Attack and defense security detection method, device, equipment and medium

Abstract

The invention relates to the technical field of computer security management, and discloses an attack and defense security detection method, device and equipment and a medium, and the method comprises the steps: obtaining a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, the storage medium further internally comprises a security detection component set, a security detection strategy library and a pre-divided virtual storage space; determining to-be-called target configuration information in the to-be-tested system based on the security detection workflow and calling the to-be-called target configuration information; constructing a simulated target range and an attack node in the virtual storage space in combination with the security detection component set; and based on the security detection workflow and the security detection strategy library, performing simulated attack and defense detection of the attack node on the simulated target range to obtain a detection result. According to the invention, the target range and the attack node are constructed in the storage medium through the detection workflow in the user access storage medium and the scheduling engine, and the simulated attack is performed; the construction of a lightweight attack simulation environment is realized, and resources and cost required by attack simulation are reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security management, and in particular to an attack and defense security detection method, device, machine equipment and medium. Background Art

[0002] With the accelerated development of the digital economy, data resources have gradually become core strategic resources, profoundly affecting the development of social economy and other aspects. Data security has become an important foundation for the healthy development of society. However, data theft, ransomware attacks, data leakage, data abuse, privacy compliance and other issues are growing and declining, data security issues are intertwined, and data security risks are unprecedented.

[0003] How to understand the opportunities and challenges of digital security, accurately and quickly assess one's own data security capabilities, and do a good job of self-inspection of data security has become the key to the digital transformation of enterprises. Data security inspection has also become an important task of data security management in various regions and industries. However, due to the lack of inspection specifications, technical standards, and tools that can be used as reference, data security inspections have long working cycles and it is difficult to summarize inspection results.

[0004] Currently, when conducting security inspections on specific devices or systems, digital twins or business mirrors are often used to synchronously simulate business information equipment and perform corresponding attack detection. However, such security inspection methods often consume a lot of resources and costs, and are not easy to promote. Summary of the invention

[0005] In view of this, the present invention provides an attack and defense security detection method, device, computer equipment and storage medium to solve the current problems of large resource consumption and high cost when performing security detection.

[0006] In a first aspect, the present invention provides an attack and defense security detection method, the method comprising:

[0007] Acquire a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, wherein the storage medium also includes: a security detection component set, a security detection policy library, and a pre-divided virtual storage space;

[0008] Determine the target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine;

[0009] Constructing a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set;

[0010] The virtual scheduling engine executes the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library to obtain the simulated attack and defense detection result.

[0011] The method provided in this aspect determines the configuration information in the system to be tested and calls it through the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user, so as to build a simulated target range and attack nodes in the virtual storage space pre-divided in the storage medium, thereby realizing the construction of the environment required for the simulated attack in the storage medium, and executing the attack behavior of the attack node on the target range based on the detection workflow and policy library to obtain the attack and defense detection results, which can realize the construction of a lightweight simulated attack environment and reduce resource consumption and cost. At the same time, because the environment is built in the storage medium, the impact of the simulated attack on the host of the system to be tested can be effectively reduced.

[0012] In an optional implementation, the target configuration information includes: namespace information and system environment information;

[0013] The step of constructing a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set includes:

[0014] generating a first container and a second container in the virtual storage space based on the namespace information;

[0015] Performing simulated environment configuration on the first container according to the system environment information, and determining the first container after the environment configuration is completed as a simulated shooting range;

[0016] A plurality of security detection components in the security detection component set are loaded into the second container, and the loaded second container is determined as an attack node, wherein the security detection components are used to execute simulated attack behaviors.

[0017] In this implementation mode, containers corresponding to the simulated target range and attack nodes are generated in the storage medium through the namespace information of the system to be tested, and the corresponding containers are configured according to the specific system environment information and the security detection component set in the storage medium to obtain the simulated target range and attack nodes. The containers constructed under the namespace mechanism are used to achieve effective isolation between the simulated attack environment and the system to be tested, thereby reducing the impact of the simulated attack behavior on the system to be tested.

[0018] In an optional implementation, the system environment information includes: system kernel information and business association information;

[0019] The performing simulation environment configuration on the first container according to the system environment information includes:

[0020] A simulated operating environment is constructed in the first container according to the system kernel information, and a simulated business environment is constructed in the first container according to the business association information.

[0021] In this implementation mode, the business environment and the operating environment are simulated through the specific business-related information and environment of the system under test and the system kernel information, thereby achieving effective configuration of the simulation environment.

[0022] In an optional implementation, before executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine, the method further includes:

[0023] Performing an initialization check on the simulated shooting range and the attack node according to a plurality of preset basic check items;

[0024] If the initialization check is qualified, the step of executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine is executed.

[0025] This implementation manner avoids abnormalities in the subsequent simulated attack process by checking the simulated target range and the attack node respectively before the simulated attack begins, thereby ensuring that the simulated attack is carried out in an orderly manner.

[0026] In an optional implementation, the security detection strategy library includes: security detection components corresponding to each of the plurality of items to be tested;

[0027] The step of executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine to obtain the simulated attack and defense detection result includes:

[0028] Based on the security detection workflow, execute attack and defense detection of each item to be tested in sequence;

[0029] When executing attack and defense detection of each item to be tested, determining the security detection component corresponding to the item to be tested in the security detection strategy library through the virtual scheduling engine;

[0030] The virtual scheduling engine drives the corresponding security detection component in the attack node to attack the target range, and obtains the simulated attack and defense detection result of the item to be tested.

[0031] In this implementation mode, by sequentially calling the security detection components corresponding to each item to be tested in the attack node through the security detection workflow and the policy library, targeted detection of each item to be tested can be achieved, thereby improving the security detection effect.

[0032] In an optional implementation, the security detection strategy library further includes: qualified indicators corresponding to a plurality of items to be tested;

[0033] After obtaining the simulated attack and defense detection result of the item to be tested, the method further includes:

[0034] The simulated attack and defense detection results of the item to be tested are compared with the corresponding qualified indicators to determine the security assessment results of the item to be tested.

[0035] In this implementation manner, by comparing the time detection results of each item to be tested with the corresponding index, the actual qualification status of each item to be tested can be effectively evaluated, ensuring that the user understands the actual situation of each item to be tested.

[0036] In an optional embodiment, the method further includes:

[0037] A safety assessment report of the system to be tested is generated based on the safety assessment results of each item to be tested.

[0038] In this implementation manner, by summarizing the security assessment results of each item to be tested, an overall security assessment report of the system to be tested is obtained, so that the user can understand the actual security situation of the system to be tested from a global perspective.

[0039] In a second aspect, the present invention provides an attack and defense security detection device, the device comprising:

[0040] A resource acquisition module, used to acquire a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, wherein the storage medium also includes: a security detection component set, a security detection policy library, and a pre-divided virtual storage space;

[0041] A configuration calling module, used to determine target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine;

[0042] An environment building module, used to build a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set;

[0043] The simulated attack module is used to execute the simulated attack and defense detection of the attack node on the simulated shooting range based on the security detection workflow and the security detection policy library through a virtual scheduling engine to obtain a simulated attack and defense detection result.

[0044] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the attack and defense security detection method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0045] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the attack and defense security detection method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 is a flow chart of an attack and defense security detection method according to an embodiment of the present invention;

[0048] Figure 2 is a flow chart of another attack and defense security detection method according to an embodiment of the present invention;

[0049] Figure 3 is an example diagram of an architecture for implementing a container in a namespace according to an embodiment of the present invention;

[0050] Figure 4 is an example diagram of the architecture of security attack and defense detection software according to an embodiment of the present invention;

[0051] Figure 5 This is an example diagram of a lightweight virtualization implementation process according to an embodiment of the present invention;

[0052] Figure 6 is a structural block diagram of an attack and defense security detection device according to an embodiment of the present invention;

[0053] Figure 7 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0055] With the accelerated development of the digital economy, data resources have gradually become core strategic resources, profoundly affecting the development of social economy and other aspects. Data security has become an important foundation for the healthy development of society. However, data theft, ransomware attacks, data leakage, data abuse, privacy compliance and other issues are growing and declining, data security issues are intertwined, and data security risks are unprecedented.

[0056] How to understand the opportunities and challenges of digital security, accurately and quickly assess one's own data security capabilities, and do a good job of self-inspection of data security has become the key to the digital transformation of enterprises. Data security inspection has also become an important task of data security management in various regions and industries. However, due to the lack of inspection specifications, technical standards, and tools that can be used as reference, data security inspections have long working cycles and it is difficult to summarize inspection results.

[0057] Currently, when conducting security inspections on specific devices or systems, digital twins or business mirrors are often used to synchronously simulate business information equipment and perform corresponding attack detection. However, such security inspection methods often consume a lot of resources and costs, and are not easy to promote.

[0058] To this end, an embodiment of the present invention provides an attack and defense security detection method, which determines the configuration information in the system to be tested and calls it through the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user, so as to build a simulated target range and attack nodes in the virtual storage space pre-divided in the storage medium, thereby realizing the construction of the environment required for the simulated attack in the storage medium, and executing the attack behavior of the attack node on the target range based on the detection workflow and policy library to obtain the attack and defense detection results, which can realize the construction of a lightweight simulated attack environment and reduce resource consumption and cost. At the same time, since the environment is built in the storage medium, the impact of the simulated attack on the host of the system to be tested can be effectively reduced.

[0059] According to an embodiment of the present invention, an attack and defense security detection method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] In this embodiment, an attack and defense security detection method is provided, which can be used for the above-mentioned simulated attack and defense security detection on a specific device or system. Figure 1 is a flow chart of an attack and defense security detection method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0061] Step S101, obtaining a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, wherein the storage medium also includes: a security detection component set, a security detection policy library, and a pre-divided virtual storage space.

[0062] When the customer conducts security testing on the customer's system or equipment by simulating attacks, the storage medium with the relevant tools installed is connected to the customer's device, where the storage medium can be a USB flash drive or a mobile hard disk, etc. The developer has pre-divided a special storage area in the storage medium, namely the virtual storage space, in which a simulation system corresponding to the customer's system to be tested is built. At the same time, the storage medium also includes a specific set of security detection components for a series of attack and defense tests on the simulation system.

[0063] The storage medium has a pre-set security detection scheduling engine and security detection workflow. The security scheduling engine can perform corresponding operations according to the specific workflow in the security detection workflow.

[0064] Step S102: determining target configuration information to be called in the system to be tested based on the security detection workflow, and calling the target configuration information through a virtualization scheduling engine.

[0065] In the security detection workflow, the configuration information required to build the simulated target range and attack nodes, namely the target configuration information, is pre-written. This configuration information is used to build the simulation environment required for simulated attack and defense in the virtual storage space pre-divided in the storage medium. It can be understood as a sandbox, and its purpose is to generate a closed simulation environment to avoid affecting the customer's system under test. The security detection scheduling engine can call the corresponding configuration information in the customer's system under test according to the guidance of the security detection workflow to generate subsequent simulated target ranges and attack nodes.

[0066] Step S103, constructing a simulated target range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set.

[0067] After obtaining the specific configuration information of the customer system, we can use container technology to build a closed container in the virtual storage space as a simulation range according to the specific configuration information. The simulation range can be understood as a simulated operating system obtained by simulating the operating environment and business environment of the customer's system under test. Similarly, we build a container as an attack node, but the attack node does not need to simulate the system environment. We only need to install the security components in the security detection component set in the container. The specific security components can be scripts, tools, plug-ins, etc. used for attack.

[0068] Step S104, executing the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and the security detection policy library through the virtual scheduling engine to obtain the simulated attack and defense detection result.

[0069] After the simulated target range and attack nodes are built in the virtual space, the virtual scheduling engine can schedule the attack nodes to attack the simulated target range, that is, the simulated customer system in the virtual memory space, according to the specific process guidance in the security detection workflow and the specific detection strategy in the security detection policy library, and collect specific information such as the response and status of each item to be tested in the simulated target range after the attack as the simulated attack and defense detection result.

[0070] The attack and defense security detection method provided in this embodiment determines the configuration information in the system to be tested and calls it through the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user, so as to build a simulated target range and attack nodes in the virtual storage space pre-divided in the storage medium, thereby realizing the construction of the environment required for the simulated attack in the storage medium, and executing the attack behavior of the attack node on the target range based on the detection workflow and policy library to obtain the attack and defense detection results, which can realize the construction of a lightweight simulated attack environment and reduce resource consumption and cost. At the same time, because the environment is built in the storage medium, the impact of the simulated attack on the host of the system to be tested can be effectively reduced.

[0071] According to an embodiment of the present invention, another attack and defense security detection method embodiment is provided, which can be used for the above-mentioned simulated attack and defense security detection of a specific device or system. Figure 2 is a flow chart of another attack and defense security detection method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0072] Step S201, obtain the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user, the storage medium also includes: a security detection component set, a security detection policy library and a pre-divided virtual storage space. Figure 1 Step S101 of the illustrated embodiment will not be described in detail here.

[0073] Step S202: determine the target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0074] Step S203, constructing a simulated target range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set.

[0075] Specifically, the target configuration information includes: namespace information and system environment information.

[0076] First, for ease of understanding, let's explain the namespace information. Namespace is a kernel-level environment isolation method provided by Linux, and is also the underlying technical principle of container environment isolation. Figure 3 , is an example diagram of an architecture for implementing a container using a namespace according to an embodiment of the present invention. When building a container using the namespace technology, it is necessary to create at least six namespaces, namely Mount, UTS, IPC, PID, Network, and User, using the specific namespace information in the User namespace module in the customer's system under test, i.e., the user namespace module. Specifically, these six namespaces perform the following functions respectively:

[0077] Mount (file system mount), the Mount namespace is used to exercise the function of the file system.

[0078] UTS (host name and domain name) represents the host node. The UTS namespace is used to isolate information related to the host name and domain name.

[0079] IPC (inter-process communication) is used to perform process communication functions. The IPC namespace is used to isolate resources for inter-process communication, including message queues, shared memory, and semaphores.

[0080] PID (Process ID), PID namespace is a root node-related mechanism integrated within the container, which is used to isolate the process ID space.

[0081] Network (user management), the network stack of the container, the Network namespace provides the network stack of the container, which is used to isolate network resources, including network devices, IP addresses, ports, routing tables, etc. Each container can have its own independent network configuration, just like an independent network node.

[0082] User, uses the uid / gid function and is used for the user management system within the container. The User namespace uses the uid / gid function and is used for the user management system within the container.

[0083] The above is only a description and explanation of the namespace mechanism. Its specific operating mechanism will not be repeated here. Only a set of namespaces with these six functions can meet the basic elements of a container, that is, the container can be built.

[0084] System environment information can be understood as the operating environment of the customer's system under test, such as system kernel related information and environment information corresponding to the business carried by the system. This information is used to build a simulation system corresponding to the customer's system under test in the constructed container to ensure the synchronization of the simulation system and the system under test in the actual operating environment as much as possible.

[0085] Specifically, in step S203, a simulated target range and attack nodes are constructed in a pre-divided virtual storage space based on the target configuration information and the security detection component set, including:

[0086] Step S203 - 1 : Generate a first container and a second container in the virtual storage space based on the namespace information.

[0087] Through the namespace sextuple in the target configuration information obtained above, namely, the six namespace information of Mount, UTS, IPC, PID, Network, and User, based on these specific namespace information, a first container for assuming the function of the simulated target range and a second container for assuming the function of the attack node can be built in the virtual storage space inside the storage medium. The specific container construction method will not be repeated here and can be set according to the actual situation.

[0088] Step S203-2, performing simulated environment configuration on the first container according to the system environment information, and determining the first container after the environment configuration is completed as a simulated shooting range.

[0089] The simulation range can be understood as a specially constructed experimental platform for simulating the real network environment and system environment relative to the customer's system to be tested. It is like a virtual "battlefield" that provides a safe and controllable space for attackers and defenders to test various attack methods and defense strategies.

[0090] After completing the construction of the corresponding carrier container, that is, the first container, a series of configurations can be performed on the container according to the system environment information corresponding to the customer system in the target configuration information to obtain a simulated target range corresponding to the customer system for subsequent attack and defense tests.

[0091] Step S203-3: load multiple security detection components in the security detection component set into the second container, determine the loaded second container as an attack node, and the security detection components are used to execute simulated attack behaviors.

[0092] The attack node can be understood as the attacker in the simulated attack and defense, and its role is to launch a series of attacks on the simulated target range to test the security issues within the customer system. Therefore, after the second container for carrying the attack node is constructed, each security component in the security detection component set in the access storage medium can be loaded into the second container to complete the construction of the attack node.

[0093] The above-mentioned attack nodes and simulation ranges can be understood as the attack nodes being the initiators of the attack and the simulation ranges being the defenders of the attack. Through subsequent simulated attack and defense, the actual defense situation of the customer system represented by the simulation range in the face of attack behaviors can be tested, that is, the security of the customer system can be tested.

[0094] Specifically, the system environment information includes: system kernel information and business related information.

[0095] For the customer's system under test, its internal environment includes: the underlying operating environment that supports the operation of various programs or services, and the business environment required for the execution of various services. This can be understood through an example. For customer system A, all its internal programs or services run on the Linux system. The kernel information of the Linux system can be understood as the system kernel information. The specific services or programs running on the system also require the corresponding business operating environment to ensure that these services or programs can be executed smoothly, such as the specific execution platform, plug-ins, system-related components, etc. This information can be understood as the above-mentioned business-related information.

[0096] In the above step S203-2, the first container is configured with a simulated environment according to the system environment information, including:

[0097] A simulated operating environment is constructed in the first container according to the system kernel information, and a simulated business environment is constructed in the first container according to the business association information.

[0098] When configuring the simulation environment for the first container, the underlying operating environment can be built in the container through the system kernel information in the system environment information to obtain a simulated operating environment relative to the client system. At the same time, based on the specific business-related information, the business environment is built on the basis of the underlying simulated operating environment in the first container, and finally the simulation environment configuration for the first container is completed.

[0099] Step S204, performing an initialization check on the simulated shooting range and attack nodes according to a plurality of preset basic check items; if the initialization check is qualified, executing step S205.

[0100] After completing the configuration of the attack node and the simulated target range, you can test the simulated target range and the attack node for multiple preset basic inspection items according to the pre-set program. For example, you can perform initialization checks on the communication, start and stop, and business software scheduling of the containers corresponding to the simulated target range and the attack node. If the test is qualified, you can wait for the security detection workflow to be scheduled, that is, execute the subsequent steps.

[0101] Step S205, executing the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and the security detection policy library through the virtual scheduling engine to obtain the simulated attack and defense detection result.

[0102] Specifically, in step S205, it includes:

[0103] Step S205-1, based on the security detection workflow, execute attack and defense detection of each item to be tested in sequence.

[0104] In step S205-2, when executing the attack and defense detection of each item to be tested, the virtual scheduling engine determines the security detection component corresponding to the item to be tested in the security detection policy library.

[0105] Step S205-3, driving the corresponding security detection component in the attack node through the virtual scheduling engine to attack the target range, and obtaining the simulated attack and defense detection result of the item to be tested.

[0106] It can be understood that the security detection workflow includes multiple process nodes, each process node records the guidance information for a certain item to be tested, and the virtual scheduling engine can execute the scheduling of the attack node based on the specific guidance information in the security detection workflow to perform attack and defense simulations between the attack node and the target range for each item to be tested.

[0107] The security detection strategy library records the security detection components needed for each item to be tested in the simulation shooting range, that is, different attack behaviors corresponding to different items to be tested are executed through different security components.

[0108] When the virtual scheduling engine schedules the attack node to perform the attack and defense detection of the corresponding item to be tested according to the security detection workflow, it is necessary to determine the security detection component corresponding to the current item to be tested in the security detection policy library, so as to schedule the corresponding component in the attack node to implement the attack behavior on the target target range. Similarly, for different items to be tested, the corresponding components are determined through the security detection policy library to perform the corresponding attack behavior. In some cases, a certain item to be tested may correspond to multiple security detection components, and multiple corresponding components need to be scheduled for coordinated attack.

[0109] Furthermore, the security detection strategy library also includes: qualified indicators corresponding to multiple items to be tested.

[0110] After step S205 - 3 , the method further includes step S205 - 4 , in which the simulated attack and defense detection result of the item to be tested is compared with the corresponding qualified index to determine the security assessment result of the item to be tested.

[0111] After the attack node is scheduled to complete the attack on the corresponding test item of the simulated target range, it is necessary to collect the specific protection situation of the simulated target range or the state after the attack as the simulated attack and defense detection result of the corresponding test item. The result is compared with the qualified index of the corresponding test item in the security detection strategy library to determine whether the test item is qualified.

[0112] For example, for item A to be tested, its corresponding security detection component in the security policy library is component X, and the corresponding qualified indicator is no impact. After component X in the scheduling attack node completes the attack on the simulated target range, if the simulated target range successfully blocks the attack behavior through its own protection tools or strategies, and the operation is not affected, it means that the security assessment result of the item to be tested is qualified.

[0113] Furthermore, after completing the attack and defense detection of each item to be tested, the method further includes: step S205-4, generating a security assessment report of the system to be tested based on the security assessment results of each item to be tested.

[0114] After executing the attack and defense simulation of each item to be tested according to the security detection workflow, the security assessment results of each item to be tested can be summarized to generate a security assessment report for the entire system to be tested. The report can display specific information such as the status of each item to be tested after the simulated attack, the gap between the items and the qualified indicators, so that customers can understand the overall security status of the system to be tested.

[0115] The attack and defense security detection method provided by the embodiment of the present invention determines the configuration information in the system to be tested and calls it through the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user, so as to build a simulated target range and attack nodes in the virtual storage space pre-divided in the storage medium, thereby realizing the construction of the environment required for the simulated attack in the storage medium, and executing the attack behavior of the attack node on the target range based on the detection workflow and policy library to obtain the attack and defense detection results, which can realize the construction of a lightweight simulated attack environment and reduce resource consumption and cost. At the same time, because the environment is built in the storage medium, the impact of the simulated attack on the host of the system to be tested can be effectively reduced.

[0116] In order to facilitate understanding of the above method embodiment, according to an embodiment of the present invention, an example diagram of the architecture of a security attack and defense detection software is provided, such as Figure 4 The entire security attack and defense detection software can be integrated into a USB flash drive, and the specific functions of each module are as follows.

[0117] The security inspection workflow is a module responsible for executing the overall logic of security business. Different attack processes are executed according to different industries and security businesses. The workflow makes the security inspection process customizable, modifiable, and loadable. It will not be fixed due to the software version, making it convenient for security practitioners to formulate the process that the software needs to execute according to their own business needs.

[0118] The compliance detection strategy library is a security indicator that needs to be met in real-life scenarios, sorted out by security experts from security scenarios according to relevant security regulations, as well as the means to check each indicator item. It is a transformation of security protection requirements from "document specifications" to "real implementation", from "security requirements" to "execution logic", and is also an important data resource accumulated by the security industry.

[0119] The attack and defense detection toolset is paired with the compliance detection policy library. The policy library determines what to detect and solves the problem of "what to do", while the attack and defense detection toolset stores multiple independent scripts, applets, etc. to solve the problem of "how to test".

[0120] Virtualized storage resources provide a certain amount of storage space here, and are formatted into special partitions. They are not used for storing files, but as virtual storage space for a virtualized environment. Here we need to go back to the principle of namespaces. Namespaces are based on processes. When creating a virtualized environment, a separate mount point needs to be mounted, which means that a portion of the file system space will be opened as a container volume. (The distinction here is not a virtual disk, because what is simulated is not a hardware device, but a mount point in the file system, similar to the concept of logical volumes in LVM.) Since the actual application scenario of this patent is based on the condition of "not changing the customer environment and trying not to occupy customer resources", for the customer's own file system, we "do not copy files", "do not occupy the file system", and "only perform security checks by running programs". The formatted partitions here have been divided into volume groups to prepare for further allocation of space to divide logical volumes and mount them in different namespaces.

[0121] The virtualization scheduling engine is dedicated to scheduling the User namespace module in the host, creating a namespace, and creating and backing up the services, software, and configurations that need to be simulated in the host into the container, and allocating a logical volume of appropriate size from the virtualization storage resources and mounting it into the container to achieve the creation of a customer environment security attack domain, which is the target range. It also bears the responsibility of creating attack node containers, which is equivalent to the process domain target range, but does not simulate the customer environment. Instead, it creates a copy from the built-in namespace template, loads the attack and defense detection tools, and waits for scheduling.

[0122] The security detection result evaluation module is a summary of the attack results. According to each detection item in the compliance detection policy library, the corresponding simulated attack results are collected, and the compliance is judged according to the evaluation criteria of the policy library. Finally, all detection items are summarized and the detection result report is presented to security practitioners for use.

[0123] Specifically, the specific implementation logic of the above security attack and defense detection software when building a lightweight virtualized target range and attack nodes can be referred to Figure 5 , is an example diagram of a lightweight virtualization implementation process according to an embodiment of the present invention.

[0124] First, let's introduce the relevant background knowledge. Virtualization usually refers to two aspects of virtualization, namely hardware virtualization and platform virtualization. Hardware virtualization refers to the simulation software based on the current hardware devices to simulate all the hardware devices required for the operation of a computer system, such as CPU, memory, motherboard, hard disk, input and output devices, etc. The operating system can be installed and the business environment can be built in the simulated hardware platform. Software that implements this function includes VMware, OpenStack, KVM, VirtualBox, etc.

[0125] Platform virtualization refers to simulating an operating system or customizing an operating system platform with components. Unlike hardware virtualization, it is based on the current system kernel and uses containerization technology to build an application layer space similar to that required by the operating system, such as system modules, lib, application components, etc. Software that implements this function include docker, podman, kubernetes, etc.

[0126] For the above lightweight virtualization implementation process example diagram, that is, Figure 5 , mainly explains the process of creating a target range and attacking nodes, as follows:

[0127] The "workflow" of the security detection module obtains the business software information, system-related configuration information, security component information, etc. that need to be collected in the customer system environment.

[0128] The User namespace module of the scheduling client system creates the "namespace six-tuple" required for the container, namely, the six namespace information of Mount, UTS, IPC, PID, Network, and User mentioned in the above embodiment.

[0129] A logical volume is requested from the client system from the virtualized storage resource as the mount point of the file system in the "namespace six-tuple" and the file system is mounted.

[0130] Create a copy and configure the "target range" based on the collected business software information, system-related component information, etc.

[0131] Create a container again as an attack node, and obtain the policy files and detection tools required for this attack and defense detection from the security rule policy library and security detection tool set and load them into the attack node.

[0132] Perform an initial check on the basic check items such as communication, start and stop, and scheduling of business software between the two containers, and wait for the security detection workflow to be scheduled after everything is confirmed to be correct.

[0133] The attack and defense security detection method provided by the embodiment of the present invention has the following advantages: the process of building a simulated target range and attack nodes in the storage medium will not make changes to the file system of the user environment, including creating file copies and any write operations. No software will be installed in the user environment, the system configuration will not be changed, etc., to ensure that there will be no security risks to the customer environment.

[0134] The attack and defense detection component is loaded from an external storage device and has no built-in chips or other computing units. The internal program runs in the node to be tested and the permissions are controllable.

[0135] It does not require huge implementation manpower and hardware resources, automatically collects necessary simulation information of the customer environment, and imports it into the container in the form of created copies. It does not require complex operations such as sorting out the deployment process of business software.

[0136] Since the function of executing virtualization is only to create two nodes of attack and defense, for specific scenarios, the necessary logic is developed from the bottom layer to implement the virtualization engine, and other common modules that are not used are cut off to achieve lightweight and specialization.

[0137] In this embodiment, an attack and defense security detection device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0138] This embodiment provides an attack and defense security detection device, such as Figure 6 As shown, including:

[0139] The resource acquisition module 401 is used to acquire the virtualization scheduling engine and security detection workflow in the storage medium accessed by the user. The storage medium also includes: a security detection component set, a security detection policy library and a pre-divided virtual storage space.

[0140] The configuration calling module 402 is used to determine the target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine.

[0141] The environment building module 403 is used to build a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set.

[0142] The simulated attack module 404 is used to execute the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and the security detection policy library through the virtual scheduling engine to obtain the simulated attack and defense detection results.

[0143] In some optional implementations, the target configuration information includes: namespace information and system environment information;

[0144] The environment building module 403, when building a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set, includes:

[0145] generating a first container and a second container in the virtual storage space based on the namespace information;

[0146] Performing simulated environment configuration on the first container according to the system environment information, and determining the first container after the environment configuration is completed as a simulated shooting range;

[0147] Multiple security detection components in the security detection component set are loaded into a second container, and the loaded second container is determined as an attack node. The security detection components are used to execute simulated attack behaviors.

[0148] In some optional implementations, the system environment information includes: system kernel information and business association information;

[0149] The environment building module 403 performs a simulation environment configuration on the first container according to the system environment information, including:

[0150] A simulated operating environment is constructed in the first container according to the system kernel information, and a simulated business environment is constructed in the first container according to the business association information.

[0151] In some optional implementations, the simulated attack module 404, before executing the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and the security detection policy library through the virtual scheduling engine, is further used to:

[0152] Perform initialization checks on the simulated range and attack nodes based on multiple preset basic check items;

[0153] If the initialization check is qualified, the virtual scheduling engine will execute the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and security detection policy library.

[0154] In some optional implementations, the security detection strategy library includes: security detection components corresponding to each of the plurality of items to be tested;

[0155] The simulated attack module 404, when executing the simulated attack and defense detection of the attack node on the simulated target range based on the security detection workflow and the security detection policy library through the virtual scheduling engine, and obtaining the simulated attack and defense detection result, includes:

[0156] Execute attack and defense detection of each item to be tested in sequence based on the security detection workflow;

[0157] When executing attack and defense detection of each item to be tested, the security detection component corresponding to the item to be tested is determined in the security detection policy library through the virtual scheduling engine;

[0158] The virtual scheduling engine drives the corresponding security detection components in the attack node to attack the target range and obtain the simulated attack and defense detection results of the items to be tested.

[0159] In some optional implementations, the security detection strategy library further includes: qualified indicators corresponding to a plurality of items to be tested;

[0160] After obtaining the simulated attack and defense detection result of the item to be tested, the simulated attack module 404 is further used to:

[0161] Compare the simulated attack and defense detection results of the item to be tested with the corresponding qualified indicators to determine the security assessment results of the item to be tested.

[0162] In some optional implementations, the simulated attack module 404 is further configured to generate a security assessment report of the system to be tested based on the security assessment results of each item to be tested.

[0163] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0164] The attack and defense security detection device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0165] The embodiment of the present invention also provides a computer device having the above Figure 6 The attack and defense security detection device shown.

[0166] See also Figure 7 , Figure 7 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 7As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 7 A processor 10 is taken as an example.

[0167] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0168] The memory 20 stores instructions executable by at least one processor 10, so that at least one processor 10 executes the method shown in the above embodiment.

[0169] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0170] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0171] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 7 The example of connecting through bus is taken in the following.

[0172] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0173] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0174] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. An attack and defense security detection method, characterized in that: The method comprises: Acquire a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, wherein the storage medium also includes: a security detection component set, a security detection policy library, and a pre-divided virtual storage space; Determine the target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine; Constructing a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set; The virtual scheduling engine executes the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library to obtain the simulated attack and defense detection result.

2. The method according to claim 1, characterized in that The target configuration information includes: namespace information and system environment information; The step of constructing a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set includes: generating a first container and a second container in the virtual storage space based on the namespace information; Performing simulated environment configuration on the first container according to the system environment information, and determining the first container after the environment configuration is completed as a simulated shooting range; A plurality of security detection components in the security detection component set are loaded into the second container, and the loaded second container is determined as an attack node, wherein the security detection components are used to execute simulated attack behaviors.

3. The method according to claim 2, characterized in that The system environment information includes: system kernel information and business related information; The performing simulation environment configuration on the first container according to the system environment information includes: A simulated operating environment is constructed in the first container according to the system kernel information, and a simulated business environment is constructed in the first container according to the business association information.

4. The method according to claim 1, characterized in that: Before executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine, the method further includes: Performing an initialization check on the simulated shooting range and the attack node according to a plurality of preset basic check items; If the initialization check is qualified, the step of executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine is executed.

5. The method according to claim 1, characterized in that The security detection strategy library includes: security detection components corresponding to a plurality of items to be tested; The step of executing the simulated attack and defense detection of the simulated shooting range by the attack node based on the security detection workflow and the security detection policy library through the virtual scheduling engine to obtain the simulated attack and defense detection result includes: Based on the security detection workflow, execute attack and defense detection of each item to be tested in sequence; When executing attack and defense detection of each item to be tested, determining the security detection component corresponding to the item to be tested in the security detection strategy library through the virtual scheduling engine; The virtual scheduling engine drives the corresponding security detection component in the attack node to attack the target range, and obtains the simulated attack and defense detection result of the item to be tested.

6. The method according to claim 5, characterized in that The safety detection strategy library also includes: qualified indicators corresponding to a plurality of items to be tested; After obtaining the simulated attack and defense detection result of the item to be tested, the method further includes: The simulated attack and defense detection results of the item to be tested are compared with the corresponding qualified indicators to determine the security assessment results of the item to be tested.

7. The method according to claim 5, characterized in that The method further comprises: A safety assessment report of the system to be tested is generated based on the safety assessment results of each item to be tested.

8. An attack and defense security detection device, characterized in that: The device comprises: A resource acquisition module, used to acquire a virtualization scheduling engine and a security detection workflow in a storage medium accessed by a user, wherein the storage medium also includes: a security detection component set, a security detection policy library, and a pre-divided virtual storage space; A configuration calling module, used to determine target configuration information to be called in the system to be tested based on the security detection workflow, and call the target configuration information through the virtualization scheduling engine; An environment building module, used to build a simulated shooting range and attack nodes in a pre-divided virtual storage space based on the target configuration information and the security detection component set; The simulated attack module is used to execute the simulated attack and defense detection of the attack node on the simulated shooting range based on the security detection workflow and the security detection policy library through a virtual scheduling engine to obtain a simulated attack and defense detection result.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the attack and defense security detection method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the attack and defense security detection method according to any one of claims 1 to 7.

Images