Network security protection simulation method and device, and storage medium

Abstract

The invention provides a network security protection simulation method and a related device. Belongs to the technical field of network security. The method comprises the following steps: generating a network topology; determining a plurality of target network nodes and a network attack path according to the network topology; attacking the target network node based on the network attack path; determining a network defense strategy and defending the target network node; and determining the protection result according to the network attack strategy and the network defense strategy. According to the method, the defense capability of the network system under various environmental factors can be effectively tested.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security protection simulation method, device and storage medium. Background Art

[0002] In recent years, information technology has developed rapidly, especially the rapid development and popularization of network and communication technology, which has enabled mankind to enter the information age and a new stage of the Internet of Everything. Informatization has changed the traditional production and life patterns, and at the same time has brought new challenges to people's work, life and social management.

[0003] At the same time, with the development of social economy, information means such as the Internet of Things, cloud computing, and artificial intelligence are becoming the inevitable choice for various industries to achieve innovative development. The current informatization is based on the Internet. In order to adapt to the growing needs of various types in the informatization environment, it is necessary to strengthen the construction of network infrastructure and improve the network's carrying capacity and resource sharing level.

[0004] However, due to the inherent weaknesses of the network itself, the fragility and defects make these open networks extremely vulnerable to hacker attacks. Therefore, the importance of network security is self-evident, and it directly affects the survival and development of the entire enterprise.

[0005] Therefore, in the context of the rapid development of the information industry today, how to ensure the security and stable operation of key information systems has become an urgent problem to be solved. At present, domestic and foreign networks and information systems are facing various security risks, including the harm caused by the spread of malicious codes such as virus infection, hacker intrusion and theft of sensitive user information and commercial secrets, etc. All kinds of problems occur from time to time, seriously affecting the normal business operation and work efficiency, causing incalculable economic losses and safety accidents to enterprises, and even endangering the safety of personal life and property.

[0006] In response to these issues, various active measures need to be taken to ensure network security. Summary of the invention

[0007] In view of this, an embodiment of the present application provides a network security protection simulation method and related devices.

[0008] In a first aspect, an embodiment of the present application provides a network security protection simulation method, comprising:

[0009] Generate network topology;

[0010] Determine a network attack path according to the network topology; the network topology includes access rights between multiple network nodes and network assets of the multiple network nodes; the network attack path is used to describe the attack sequence on the network nodes;

[0011] Selecting a network attack strategy, and attacking a target network node according to the network attack path; the network attack path includes a plurality of target network nodes;

[0012] Determine a network defense strategy and perform defense on the target network node;

[0013] The protection result is determined based on the network attack strategy and the network defense strategy.

[0014] In a second aspect, an embodiment of the present application provides a network security protection simulation device, including:

[0015] Network topology module, used to generate network topology;

[0016] A determination module, configured to determine a network attack path according to the network topology; the network topology includes access rights between a plurality of network nodes and network assets of the plurality of network nodes; the network attack path is used to describe the attack sequence on the network nodes;

[0017] A network attack planning module, used to select a network attack strategy and attack a target network node according to the network attack path; the network attack path includes multiple target network nodes;

[0018] A network defense planning module, used to determine a network defense strategy and to defend the target network node;

[0019] The verification result statistics module is used to determine the protection result according to the network attack strategy and the network defense strategy.

[0020] In a third aspect, an embodiment of the present application provides a device, comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device performs the network security protection simulation method described in any one of the first aspects above.

[0021] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which a code is stored. When the code is executed, the device executing the code implements the network security protection simulation method described in any one of the first aspects above.

[0022] The network security protection simulation method provided by this application can complete the security protection of the entire network in a virtual environment, and can set different types of attack methods according to different scenarios to verify the effectiveness of the overall network defense system. At the same time, the vulnerability of a single node can also be seen to adjust the deployment in a targeted manner. Moreover, the network security protection simulation method provided by this application not only provides an effective network security risk analysis and management tool, but also provides support for improving the network's ability to resist external threats, optimizing security resource allocation, and enhancing emergency response. In addition, this method can also be used as an education and training tool to improve the operational skills and response efficiency of the security team. Overall, this method greatly improves the organization's network security protection level and risk management capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A block diagram of a network security protection simulation system based on a network provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of a flow chart of a network security protection simulation method provided in an embodiment of the present application;

[0026] Figure 3 This is a schematic diagram of a computer device embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0028] The network security protection simulation system based on the network provided by this application is as follows Figure 1 As shown, the system mainly includes: a network topology module 101, a determination module 102, a network attack planning module 103, a network defense planning module 104 and a verification result statistics module 105.

[0029] Among them, the network topology module 101 is mainly responsible for collecting network topology information under the network architecture to be tested, and at the same time converting each physical entity and location information into network relationship structured data that is easy to analyze and process, that is, providing it for reference for the next step of network attack planning and network protection plan.

[0030] The determination module 102 is used to determine a network attack path according to the network topology.

[0031] The main function of the network attack planning module 103 and the network defense planning module 104 is to perform a series of operations such as intrusion testing, penetration testing, and vulnerability scanning on important entities in the network system by simulating various known network attack methods, so as to discover hidden vulnerabilities and take protective measures to compensate for them.

[0032] The function of the verification result statistics module 105 is to obtain corresponding conclusion indicators through analysis and processing of relevant data generated during the implementation of the above two plans, and then provide advisory opinions and guidance for the overall security evaluation of the actual system.

[0033] The above three functional modules are independent of each other, and each of them contains several logical subsets to achieve better practical effects. For example, the network topology module can be divided into network node types, connection methods, etc. according to different dimensions, which can make this solution more adaptable and greatly improve the flexibility and stability of the entire system.

[0034] The following is a brief introduction to the basic composition and workflow of each functional module:

[0035] Network topology module: This part is mainly composed of three types of entities: model creators, original network structure data processors, and network topology visualization tool developers. Since the key issue that this module needs to solve is how to ensure its own security, its basic idea is to virtualize all entities into a "black box" data packet, which is conducive to improving the robustness of the system and avoiding the interference of external factors. Another point to note is that in actual business scenarios, the real network topology information and sensitive information are usually shielded and only the most basic elements are retained to facilitate the operation of subsequent links. Of course, some auxiliary rules or filtering conditions can be added to meet the requirements before being output to the next stage for continued execution.

[0036] In addition, the above is only an example, and other solutions that can achieve the corresponding effect can also be adopted. For example, if a complete network topology is required to accurately locate the network nodes, static graphics can be used directly instead of database files; on the other hand, if more attribute features or change trends need to be recorded, a representation similar to dynamic traffic will be used to present them for users to observe and make corresponding adjustments.

[0037] Network attack planning module: The main idea of ​​this part is to first collect all IP addresses and their corresponding port numbers transmitted through the router through network packet capture technology, and then analyze and compare these data to find the target objects and mark them to form a preliminary list for backup; secondly, obtain various common and effective attack program sets from known channel sources and classify and block them into an ordered table structure through specific algorithms for easy call and query (such as classification by common Trojans, distinction by the latest popular virus types, etc.); finally, consider how to design a reasonable interactive interface so that users can complete the selection and configuration operations in a short time and enter the actual combat mode as soon as possible to take the initiative to attack until victory is achieved.

[0038] Of course, in the actual application process, you may encounter many unexpected situations, which may cause the number of problem points to increase or even get out of control and eventually lead to failure. Therefore, relevant preparations must be made in advance to ensure that everything is foolproof. It is also worth mentioning that although the description here takes a single environment as the main form of client server as an example, it can be expanded and upgraded to a multi-interactive system with a cluster distributed structure, and more types of intelligent roles can be added to participate in collaborative cooperation to increase the fun and enhance the experience.

[0039] Network defense planning module: This part belongs to the background support service system, which is also composed of three main components: core components, peripheral plug-in units, and auxiliary service layers. Special attention should be paid to the core components, which must be strong and stable enough to perform well, otherwise it will affect the overall level and fail to achieve the expected target effect. In addition, it is necessary to add that some new technologies are introduced in this system to achieve new breakthroughs, such as cloud computing platforms, big data storage centers, high-performance computing engines, etc. The application of these new concepts can play a significant role in improving the level of competitiveness.

[0040] Verification result statistics module: This step mainly integrates the feedback information generated in the previous links to form a comprehensive research report and submit it to the superior department for review and research in order to better understand the current situation and take necessary targeted measures in time to solve the exposed problems. In addition, it also has a certain predictive ability to warn of potential threats and hidden dangers in advance. At the same time, when unexpected situations occur, it can also react in time to activate the emergency response mechanism to quickly and effectively eliminate adverse effects and restore the original state to normal operation. At the same time, a large number of valuable lessons will be accumulated throughout the process for future reference and learning, saving a lot of time and energy costs while also reducing the possibility of similar incidents happening again.

[0041] In summary, the network security protection simulation provided in the embodiment of the present application simulates attack and defense one by one according to the existing network attack strategy and network defense strategy. It can effectively improve the network security technical capabilities of the network security team / personnel so that they can deal with actual and potential security issues. The attack and defense drill rules can be customized according to the usage scenario, so that the participants can master the attack and defense rules through repeated drills of attack and defense scenarios, and quickly improve their practical attack and defense skills. On the one hand, in the actual network environment, the network security team / personnel can effectively form network protection technology according to the existing network space status, reduce the threat of network attacks, and carry out effective emergency disposal after being attacked; on the other hand, the network security team / personnel can use this method to deduce the impact of emerging attack / protection technologies on digital network assets, and formulate relevant response strategies in advance for potential impacts.

[0042] Moreover, this method can display the actual path of each attack path and defense method on the network topology, as well as the effects of security attack technology, network security protection technology and network security operation and maintenance technology on network assets. It can effectively deduce the effectiveness of the actual path attack strategy and defense strategy of one or more attack paths and defense methods, and can be effectively applied to the review and analysis of attack strategy and protection strategy, which has a strong guiding significance for the formulation of actual attack and defense strategies.

[0043] like Figure 2 As shown, the present application provides a network security protection simulation method, which is applied to a network security protection simulation system, and the method includes:

[0044] S1. Generate network topology.

[0045] Network topology describes the physical or logical connections between devices in a network (such as computers, servers, routers, switches, etc.). Understanding network topology is the basis for network planning, management, and troubleshooting. Network topology can be divided into physical topology and logical topology. Physical topology describes the actual connection and layout of physical devices. For example, the layout of cable connections, the relative position of devices, etc. Logical topology describes the flow path of data in the network without considering the physical connection. For example, virtual local area network (VLAN), subnet structure, etc.

[0046] Generating network topology is the first step to understand and manage the network. Through a combination of automated tools and manual recording, all nodes in the network and their connection relationships can be accurately identified. This step provides necessary data support for subsequent network attack path determination and security protection strategy formulation. Mastering comprehensive network topology information can significantly improve the efficiency of network management and maintenance, while enhancing the network's security protection capabilities.

[0047] Specifically, generating a network topology includes: obtaining node information of multiple network nodes in the network, access rights between each network node, and network assets of each node; and building a network topology based on the node information of multiple network nodes, access rights between each network node, and network assets of each node.

[0048] In detail, the node information of multiple network nodes in the network, the access rights between the network nodes and the network assets of each node can be obtained first, and then the multiple network nodes, the access rights between the multiple network nodes and the network assets of the network nodes obtained above can be organized into a set of data, and then the set of data can be converted into a graphical network topology through a predefined format.

[0049] Get node information of multiple network nodes in the network. You can use Nmap or similar tools to scan the entire subnet (can be one or more) to discover all online devices. Identify the device type (such as routers, switches, servers, workstations, etc.) through the scan results. Get the status information of the device, including the operating system type, open ports, MAC address, IP address, etc.

[0050] You can also obtain detailed information about network devices through the Simple Network Management Protocol (SNMP). Specifically, use SNMP tools (such as Net-SNMP) to send query requests to network devices. Collect the device's Management Information Base (MIB) data, including device name, interface status, routing table, traffic statistics, etc.

[0051] You can also obtain the latest device information from the configuration management database (CMDB) or network management system, integrating information from different sources to ensure the accuracy and completeness of node information.

[0052] S2. Determine the network attack path based on the network topology.

[0053] Determining network attack paths is a complex and sensitive process that usually involves an in-depth understanding and analysis of the network environment. Before introducing how to determine network attack paths based on network topology, it should be made clear that this process should be carried out within a legal and ethical framework and should comply with relevant laws, regulations and best practices.

[0054] To identify potential security risk points based on network topology (rather than specific attack paths), you can take the following steps:

[0055] First, you need to understand the physical and logical structure of the network in detail based on the network topology, including network devices, connection methods, data transmission processes, etc. Analyze the key nodes and weak links in the topology, such as important servers, data centers, or ports with direct external connections. Then, based on the network topology, identify possible security risks, such as unencrypted communications, excessive exposure, or unreasonable access control policies. Evaluate the traffic patterns between nodes and the effectiveness of anomaly detection mechanisms. Simulate potential network attacks in a secure environment to test the actual security of the network. This can be done by using virtualized attack tools or reproducing attack scenarios in an isolated environment. Finally, based on the results of the simulated attacks, formulate targeted security policies and protective measures, such as strengthening identity authentication, implementing data encryption, and regularly updating software and operating systems.

[0056] Specifically, determining a network attack path according to a network topology includes: determining a plurality of target network nodes from the network topology; determining access rights between the plurality of target network nodes according to a network graph; and generating a network attack path according to the access rights between the plurality of target network nodes.

[0057] The method of determining the network attack path based on the network topology effectively identifies potential security threats through systematic analysis and detailed steps, thereby strengthening network protection. First, by identifying key nodes, external interfaces and weak links, we can fully grasp the important devices and connection points in the network, such as important servers, core network devices, user terminals, Internet portals and VPN gateways. Then, we collect and analyze the access rights between network nodes, obtain and parse information such as access control lists (ACLs), firewall rules and VLAN subnet configurations. In this stage, we use graph theory methods to construct a network diagram to clarify the logical connections and access controls between nodes.

[0058] In the permission verification phase, tools are used to simulate access attempts between different nodes, and a detailed access permission list is formed by recording successful and failed access attempts. Subsequently, a potential network attack path map is constructed based on the identified target nodes and access permission information, and weights are used to represent access control and communication difficulties. By evaluating the feasibility of the path, identifying the critical path, and using security simulation tools (such as CALDERA, MITRE ATT&CK) to perform attack simulations, the attack path map is further adjusted and optimized. Finally, a detailed attack path description is generated, including specific actions for each step, possible vulnerabilities and attack techniques that may be exploited, and corresponding security recommendations and protective measures are proposed.

[0059] The above methods, first of all, provide a systematic approach that enables security teams to fully understand the network architecture and possible attack paths, and then develop targeted defense strategies. Secondly, through simulation and actual testing, potential security vulnerabilities can be discovered and repaired in advance, improving the security of the overall network. Finally, by generating detailed path descriptions and protective measures, it not only helps network administrators better prevent attacks, but also provides valuable reference for network security construction, enabling organizations to respond more calmly when facing complex network threats.

[0060] Specifically, determining a plurality of target network nodes from the network topology includes: scanning network vulnerabilities, selecting network nodes with network vulnerabilities from the network topology as target network nodes, or manually specifying a target network node as a target.

[0061] First, conduct a network vulnerability scan. By using professional security scanning tools (such as Nmap, Nessus, etc.), a comprehensive vulnerability scan is performed on the entire network. These tools can discover known vulnerabilities in network devices, servers, and terminal devices, including unpatched security vulnerabilities, configuration errors, weak passwords, open ports, etc. The scan results will generate a detailed report listing all detected vulnerabilities and the security score of each device. Based on these reports, it can be preliminarily determined which nodes are at higher risk and require further attention and protection. This step can automatically identify a large number of potential vulnerabilities with high efficiency and comprehensive coverage, providing a solid data foundation for subsequent protective measures.

[0062] Next, manually specify the target nodes. Although automatic scanning can cover most vulnerabilities, some key nodes may not be suitable for full reliance on automatic scanning tools due to their particularity or sensitivity. For example, core servers, database servers, application servers responsible for important business processes, etc. Network security experts can manually specify these key nodes as targets based on their in-depth understanding of network architecture and business processes. Such a designation process relies on the experience and judgment of experts to ensure that no critical nodes are missed, especially when automatic scanning tools cannot detect or may interfere with them.

[0063] The combination of these two methods can ensure that the nodes that need the most attention in the network are identified, and achieve wide coverage and in-depth comprehensive identification of target nodes. The beneficial effect is significant. Through automated scanning, all known vulnerabilities can be quickly identified. At the same time, the manual designation method can ensure that the identification of key nodes is more accurate and reliable, avoiding omissions caused by the limitations of automated tools.

[0064] S3. Select a network attack strategy and attack the target network node according to the network attack path.

[0065] Specifically, the selection of network attack strategies includes:

[0066] Scan the network vulnerabilities of each target network node and select corresponding network attack strategies for the network vulnerabilities of each target network node.

[0067] The steps to select a network attack strategy start with a network vulnerability scan of each target network node. By using professional vulnerability scanning tools (such as Nmap, Nessus, etc.), the security team can fully identify the security vulnerabilities of each target node. These tools will deeply analyze the system configuration, open ports, running services and their software versions of each node, generate a detailed scan report, and list the specific vulnerability information of each node. Next, based on the scan results, select the corresponding network attack strategy for the specific vulnerability of each node. For example, if a node has a known vulnerability, you may choose to simulate the exploitation attack strategy for that vulnerability; for other situations such as weak passwords, different attack methods such as brute force cracking or social engineering may be used. In this way, the security team can develop accurate and practical attack simulation strategies, providing key data support and decision-making basis for subsequent security protection measures. This process not only helps to identify and evaluate security weaknesses in the network, but also lays the foundation for strengthening the network security protection system.

[0068] Specifically, the selecting of the network attack strategy includes determining the network attack strategy from a network attack strategy library. The network attack strategy library includes vulnerability exploits, Trojans, super Trojans, zero-day vulnerabilities, deception attacks, near-source attacks, supply chain attacks, phishing attacks, and lateral attacks.

[0069] Selecting a specific network attack strategy is an important step in customizing and optimizing network security testing and protection measures. This process involves determining the most suitable attack strategy from the network attack strategy library to simulate potential threats and test the network's defense capabilities. The specific implementation process is as follows:

[0070] First, establish a network attack strategy library. The network attack strategy library is a database containing various known attack methods based on different attack techniques and targets. Common attack strategies include vulnerability exploits, Trojan attacks, super Trojans, zero-day vulnerability exploits, deception attacks, near-source attacks, supply chain attacks, phishing attacks, and lateral attacks. Vulnerability exploits are attacks through known security vulnerabilities, such as exploiting unpatched operating system vulnerabilities. Trojans and super Trojans are remote control and data theft through malware. Zero-day vulnerability exploits are attacks before the vulnerability is patched, which are extremely destructive. Deception attacks steal data or damage systems by disguising or posing as fake identities. Near-source attacks target physically close targets, such as spreading malware through USB flash drives. Supply chain attacks penetrate through links in the supply chain, phishing attacks induce users to disclose sensitive information through forged emails or websites, and lateral attacks expand to other nodes in the network after breaking through one node.

[0071] In actual operation, the selection of network attack strategies needs to be customized according to the specific situation of the target network. First, analyze the security situation and structure of the target network, including information such as existing defense measures, vulnerabilities, and sensitive assets. Based on this information, select the most effective attack strategy from the strategy library. For example, if there is unupdated system software in the target network, you can choose a vulnerability exploitation strategy; if the target network is likely to be infiltrated through the supply chain, you can choose a supply chain attack strategy. When choosing, consider the potential impact and difficulty of the attack to ensure the authenticity and effectiveness of the simulated attack.

[0072] Once the attack strategy is determined, it can be simulated and tested through specific attack tools and techniques. These tools and techniques can be penetration testing tools commonly used in the network security industry, such as Metasploit, Wireshark, KaliLinux, etc. Through these tools, different attack methods can be simulated to test the defense capabilities of the target network.

[0073] The beneficial effect of this process is that it not only reveals potential vulnerabilities and weak links in the network, but also helps the security team understand the principles and processes of different types of attacks, so as to develop more effective defense measures. By simulating real attack scenarios, vulnerabilities can be discovered and patched in advance, improving the overall defense level of the network. In addition, regular simulated attack tests can ensure that the network defense mechanism is always in the best condition, respond to new security threats in a timely manner, and protect the network security of the organization.

[0074] S4. Determine the network defense strategy and defend the target network node.

[0075] The main purpose of step S4 is to determine a defense strategy suitable for the target network node in order to effectively protect it from potential network attacks. This process includes the following key steps:

[0076] First, analyze the data obtained in the vulnerability scanning and attack simulation phases, including the security status of each target node, identified vulnerabilities, and attack surfaces. This provides a basis for formulating defense strategies. For example, knowing that a node has a known vulnerability or that its open ports may be exploited helps the security team establish priority defense areas.

[0077] Next, determine the appropriate protective measures. These measures may include installing and configuring firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) to monitor and block suspicious activities in real time. At the same time, additional security patches can be updated to the system to fix identified vulnerabilities and reduce the risk of being exploited. In addition, user authentication mechanisms can be strengthened, such as implementing multi-factor authentication, to ensure the security of sensitive resources.

[0078] Then, a comprehensive set of security policies is formulated based on the specific situation of the target node. This includes access control policies, data encryption measures, regular vulnerability assessments and security audits, etc. These policies are designed to improve the overall security posture and ensure the integrity and availability of network resources.

[0079] Finally, implement and monitor the defense strategy. After installing the required security tools, the security team should regularly review the logs recorded by the firewall and intrusion detection system to promptly detect and respond to any abnormal activities. At the same time, conduct security drills to ensure the effectiveness of various measures and enhance the security awareness and response capabilities of team members.

[0080] Specifically, selecting a network defense strategy includes: determining a network defense strategy from a network defense strategy library. The network defense strategy library includes traffic detection, EDR, phantom cloud, anti-virus software, Trojan removal, vulnerability patching, network disconnection, and space mapping.

[0081] According to the security requirements and risk assessment results of the target network nodes, analyze the existing security threats and vulnerabilities, and then determine the most appropriate defense strategy from the network defense strategy library.

[0082] Select appropriate strategies from the network defense strategy library, including the following:

[0083] Traffic detection: By implementing traffic detection technology, network traffic is continuously monitored to identify abnormal behavior or potential attack activities. A network intrusion detection system (NIDS) can be applied to analyze traffic in real time and trigger alarms.

[0084] EDR (Endpoint Detection and Response): Deploy endpoint detection and response solutions to monitor and record activities on endpoint devices, detect suspicious behavior, and respond quickly when security incidents occur. EDR tools can provide in-depth analysis and response capabilities.

[0085] Huanyun: Apply cloud security solutions to ensure data and application security in the cloud environment. Huanyun technology can monitor and protect data stored in the cloud in real time to prevent data leakage and unauthorized access.

[0086] Antivirus software: Use antivirus software to regularly scan and remove malware and viruses in the system to ensure the safety of each node. Update the virus database regularly to ensure protection against the latest threats.

[0087] Remove Trojans: Implement removal measures for detected Trojan programs. Ensure that every terminal and server in the system is not infected by malware and maintain the normal operation of the network.

[0088] Vulnerability patches: Track and apply the latest security patches to fix known vulnerabilities and reduce potential attack surfaces. Regularly check software and systems and update patches in a timely manner.

[0089] Network disconnection: When a serious security incident or potential threat is discovered, the affected network nodes are temporarily disconnected to prevent the attack from spreading further. This strategy is usually implemented in emergency situations to ensure overall network security.

[0090] Spatial mapping: Perform spatial mapping of the network environment to understand the network structure and the security status of each node. This technology can help identify weak links and make corresponding defense strategies.

[0091] Specifically, the selecting of the network protection strategy includes: scanning the network vulnerabilities of each target network node, and selecting a corresponding network protection strategy for the network vulnerabilities of each target network node.

[0092] The process of selecting a network protection strategy begins with a comprehensive vulnerability scan of each target network node, using specialized tools to identify security weaknesses in a large-scale network environment. This phase provides an in-depth analysis of each node's system configuration, known vulnerabilities, and security risks. By evaluating the scan results, the security team can develop a corresponding protection strategy for the specific vulnerabilities of each target node. For example, for unpatched vulnerabilities discovered, the team may choose to apply security patches and update configurations; for nodes at risk of infection with specific malware, anti-virus software and intrusion detection systems may be deployed. By combining security protection measures with specific network vulnerabilities, the team ensures that the most effective protection strategy is implemented for each node, thereby enhancing the overall network security posture and reducing potential losses. This approach strives to optimize both effectiveness and resource utilization, providing a systematic guarantee for maintaining network security.

[0093] S5. Determine the protection result based on the network attack strategy and network defense strategy.

[0094] Specifically, the protection result is determined based on the network attack strategy and the network defense strategy, including: executing the network attack strategy on the target network node, and executing the network defense strategy on the target network node; judging the working status of the network assets of the target network node; if the working status of the network assets of the target network node is abnormal, determining that the defense has failed; if the working status of the network assets of the target network node is normal, confirming that the defense has been successful.

[0095] In the process of network security protection, determining the protection results based on network attack strategies and defense strategies is a key link. This process first involves attack simulation on the target network node, and using the preset network attack strategy to test the threats that the system may face. For example, you can use a variety of methods such as vulnerability exploitation, Trojan implantation, phishing attacks, etc. to scan and evaluate security vulnerabilities in the network environment and gain insight into potential attack paths. Simulated attacks require strict control of the environment to ensure that no actual damage is caused to the production system.

[0096] After completing the attack simulation, the next step is to implement the corresponding network defense strategy. These defense strategies can include configuring firewalls, deploying intrusion detection systems (IDS), applying anti-virus software, patch management and other measures. The purpose is to fight against the previously simulated attacks on the same node and resist unauthorized access and potential data leakage. This process ensures that all protection measures are effectively implemented so that the target network node is in a protected environment.

[0097] After the attack simulation and defense strategy are executed, the working status of the target network nodes must be evaluated. By monitoring the system's availability, response time, and security logs, determine whether the network assets are operating normally. If the working status of the network assets is found to be abnormal, such as system crashes, service interruptions, or security alarm triggers, this indicates that the current defense measures have not been able to effectively prevent the attack, thus confirming that the defense has failed. On the contrary, if the network assets are in normal status, all services can still run stably, and there is no record of malicious activities, it means that the defense strategy has successfully resisted the simulated attack, confirming that the defense was successful.

[0098] The entire process is recorded in detail to provide data support and experience feedback for future optimization of network security strategies, to enhance the response capabilities and technical level of the security team, and to ensure the continuous improvement and strengthening of network security defense mechanisms. Through this systematic evaluation and feedback, organizations can timely adjust and improve network protection measures, improve the ability to resist new threats, and ensure the security and stability of information systems.

[0099] Optionally, the working status of the network assets includes normal operation, a state where there are security vulnerabilities that are easily used as attack entry points, a state where there are security vulnerabilities but are repaired by vulnerability patches, a state where DMZ area network assets lose permissions after suffering a phishing attack / supply chain attack, etc., a state where office area network assets lose permissions after suffering a near-source attack / spoofing attack, etc., a state where a (super) Trojan horse is implanted and can be used as a springboard for lateral movement, a state where permissions are lost due to an ODay attack, and when protected by EDR and honeypots.

[0100] Optionally, the multiple target network nodes include at least a first target network node and a second target network node; and determining the protection result according to the network attack strategy and the network defense strategy includes:

[0101] Simulating, at the first target network node, a network attack strategy corresponding to the first target network node, and simulating, at the first target network node, a network protection strategy corresponding to the first target network node;

[0102] If the working status of the network asset of the first target network node is normal, the defense is confirmed to be successful;

[0103] If the working state of the network asset of the first target network node is abnormal, simulating the network attack strategy corresponding to the second target network node at the second target network node, and simulating the network protection strategy corresponding to the second target network node at the second target network node;

[0104] If the working status of the network assets of the second target network node is normal, it is confirmed that the defense is successful; if the working status of the network assets of the second target network node is abnormal, it is determined that the defense has failed.

[0105] In the above process, simulated attacks are first implemented on the first target network node. In this stage, specific attack methods are used against the node according to the network attack strategy, such as exploiting known vulnerabilities, performing denial of service attacks (DDoS), and implanting malware for comprehensive testing. These attack strategies must be carried out in a strictly controlled experimental environment to ensure that no interference is caused to actual business.

[0106] After the attack simulation is completed, the corresponding network protection strategy will be deployed on the first target network node. At this time, the security team will apply defense measures such as updating security patches, configuring firewalls, strengthening intrusion detection systems (IDS), implementing access control and user rights management. These measures are aimed at enhancing the system's protection capabilities and ensuring that it can effectively resist external threats when actual attacks occur.

[0107] After that, a comprehensive assessment of the working status of the first target network node is required. This includes checking the system's availability, response speed, log records, and security event detection. If the working status of the first target network node is normal, it means that the implemented protection strategy can effectively resist the simulated attack, and the defense can be confirmed to be successful.

[0108] However, if the working status of the first target network node shows abnormalities, such as system crashes, connection interruptions, or frequent security alerts, this indicates that the network protection measures have failed to play the expected role in this attack. At this time, the security team needs to quickly adjust the strategy and enter the protection test of the second target network node.

[0109] For the second target network node, simulate the attack again, using the attack strategy for that node, such as trying to obtain user credentials through phishing attacks, launching cross-site scripting attacks (XSS), etc. At the same time, implement corresponding protection measures, such as configuring a more powerful firewall, enabling smart terminal protection, implementing multi-factor authentication, etc. These protection strategies will help evaluate the security of the second target network node and its position in the attack path.

[0110] After completing this setup, evaluate the working status of the second target network node again. If the working status of the node is normal and no security incidents are found, it indicates that the defense strategy adopted is effective, thus confirming the success of this defense. If the status of the second target network node is found to be abnormal, this will clarify the vulnerability of the node in the overall network defense system, thus determining the failure of the overall defense.

[0111] Through this complete testing and evaluation process, the security team can not only identify the weak links in the network in a timely manner, but also conduct in-depth analysis of the effectiveness of the protection strategy. These results provide important data support and experience feedback for future adjustments and optimizations of network security measures, allowing the network security framework to dynamically adapt to the ever-changing threat environment. Ultimately, through continuous strategy adjustment and improvement, the overall level of network security can be improved, providing more reliable protection for information assets.

[0112] Optionally, the above method also includes: updating the working status of the network assets of the target network node and the network attack strategy and network protection strategy corresponding to the target network node in real time in the network topology.

[0113] By real-time monitoring of the working status of target network nodes and dynamically updating the corresponding network attacks and protection strategies, the effectiveness of network security protection can be significantly improved. Through intelligent monitoring and data analysis, the security team can quickly identify potential security threats and adjust defense measures in a timely manner, thereby reducing security vulnerabilities and response time. In addition, the combination of visualization tools and automation technology makes the management of attack paths and protection status more intuitive and efficient, ultimately achieving comprehensive protection and continuous optimization of the network environment.

[0114] Optionally, the above method also includes: generating an attack and defense simulation report corresponding to the network attack path according to the attack and defense results of each target network node in the network attack path.

[0115] By generating attack and defense simulation reports for each target network node in the network attack path, it is possible to comprehensively summarize the results of attack and defense and provide a detailed security situation analysis. This report can help the security team identify weaknesses in the network, evaluate the effectiveness of protective measures, and optimize future protection strategies with the help of historical data, thereby more effectively improving the overall network security protection level and enhancing the organization's defense capabilities against potential threats.

[0116] The above are some specific implementations of the network security protection simulation method provided by the embodiment of the present application. Based on this, the present application also provides a corresponding device. The device provided by the embodiment of the present application will be introduced from the perspective of functional modularization.

[0117] See also Figure 1 The structural diagram of the network security protection simulation device shown in the figure includes a network topology module 101, a determination module 102, a network attack planning module 103, a network defense planning module 104 and a verification result statistics module.

[0118] The network topology module 101 is used to generate a network topology;

[0119] A determination module 102, configured to determine a network attack path according to the network topology; the network topology includes access rights between multiple network nodes and network assets of the multiple network nodes; the network attack path is used to describe the attack sequence on the network nodes;

[0120] A network attack planning module 103, used to select a network attack strategy and attack a target network node according to the network attack path; the network attack path includes multiple target network nodes;

[0121] A network defense planning module 104, used to determine a network defense strategy and to defend the target network node;

[0122] The verification result statistics module 105 is used to determine the protection result according to the network attack strategy and the network defense strategy.

[0123] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0124] Among them, the device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes, so that the device executes the network security protection simulation method described in any embodiment of the present application.

[0125] The computer storage medium stores codes, and when the codes are executed, the device executing the codes implements the network security protection simulation method described in any embodiment of the present application.

[0126] like Figure 3 As shown, a computer device is provided for an embodiment of the present application, including a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112, and the memory 113 communicate with each other through the communication bus 114.

[0127] Memory 113, used for storing computer programs;

[0128] In one embodiment of the present application, the processor 111 is used to implement the network security protection simulation method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 113.

[0129] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the network security protection simulation method provided by any of the aforementioned method embodiments is implemented.

[0130] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0131] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A network security protection simulation method, characterized in that: include: Generate network topology; Determine a network attack path according to the network topology; the network topology includes access rights between multiple network nodes and network assets of the multiple network nodes; The network attack path is used to describe the attack sequence on network nodes; Selecting a network attack strategy, and attacking a target network node according to the network attack path; the network attack path includes a plurality of target network nodes; Determine a network defense strategy and perform defense on the target network node; The protection result is determined based on the network attack strategy and the network defense strategy.

2. The method according to claim 1, characterized in that: The generating of the network topology comprises: Acquire node information of the plurality of network nodes in the network, access rights between the network nodes, and network assets of the network nodes; The network topology is constructed according to the node information of the plurality of network nodes, the access rights between the respective network nodes, and the network assets of the respective nodes.

3. The method according to claim 1, characterized in that The determining the network attack path according to the network topology includes: determining the plurality of target network nodes from the network topology; Determining access rights between the plurality of target network nodes according to the network graph; The network attack path is generated according to the access rights between the multiple target network nodes.

4. The method according to claim 3, characterized in that The determining a plurality of target network nodes from the network topology comprises: Scan network vulnerabilities and select a network node with a network vulnerability from the network topology as the target network node.

5. The method according to claim 1, characterized in that The determining of the protection result according to the network attack strategy and the network defense strategy includes: Execute the network attack strategy at the target network node, and execute the network defense strategy at the target network node; Determining the working status of the network assets of the target network node; If the working status of the network assets of the target network node is abnormal, it is determined that the defense has failed; if the working status of the network assets of the target network node is normal, it is confirmed that the defense has been successful.

6. The method according to claim 1, characterized in that The multiple target network nodes include at least a first target network node and a second target network node; and determining the protection result according to the network attack strategy and the network defense strategy includes: Simulate, at the first target network node, a network attack strategy corresponding to the first target network node, and simulate, at the first target network node, a network protection strategy corresponding to the first target network node; If the working status of the network asset of the first target network node is normal, the defense is confirmed to be successful; If the working state of the network asset of the first target network node is abnormal, simulating the network attack strategy corresponding to the second target network node at the second target network node, and simulating the network protection strategy corresponding to the second target network node at the second target network node; If the working status of the network assets of the second target network node is normal, it is confirmed that the defense is successful; if the working status of the network assets of the second target network node is abnormal, it is determined that the defense has failed.

7. The method according to claim 5, characterized in that The working status of the network assets includes normal operation, the state where there are security vulnerabilities that are easily used as attack entry points, the state where there are security vulnerabilities but are repaired by vulnerability patches, the state where DMZ area network assets lose permissions after suffering phishing attacks / supply chain attacks, etc., the state where office area network assets lose permissions after suffering near-source attacks / spoofing attacks, etc., the state where Trojans are implanted and can be used as a springboard for lateral movement, the state where permissions are lost due to ODay attacks, and the state when protected by EDR and honeypots.

8. The method according to claim 1, characterized in that: The method further comprises: An attack and defense simulation report corresponding to the network attack path is generated according to the attack and defense results of each target network node in the network attack path.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network security protection simulation method as described in any one of claims 1 to 8 is implemented.

10. A computer storage medium, characterized in that: The computer storage medium stores instructions, and when the instructions are executed on the terminal device, the terminal device executes the network security protection simulation method according to any one of claims 1 to 8.

Images