, standard deviation, minimum value and maximum value. Also obtain the communication time interval, communication port and communication protocol of each interactive communication, set a corresponding communication identifier for each interactive communication, associate and save the communication identifier and the corresponding key value, and record the key value as communication characteristic data.

[0067] Specifically, in order to identify the communication characteristic data, the header information of each communication is extracted from the first communication data, and the header information includes the source IP address of the current communication, the target IP address, the protocol type, the source port, the target port, the communication timestamp and the data length. After each communication connection is established, the information system and the communication terminal may perform multiple communication interactions based on this communication connection. Therefore, based on the header information, the communications with the same header information are divided into the same interactive communication. For each interactive communication, the key value of the communication data length of the interactive communication is calculated. The key value includes the average value, standard deviation, minimum value and maximum value of the communication data length. The communication time interval, communication data volume, communication port and communication protocol between two communications in the same interactive communication are also obtained. A corresponding communication identifier is set for each interactive communication, and the communication identifier and the corresponding key value are associated and saved. The key value is the corresponding communication characteristic data. In order to break the external information system, the communication data length of the abnormal communication is relatively long and the communication time interval is relatively short. Therefore, the communication characteristic data of the abnormal communication can be obtained by the above method, and the communication characteristic data of the normal communication can also be obtained based on the above method. It is convenient to judge the communication type based on the communication characteristic data later. The above method can speed up the judgment speed of the communication type, and then speed up the recognition speed of the abnormal communication.

[0068] Further, calculating the risk index of the information system when performing the first type of communication includes the following steps:

[0069] Step S21, collect relevant data of the information system, the information system includes multiple system facilities, the relevant data includes the facility identification, facility name and security configuration data of each system facility, and regularly update the security configuration data and network security data.

[0070] Specifically, the system facilities include multiple server hosts and various terminal devices. The terminal devices include mobile terminals, printers and other devices. The security configuration data includes operating system-related information, permission configuration data and firewall status data of each system device. The network security data refers to the latest network security information obtained from the security knowledge publishing website, including attack type, attack probability, risk level, vulnerability technical details, affected software or system versions, security patches, newly discovered attack modes, malware analysis reports and attack trends, etc. The relevant data and network security data are stored in the storage unit, and the security configuration data and network security data of the system facilities are periodically updated to ensure that the data in the storage unit is always the latest. The collection of relevant data and network security data provides necessary data support for the subsequent calculation of the risk index.

[0071] Step S22: Acquire facility hidden dangers of system facilities based on security attack data and security configuration data of each system facility, acquire communication relationships among system facilities in the information system, analyze multiple intrusion patterns based on the communication relationships, calculate intrusion scores for each system facility based on the intrusion patterns and empirical data, and calculate risk indexes based on the intrusion scores of each system facility.

[0072] Specifically, facility hidden dangers refer to the security vulnerabilities existing in each system facility, communication relationship refers to the communication connection relationship between each system facility, security attack data includes attack type, attack probability and risk level. Possible intrusion modes can be analyzed based on communication relationship and network security data. Intrusion mode refers to the various possible intrusion methods in which malware exploits the facility hidden dangers of system facilities to further invade other system facilities based on the communication relationship between each system facility. The intrusion score refers to the possibility of each system facility being attacked by malware based on empirical data combined with factors such as facility hidden dangers. The higher the intrusion score, the greater the possibility of the system facility being attacked. The calculation method of the intrusion score will be explained in detail later, and the risk index is calculated based on the intrusion score of each system facility.

[0073] Furthermore, the intrusion score of each system facility is calculated, including the following steps:

[0074] Step S221, obtaining experience data of the system facility, obtaining a first number of times the system facility is attacked based on the experience data, and calculating a first value based on the first number;

[0075] Step S222: classify the system facilities, obtain a plurality of different facility types, obtain relevant industry data for each facility type, obtain a second value of the system facilities based on the industry data, and obtain a third value of the system facilities;

[0076] Step S223: Set corresponding weight values ​​for the first value, the second value, and the third value, respectively, calculate the corresponding weighted results as the first result value, and use the first result value as the intrusion score of the system facility.

[0077] Specifically, empirical data refers to historical data related to system facilities, which records relevant data of system facilities during the operation period of the information system, including attack information, obtains the first number of times the system facilities are attacked during the operation period of the information system, and also obtains the first total number of times all system facilities are attacked during the operation period of the information system. The result value obtained by dividing the first number by the first total number is used as the first value of the system facility. The second value refers to the probability of each facility type being attacked in the industry big data. The third value is the evaluation value of the system facility by industry experts. The higher the evaluation value, the more vulnerable the system facility is, and the corresponding probability of a successful attack is also higher. Corresponding weight values ​​are set for the first value, the second value, and the third value. In this embodiment, the weight value of the first value can be set to 0.4, and the weight values ​​of the second value and the third value can be set to 0.3. The three values ​​are multiplied by the corresponding weight values ​​to obtain the corresponding weighted values ​​as the first result value, and then the intrusion score of the system facility is calculated based on the first result value and the communication connection relationship between the system facility in the information system. The specific calculation method will be explained in detail later.

[0078] Further, the risk index is calculated based on the intrusion score of each system facility, including the following steps:

[0079] Obtain the intrusion score corresponding to each system facility, obtain the related system facilities of each system facility, obtain the impact probability of the related system facilities affecting the system facilities, calculate the comprehensive intrusion score for each system facility based on the intrusion score and the impact probability, and add up the comprehensive intrusion scores of each system facility as the risk index of the information system when conducting the first type of communication.

[0080] Specifically, in order to calculate the risk index of the information system when performing the first type of communication, the intrusion score of each system facility is first obtained, and the related system facilities of the system facilities are obtained based on the communication relationship, and the impact probability of the related system facilities affecting the system facilities is also obtained. The impact probability can be obtained by calculating the ratio of the number of times the related system facilities are affected when the related system facilities are attacked to the total number of times the related system facilities are attacked. For each system facility, the comprehensive intrusion score is calculated. For example, the intrusion score of the router is 0.1, the intrusion score of the server is 0.2, and the intrusion score of the database server is 0.3. The server relies on the router for communication. The database server relies on the server to add, delete, modify and query the database. Assuming that the probability of the router affecting the server is 0.5, the comprehensive intrusion score of the corresponding server is 0.2+0.1*0.5=0.25. Assuming that the probability of the server affecting the database server is 0.7, the comprehensive impact score of the corresponding data block server is 0.3+0.25*0.7=0.475. The final risk index of the information system is 0.1+0.25+0.475=0.825. The above method can be used to calculate the risk index of the information system, and then the current communication can be processed based on the risk index.

[0081] According to another aspect of the embodiment of the present invention, Figure 2 As shown, a network security testing system for an information system is also provided, including an analysis module, a first protection module, a second protection module and a judgment module, which are used to implement a network security testing method for an information system as described above, and the specific functions of each module are as follows:

[0082] An analysis module, used to collect communication related information of each communication of the information system, and identify the communication type of each communication based on the communication related information, where the communication type includes a first type of communication and a second type of communication;

[0083] A first protection module is used to calculate a risk index when the information system performs a first type of communication, and when the risk index is greater than a preset first threshold, obtain a first communication terminal corresponding to the first type of communication, stop communicating with the first communication terminal, and notify a second communication terminal that performs normal communication with the information system;

[0084] A second protection module is used to modify the communication path between the first communication terminal and the information system corresponding to the first type of communication when the risk index is less than or equal to the first threshold, so that the first communication terminal communicates with the information system through a specific communication node;

[0085] The judgment module, after receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and judges whether the current communication is malicious communication based on the dynamic interaction. If so, the communication-related information of the current communication is recorded and the communication with the first communication terminal is stopped. Otherwise, the communication data is forwarded to the information system normally.

[0086] According to another aspect of an embodiment of the present invention, a storage medium is provided, wherein the storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute any one of the above-mentioned network security testing methods for an information system.

[0087] In summary, the present invention provides a network security testing method, system and storage medium for information systems, the method includes collecting detailed information of each communication, and identifying the type of communication, which is divided into first and second types of communication; for the first type of communication, calculating the risk index; if the risk index exceeds the preset threshold, terminating the communication with the relevant communication terminal, and notifying other terminals; if the risk index is lower than or equal to the threshold, adjusting the communication path so that the first type of communication terminal must communicate with the information system through a specific node; after receiving the communication data, the specific node simulates the interaction in an isolated environment to determine whether the communication is malicious communication. If it is malicious communication, the information is recorded and the communication is stopped; if it is not malicious communication, the data is forwarded to the information system. The present application can effectively identify and respond to potential network threats and protect the security of information systems.

[0088] In this specification, the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the embodiments described later, the description is relatively simple, and the relevant parts can be referred to the partial description of the previous embodiments.

[0089] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A network security testing method for an information system, characterized in that: The steps include: Step S1, collecting communication related information of each communication of the information system, and identifying the communication type of each communication based on the communication related information, wherein the communication type includes a first type of communication and a second type of communication; Step S2, calculating a risk index when the information system performs the first type of communication, and when the risk index is greater than a preset first threshold, acquiring a first communication terminal corresponding to the first type of communication, stopping communication with the first communication terminal, and notifying a second communication terminal that performs normal communication with the information system; Step S3: when the risk index is less than or equal to the first threshold, modify the communication path between the first communication terminal and the information system corresponding to the first type of communication, so that the first communication terminal communicates with the information system through a specific communication node, and simulates the current communication when the first communication terminal communicates with the specific communication node; Step S4: After receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and determines whether the current communication is malicious communication based on the dynamic interaction. If so, record the communication-related information of the current communication and stop communicating with the first communication terminal. Otherwise, forward the communication data to the information system normally.

2. The method according to claim 1, characterized in that Identifying the communication type of each communication based on the communication-related information includes the following steps: Step S11, learning and identifying communication feature data of different communication modes based on historical communication related information, wherein the communication modes include normal communication and abnormal communication, and further extracting key data of each communication with the information system from the communication related information, wherein the key data includes header information, IP address, communication protocol, communication time and communication data length; Step S12: During each communication, compare the key data of the current communication with the first key data of abnormal communications that occurred in the past; if the similarity between the key data of the current communication and the first key data is greater than or equal to a preset second threshold, identify the current communication as the first type of communication; otherwise, identify the current communication as the second type of communication.

3. The method according to claim 2, characterized in that Learning and identifying communication feature data of different communication modes based on historical communication related information includes the following steps: Step S111, pre-constructing a test environment for the information system, wherein the test environment includes multiple system facilities of the information system, wherein the system facilities include a server of the information system, a client interacting with the information system, a communication device and a security device, wherein the communication device includes a hub, a switch and a router, and the security device includes a firewall; Step S112: running the test environment, implementing normal network interactive communication on the test environment, collecting second communication data of the information system in the case of normal communication, implementing multiple preset network simulation attacks on the test environment, and recording first communication data during the attack process; Step S113: identifying second communication characteristic data during normal communication based on the second communication data, and identifying first communication characteristic data during network attack based on the first communication data.

4. The method according to claim 3, characterized in that Identifying first communication feature data when a network attack occurs based on the first communication data includes the following steps: Extract header information from the first communication data, and based on the header information, divide the communications with the same header information into the same interactive communication. For each interactive communication, calculate the key value of the communication data length of the interactive communication, the key value includes the average value, standard deviation, minimum value and maximum value. Also obtain the communication time interval, communication port and communication protocol of each interactive communication, set a corresponding communication identifier for each interactive communication, associate the communication identifier with the corresponding key value and save it, and the key value is recorded as the communication characteristic data.

5. The method according to claim 1, characterized in that Calculating the risk index of the information system when performing the first type of communication includes the following steps: Step S21, collecting relevant data of the information system, the information system includes multiple system facilities, the relevant data includes the facility identification, facility name and security configuration data of each of the system facilities, and regularly updating the security configuration data and network security data; Step S22: obtaining facility risks of the system facilities based on the security attack data and the security configuration data of each of the system facilities, obtaining the communication relationship between each of the system facilities in the information system, analyzing multiple intrusion patterns based on the communication relationship, calculating the intrusion score of each of the system facilities based on the intrusion pattern and empirical data, and calculating the risk index based on the intrusion score of each of the system facilities.

6. The method according to claim 5, characterized in that Calculating the intrusion score of each of the system facilities comprises the following steps: Step S221, obtaining experience data of the system facility, obtaining a first number of times the system facility is attacked based on the experience data, and calculating a first value based on the first number of times; Step S222: classify the system facilities, obtain a plurality of different facility types, obtain relevant industry data for each facility type, obtain a second value of the system facilities based on the industry data, and obtain a third value of the system facilities; Step S223, respectively set corresponding weight values ​​for the first value, the second value and the third value, calculate the corresponding weighted results as the first result value, and use the first result value as the intrusion score of the system facility.

7. The method according to claim 5, characterized in that Calculating the risk index based on the intrusion score of each of the system facilities comprises the following steps: Obtain the intrusion score corresponding to each of the system facilities, obtain the related system facilities of each of the system facilities, obtain the impact probability of the related system facilities affecting the system facilities, for each of the system facilities, calculate a comprehensive intrusion score based on the intrusion score and the impact probability, and add up the comprehensive intrusion scores of each of the system facilities as the risk index of the information system when performing the first type of communication.

8. A network security testing system for an information system, used to implement a network security testing method for an information system as claimed in any one of claims 1 to 7, characterized in that: Includes the following modules: An analysis module, configured to collect communication related information of each communication of the information system, and identify a communication type of each communication based on the communication related information, wherein the communication type includes a first type of communication and a second type of communication; a first protection module, configured to calculate a risk index when the information system performs the first type of communication, and when the risk index is greater than a preset first threshold, obtain a first communication terminal corresponding to the first type of communication, stop communicating with the first communication terminal, and notify a second communication terminal that performs normal communication with the information system; a second protection module, configured to modify, when the risk index is less than or equal to the first threshold, a communication path between the first communication terminal and the information system corresponding to the first type of communication, so that the first communication terminal communicates with the information system through a specific communication node, and simulates the current communication when the first communication terminal communicates with the specific communication node; The judgment module is configured such that after receiving the communication data from the first communication terminal, the specific communication node imports the communication data into a preset isolation environment, simulates the dynamic interaction between the information system and the first communication terminal in the isolation environment, and judges whether the current communication is malicious communication based on the dynamic interaction. If so, the communication-related information of the current communication is recorded and the communication with the first communication terminal is stopped. Otherwise, the communication data is forwarded to the information system normally.

9. A storage medium, characterized in that: The storage medium stores program instructions, wherein when the program instructions are executed, the device where the storage medium is located is controlled to execute a network security testing method for an information system as described in any one of claims 1 to 7.

Images