Test method and device for attack and defense drilling

Abstract

The invention discloses a test method and device for attack and defense drilling, and relates to the technical field of data processing. The method comprises the steps that corresponding test scenes are determined according to test requirements, corresponding function modules are obtained based on the test scenes, the function modules are virtual modules with functions needed when attack and defense drill tests are executed in the test scenes, and each test scene at least corresponds to one function module; combining the function modules according to the execution logic to obtain a function link; wherein the execution logic of the function module is consistent with the operation logic of the function corresponding to the function module when the test scene is operated; a protection module and an attack module are inserted into the function link to obtain a test link, and the attack module is a virtual module for simulating the function of an actual attack behavior; the protection module is used for simulating a virtual module for protecting a functional link when an attack behavior exists; and executing the test link, and obtaining a test result. The application is used for realizing the test function of the attack and defense drill.

Description

Technical Field

[0001] The present application relates to the field of digital processing technology, and in particular to a testing method and device for attack and defense drills. Background Art

[0002] With the rapid development of computer networks, the Internet has brought tremendous changes to society. Cyberspace is the "fifth dimension" after land, sea, air and space. Therefore, whether it is as large as a country or as small as an enterprise, the security of its cyberspace is an important prerequisite for ensuring the security of its own data.

[0003] At present, in order to face the attacks in cyberspace, it is generally necessary to simulate the attack situations in various scenarios through attack and defense drills, so as to determine the security loopholes and hidden dangers in cyberspace during the test process of attack and defense drills. However, in practical applications, the test process of conventional attack and defense drills often requires the use of hardware equipment to build a real scene, so as to use the possible attack behaviors in the scene to simulate the actual attack. This leads to the need to consume a lot of manpower and material resources to build the actual scene when the attack and defense drill test is needed. For example, when the attack and defense drill test needs to be carried out during the process of the client logging into the server, it is necessary to use a computer device as the client and another server device as the server, and use the network scene built by the two to perform the attack and defense drill test process. Therefore, the existing attack and defense drill test process has the problem of excessive cost. Summary of the invention

[0004] The embodiments of the present application provide a method and device for testing an attack and defense drill, the main purpose of which is to implement a method for testing an attack and defense drill to solve the problem of excessive cost in the existing attack and defense drill testing process.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides a method for testing an attack and defense drill, the method comprising:

[0007] Determine a corresponding test scenario according to the test requirements, and obtain a corresponding functional module based on the test scenario, wherein the functional module is a virtual module of the functions required when performing the attack and defense drill test in the test scenario, and each of the test scenarios corresponds to at least one functional module;

[0008] Combining the functional modules according to the execution logic to obtain a functional link; wherein the execution logic of the functional modules is consistent with the operation logic of the functions corresponding to the functional modules when the test scenario is executed;

[0009] Inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of an actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists;

[0010] The test link is executed and a test result is obtained, wherein the test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

[0011] In a second aspect, the present application also provides a test device for attack and defense drills, the device comprising:

[0012] An acquisition unit, configured to determine a corresponding test scenario according to a test requirement, and acquire a corresponding functional module based on the test scenario, wherein the functional module is a virtual module having a function required when performing an attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module;

[0013] A combining unit, used to combine the functional modules according to the execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the operation logic of the function corresponding to the functional module when the test scenario is running;

[0014] An inserting unit, used for inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of an actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists;

[0015] An execution unit is used to execute the test link and obtain a test result, wherein the test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

[0016] In a third aspect, the present application further provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the test method of the attack and defense drill described in the first aspect.

[0017] In a fourth aspect, the present application also provides a testing device for attack and defense drills, the device comprising a storage medium; and one or more processors, the storage medium being coupled to the processor, the processor being configured to execute program instructions stored in the storage medium; when the program instructions are executed, the testing method for attack and defense drills described in any one of the first aspects is executed.

[0018] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0019] The present application provides a test method and device for attack and defense drills. The present application can first determine a corresponding test scenario according to a test requirement, and obtain a corresponding functional module based on the test scenario, wherein the functional module is a virtual module of the functions required when executing the attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module; then, the functional modules are combined according to the execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the running logic of the function corresponding to the functional module when the test scenario is running; thereafter, a protection module and an attack module are inserted into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; finally, the test link is executed and a test result is obtained, wherein the test result is used to characterize the impact on the functional link in the test scenario after simulating the attack behavior based on the attack module, thereby realizing the test function of the attack and defense drill. Compared with the prior art, in the present application, during the test process of attack and defense drills, it is no longer necessary to use physical equipment to build test scenarios. Instead, it can be built directly based on virtual modules. That is to say, the functional link obtained by combining functional modules simulates the actual test scenario, and simulates an actual functional scenario in the form of electrical digital signals. This saves the hardware equipment required to build the actual scenario. Therefore, during the test process of attack and defense drills, there is no need for a large amount of material resources to build the scenario required for the test, so that the process of building the scenario saves a lot of hardware equipment, thereby saving costs.

[0020] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0022] Figure 1 A flow chart of a test method for attack and defense drills provided in an embodiment of the present application is shown;

[0023] Figure 2 A flow chart of another attack and defense drill testing method provided in an embodiment of the present application is shown;

[0024] Figure 2-A A schematic diagram showing a functional link during the execution of a test method for attack and defense drills provided in an embodiment of the present application;

[0025] Figure 2-B A schematic diagram showing a functional link during the execution of another attack and defense drill test method provided in an embodiment of the present application;

[0026] Figure 2-C A schematic diagram of a test link during the execution of a test method for attack and defense drills provided in an embodiment of the present application is shown;

[0027] Figure 3 A block diagram showing the composition of a test device for attack and defense drills provided in an embodiment of the present application is shown;

[0028] Figure 4 A block diagram showing the composition of another attack and defense drill testing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0030] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0031] The present application embodiment provides a flow chart of a test method for attack and defense drills, such as Figure 1 As shown, the method includes:

[0032] 101. Determine a corresponding test scenario according to a test requirement, and obtain a corresponding functional module based on the test scenario.

[0033] Among them, the functional module is a virtual module that performs the functions required when executing the attack and defense drill test in the test scenario, and each of the test scenarios corresponds to at least one functional module.

[0034] Since there may be different requirements for attack and defense drills in different situations during the test process of attack and defense drills, the actual test scenarios are also different for different requirements. For example, when testing the security requirements during the login process, it is necessary to use the corresponding login scenario for testing. Therefore, in this embodiment, it is firstly determined which scenario is required for subsequent testing based on the current required test requirements, that is, which test scenario is required. Then, since the functions executed in different test scenarios are different, in this case, when the current required test scenario is determined, it is necessary to obtain the corresponding functional module based on the test scenario. Among them, the functional module can be understood as a virtual module for simulating the various functions required to be executed in the test scenario, that is, the virtual module is actually a modular program that simulates the actual function, which mainly includes the logical operations and other operations required to perform the function. In this way, by "refining" the entire function into a "modular" program of its functional essence, it can be ensured that the hardware equipment required for the actual function is omitted when the basic operation logic of the function is realized, that is, the main operation logic of the function is restored by simulation, so that the actual hardware cost is omitted.

[0035] It should be noted that, in this embodiment, the setting process of the functional module can be performed based on any existing simulation method, which is not limited here. The user can select a suitable setting method based on different simulation platforms according to needs.

[0036] 102. Combine the functional modules according to the execution logic to obtain a functional link.

[0037] The execution logic of the functional module is consistent with the operation logic of the function corresponding to the functional module when the test scenario is running.

[0038] Based on the description of the previous steps, it can be seen that after the test scenario is determined, the functional modules corresponding to the test scenario are obtained, but these functional modules only represent the corresponding functions, and in the actual operation process, these functions are not simply combined at random, but there is a set of logical relationships that conform to the scenario, so in this step, it is necessary to combine these functional modules according to the execution logic, and the execution logic is actually the running logic of the functions corresponding to these functional modules when running in the test scenario. In this way, it can be ensured that in the functional chain obtained after the combination, the logical order of the running functional modules is consistent with the running order of the actual corresponding functions in the scenario, thereby ensuring that the running conditions between the actual functions in the functional chain simulation test scenario are consistent, thereby ensuring the accuracy of subsequent test results.

[0039] 103. Insert a protection module and an attack module into the functional link to obtain a test link.

[0040] The attack module is a virtual module used to simulate the function of the actual attack behavior; the protection module is a virtual module used to simulate the function of protecting the functional link when the attack behavior exists.

[0041] When the functional link has been determined in the above steps, the execution of each function in a certain scenario is actually simulated. Since this embodiment is to realize the test function of a total attack and defense drill, it is necessary to simulate the actual protection of each function in the scenario and the entire process of triggering protection when there is an attack. Therefore, in this step, on the basis of the functional link, it is also necessary to insert a protection module and an attack module. The protection module, as the name implies, is a module for protecting the normal operation of the functional link, and the attack module is a module for simulating attack behavior. In this way, by inserting these two modules into the functional link, the obtained test link can simulate the situation of each protected function in a certain scenario under the existence of attack behavior, thus realizing the needs of attack and defense drill testing.

[0042] Of course, in this embodiment, the number and insertion positions of the protection modules and attack modules are not limited, and the user can select them based on the actual simulation needs.

[0043] 104. Execute the test link and obtain a test result.

[0044] The test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

[0045] After obtaining the test link, the test operation can be performed based on the method of this step. Since the test link contains an attack module that simulates the attack behavior and a protection module that simulates the defense mechanism, the test result obtained is equivalent to simulating the defense situation of the defense mechanism under a real attack behavior, thereby ensuring that the test result can ensure that the test effect of the attack and defense drill is closer to the actual situation and ensures the authenticity of the test result.

[0046] Based on this, the present embodiment provides a test method for attack and defense drills. Compared with the prior art, in the test process of attack and defense drills in the present application, it is no longer necessary to use physical equipment to build test scenarios, but it can be directly built based on virtual modules, that is, the functional link obtained by combining functional modules simulates the actual test scenario, and simulates an actual functional scenario in the form of electrical digital signals, thus eliminating the need for the hardware equipment required to build the actual scenario, so that in the test process of attack and defense drills, a large amount of material resources are not required to build the scenario required for the test, so that the process of building the scenario saves a lot of hardware equipment, which has the effect of saving costs.

[0047] Furthermore, as a further description and refinement of the above-mentioned embodiment, the present application also provides a test of attack and defense drills, specifically as follows: Figure 2 As shown:

[0048] 201. Setting a corresponding virtual module based on the functional parameters of each function in the test scenario to obtain the functional module.

[0049] Each of the functional modules is provided with configuration information simulating a corresponding function.

[0050] Since the present embodiment is a method for implementing attack and defense drill tests, and in this process, as described in the aforementioned embodiment, the construction and setting of the actual scene is implemented based on simulation, then each function in the scene needs to be "refined" into a corresponding virtual module. That is to say, the method described in the present embodiment actually simulates the data processing process of the business processes and attack and defense mechanisms of various information systems through the combination of functional modules. In these functional modules, each module represents a data calculation method, that is, a function, and a combination of multiple modules can simulate a data processing process, that is, a large process formed by multiple functions in the scene.

[0051] 202. Determine a corresponding test scenario according to the test requirements, and obtain a corresponding functional module based on the test scenario.

[0052] Among them, the functional module is a virtual module that performs the functions required when executing the attack and defense drill test in the test scenario, and each of the test scenarios corresponds to at least one functional module.

[0053] Specifically, when the method described in this embodiment is specifically applied, the test scenario includes at least one of a login scenario and an industrial control scenario; the login scenario is used to perform an attack and defense drill test on the login operation, and the industrial control scenario is used to perform an attack and defense drill test on the operation process of the industrial equipment;

[0054] The functional modules include a message processing module, a message judgment module, a message output module and an industrial control module;

[0055] The message processing module is used to process the message content and / or message attributes; the message content is used to represent the data content of the message itself; the message attributes are used to represent the attribute information associated with the message;

[0056] The message judgment module is used to judge the message content and / or message attributes; the message output module is used to output and display the message content or message attributes;

[0057] The industrial control module is used to perform a control operation on the industrial device based on the message content and / or message attributes.

[0058] In practical applications, even login scenarios or industrial control scenarios can be subdivided into various more specific subordinate scenarios. For example, the industrial control scenario can be specifically a scenario for controlling air conditioner equipment, and the login scenario can be specifically a challenge login scenario, etc. Therefore, in this case, the message processing module, message judgment module, message output module and industrial control module in the specific scenario can also be specifically subordinate modules adapted to the specific scenario.

[0059] Here, taking the message processing module as an example, the message processing module can be specifically divided into two categories: a message content processing module and a message attribute processing module. The former mainly processes the message itself, while the latter mainly processes the attribute information corresponding to the message.

[0060] Specifically, the message content processing module can be further divided into the following modules:

[0061] Input module (English abbreviation: msg_write): This module can input data content from the front end and generate a message to enter the information channel.

[0062] Fixed input module (English abbreviation: msg_write_s): This module needs to pre-edit the input content when used. It is triggered when the message flows into the module, and the edited content is generated into a message and passed to the next module.

[0063] File reading module (English abbreviation: file_read): Enter an address for this module, which can read the corresponding file and generate a message based on the file content and pass it to the next module.

[0064] Random number module (abbreviated as random in English): generates a random number and passes it to the next module as the message content.

[0065] Encryption module (encrypt-n): n represents the cryptographic algorithm used by the module, such as encrypt-sm3, which represents the sm3 encryption module. The function of this module is to read the message content, encrypt the content using the corresponding encryption algorithm (the key is built-in), and then pass the ciphertext generated message to the next module.

[0066] Decryption module (English abbreviation: decrypt-n): n code is the cryptographic algorithm used by this module, such as decrypt-sm3, which represents the sm3 decryption module. The function of this module is to read the message content, use the corresponding decryption algorithm (the key is built-in, corresponding to the encryption module) to decrypt the content, and then pass the plaintext generated message to the next module.

[0067] Copy module (English abbreviation: copy-n): After receiving a message, this module copies the message into n pieces and transmits them to n information channels.

[0068] Deciphering module (English abbreviation: decipher-n): n represents the cryptographic algorithm deciphered by the module, such as decipher-sm3, which means that the module is used to decipher the sm3 cryptographic algorithm. Unlike the deciphering module, this module does not read the system's built-in key and attempts to decrypt the message content without a key. If the deciphering is successful, the plaintext generated message will be passed to the next module. If it fails, the ciphertext will continue to be passed.

[0069] Specifically, the message attribute processing module can be further divided into the following modules:

[0070] Attribute adding module (attr-write): The function of this module is to add a key-value pair to the message flowing through the module. The format is (attribute name: attribute value (calculation method)). The key-value pair needs to be defined manually when used. If the message already contains the same attribute name, it will be overwritten with the new attribute value, where the attribute value can be calculated.

[0071] Message content to attribute module (mess-attr): This module receives two messages, one of which is called an attribute message, which contains a special attribute (attrname: attr), indicating that the message content is to be added as an attribute to another message, and the attribute name is the attribute value of the attrname attribute. This module is set to start working only when two messages are received, and pass the message after the attribute is added. When only one message is received, it will wait for another message. When the module receives two messages that contain or do not contain (attrname: attr) attributes at the same time, it will queue the same message, and when another message is received, it will dequeue the message to add the attribute.

[0072] Attribute change module (attr-update): This module needs to simply define the change algorithm when used. The definition form is (attribute name: calculation method). Its function is that when a message flows through this module, if the message contains the attribute corresponding to the attribute name, its attribute value is calculated and assigned according to the defined calculation method. If the calculation method is delate, the attribute is deleted.

[0073] Integrity check module (check-n): n represents the verification algorithm used by this module. The function of this module is to calculate the verification value based on the message content when the message flows through the module, and add it to the message as an attribute. The attribute name is fixed as "n-verification value". If an attribute with this name already exists when the message flows through the module, the verification value is calculated based on the message content and compared with the attribute value. If they are equal, the attribute is added (n-verification result: 1), otherwise the attribute is added (n-verification result: 0).

[0074] It should be noted that the various modules described above are only exemplary. In actual applications, users can set up virtual modules with required functions as functional modules based on their own needs based on the methods in the aforementioned steps. Users can select the above-mentioned modules but not limited to the above-mentioned modules as needed to execute the test method of the attack and defense drill described in this embodiment.

[0075] In this way, by setting modules for different scenarios, it is possible to ensure that corresponding functional modules can be selected for different test scenarios, thereby ensuring the accurate construction of corresponding functional links in the test scenarios, which is conducive to ensuring the accuracy of subsequent test results.

[0076] Furthermore, based on the above description, it can be known that the test scenario can be a login scenario or an industrial control scenario, and the execution methods of this step in these two scenarios are as follows:

[0077] On the one hand, when the test scenario is a login scenario, this step may specifically include:

[0078] When it is determined that the test requirement is a login test, the test scenario is determined to be the login scenario, and a message processing module, a message judgment module, and a message output module corresponding to the login scenario are obtained according to a preset corresponding relationship.

[0079] That is to say, in the login scenario, at least a message processing module is required to receive messages, a message judgment module is required to determine whether the input message is correct, and a message output module is required to output the login results. This ensures that when constructing the login scenario, the three functions of receiving messages, message judgment, and outputting results based on judgment are simulated respectively. In this way, based on these three modules, the subsequent functions required for the login scenario can be realized.

[0080] On the other hand, when the test scenario is an industrial control scenario, this step can be executed as follows:

[0081] When it is determined that the test requirement is an industrial control test, the test scenario is determined to be the industrial control scenario, and a message processing module, a message judgment module, and an industrial control module corresponding to the industrial control scenario are obtained according to a preset corresponding relationship.

[0082] In this industrial control scenario, the message processing module is used to receive the message corresponding to the control instruction, and then judge the message corresponding to the instruction based on the message judgment module, and perform the corresponding control operation in the industrial control module based on the judgment result. In this way, the above three functions can be realized based on these three modules, thereby ensuring the authenticity of the subsequent process of controlling industrial equipment in the actual industrial control scenario.

[0083] 203. Combine the functional modules according to the execution logic to obtain a functional link.

[0084] The execution logic of the functional module is consistent with the operation logic of the function corresponding to the functional module when the test scenario is running.

[0085] Based on the description of the above steps, it can be known that the test scenario can be a login scenario or an industrial control scenario. In the login scenario, this step can be:

[0086] According to the operation logic of the function of each module in the login scenario, the message processing module, the message judgment module and the message output module are combined to obtain a functional link corresponding to the login scenario;

[0087] The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message;

[0088] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message.

[0089] The message output module is used to output target data and / or display a target page based on the judgment result.

[0090] Specifically, based on the method described in this step, the process of building a functional link based on the login scenario can be as follows: Figure 2-A As shown, specifically:

[0091] A command issued by a user to the system is input through the message content receiving module, and then a message is generated and passed to two message attribute receiving modules in succession, so as to add two attribute information to the message corresponding to the login instruction. The attribute information can be in the form of a key-value pair, that is, (user name: name), (password: password), and then passed to the message attribute judgment module to read the attribute information of the message and make a judgment. Assuming that two users are allowed to log in under the current login scenario, that is, there are two judgment criteria, namely (user name 1, guiding branch 1) and (user name 2, guiding branch 2), then three branch guides will be generated in the first message attribute judgment module. Branch 1 represents the user login with the user name of user 1, guiding branch 1. This module has a judgment criterion, that is, when the user name is user 1, it is further confirmed whether the input password is the password corresponding to user 1. If correct, it will continue to be passed back to the message output module in branch 1, and the message output module simulates the output of the target page to be displayed and / or outputs the corresponding target data, thereby representing that the user has successfully logged in as user 1. Similarly, branch 2 indicates that the user has successfully logged in with the username User 2; on the contrary, if the judgment fails in the first message attribute judgment module, the return branch is executed, that is, the username entered by the current user is neither User 1 nor User 2, and if the judgment fails in the subsequent message attribute judgment modules in branch 1 and branch 2, the corresponding return branch is executed, indicating that the password of User 1 or the password of User 2 entered by the current user is incorrect and needs to be re-entered.

[0092] In addition, when the test scenario is determined to be an industrial control scenario, this step may be:

[0093] According to the operation logic of the function of each module in the industrial control scenario, the message processing module, the message judgment module and the industrial control module are combined to obtain a functional link corresponding to the industrial control scenario;

[0094] The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message;

[0095] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message.

[0096] Among them, the industrial control module includes an equipment control module and / or an equipment alarm module, the equipment control module is used to perform corresponding control operations based on the judgment results, and the equipment alarm module is used to feedback alarm information when an abnormality occurs when the equipment performs a control operation.

[0097] Specifically, based on the difference of controlled devices in actual industrial control scenarios, the actual way of forming the above functional links may be slightly different. In this embodiment, when the controlled device is an air conditioner, the specific method may be as follows: Figure 2-B shown, including:

[0098] In this example, a message content receiving module, a message content judgment module, two device control modules and a device alarm module are used. When the air conditioner is running, the temperature of the air conditioner is collected in real time through the message content receiving module, and the temperature is used as the message content, and then transmitted to the message content judgment module. The message content judgment module corresponds to two branches, namely branch 1 and branch 2. In the message content judgment module, its judgment logic follows the following calculation method: when the message content is less than the preset temperature t, it is directed to branch 1, which means that when the current temperature is less than the preset temperature, the message is directed to the device control module in branch 1, and the device control module performs the corresponding control operation. For example, the specific function of the device control module can be to control the air conditioner to change to the heating state so that the temperature continues to increase; for branch 2, when the temperature is higher than the preset temperature t, the message content judgment module transmits the judgment result to branch 2, and the device control module in branch 2 controls the air conditioner to perform the corresponding control operation. For example, the device control module of branch 2 can control the air conditioner to change to the cooling state. When the air conditioner is running, there may be abnormalities in the operation. At this time, the abnormal information can be collected by the equipment alarm module through branch 3 to execute the corresponding alarm function.

[0099] 204. Insert a protection module and an attack module into the functional link to obtain a test link.

[0100] The attack module is a virtual module used to simulate the function of the actual attack behavior; the protection module is a virtual module used to simulate the function of protecting the functional link when the attack behavior exists.

[0101] Furthermore, in the process of inserting the protection module and the attack module, it can be specifically performed in the following manner:

[0102] Determining a first insertion position of the protection module in the functional link according to a protection target of the protection module, and inserting the protection module in the functional link based on the first insertion position, wherein the protection target includes at least one of the functional modules in the functional link;

[0103] A second insertion position of the attack module in the functional link is determined according to the attack mode of the attack module, and the attack module is inserted into the functional link based on the second insertion position. The attack mode is used to characterize the functional module targeted by the attack module in the functional link by simulating attack behavior.

[0104] Since the function of the protection module is to simulate the protection mechanism for one or some functions in the scenario, in this embodiment, when the protection module needs to be inserted, it is necessary to select the insertion position based on the protection target that the user needs to protect, that is, the first insertion position. Similarly, in actual applications, the attack behavior actually has the target it needs to attack, such as tampering or copying certain data. In this case, it is necessary to select the corresponding position based on the attack method of the attack behavior, that is, the second insertion position.

[0105] In the above example Figure 2-B Based on the example, the test link after adding the corresponding attack module and protection module can be as follows Figure 2-C shown, including:

[0106] In this example, in the scenario of controlling the air conditioner, an attack module and a protection module are added, wherein the attack module is used to simulate the situation in which the real-time temperature information sent during the operation of the air conditioner is tampered with, and the protection module is used to detect the real-time temperature sent by the current air conditioner before the message content receiving module receives the tampered temperature information to determine whether it has been tampered with. Here, based on the fact that the attack method occurs before the message is generated, that is, before the message content receiving module determines the temperature as the message content, the attack module is inserted between the message content receiving module and the air conditioner. The protection module serves as a protection defense function to confirm whether the temperature sent by the air conditioner has been tampered with, and the protection target is the message content receiving module in time. Therefore, it must be set at the position closest to the message content receiving module, so it is inserted between the attack module and the message content receiving module.

[0107] It should be noted that the setting positions of the attack module and the protection module described above in this step, that is, the setting positions of the first insertion position and the second insertion position can be set based on the actual scenario, and the order of setting the two can also be selected based on the actual needs of the user and is not limited here. Of course, in some cases, when there are multiple protection functions, multiple protection modules can also be set, and when the protection functions are aimed at different protection targets, the position of each protection module can be different. Similarly, there are many possible attack methods in a scenario. In this case, the number and position of the attack modules set can also be selected based on the needs of the user and are not limited here.

[0108] 205. Execute the test link and obtain a test result.

[0109] The test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

[0110] When the test link is determined, it actually determines the simulation of various functions and situations with protection mechanisms and attack behaviors in a certain scenario. Then, the test link can be executed. Since the test link simulates the actual attack situation and the operation of the corresponding protection mechanism, the test results obtained can reflect the test effect that the protection mechanism can operate normally when attack behaviors occur in the implementation scenario.

[0111] 206. Display the test link and the corresponding test result through a preset interactive interface.

[0112] In order to further improve the convenience of the test process, the current test link and test results can also be displayed through a preset interactive interface. This ensures that during the test process of the attack and defense drill, the simulated scenarios and attack behaviors and the operation of the protection mechanism can be easily and intuitively understood, so that users can understand the test effects of the attack and defense drill more intuitively and conveniently.

[0113] 207. When a modification instruction is received, modify at least one module in the test link based on the modification instruction, and re-execute the test after the modification is completed.

[0114] The modification instruction includes an instruction obtained after a point-selection operation is performed based on the preset interactive interface.

[0115] In some cases, users may need to adjust the test link. For example, Figure 2-C To delete branch 2 in the test link, you can directly click and select based on the preset interactive interface to issue corresponding modification instructions. This intuitive way of modifying the test link can simplify the modification process of the test link, thereby ensuring that the test link needs to be adjusted later for retesting more conveniently.

[0116] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown in the figure, another embodiment of the present application also provides a test device for attack and defense drills. This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. In order to realize a test method for attack and defense drills, the device is specifically as follows Figure 3 As shown, the device comprises:

[0117] The acquisition unit 31 may be used to determine a corresponding test scenario according to a test requirement, and acquire a corresponding functional module based on the test scenario, wherein the functional module is a virtual module of a function required when performing an attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module;

[0118] The combining unit 32 may be used to combine the functional modules acquired by the acquiring unit 31 according to the execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the operation logic of the function corresponding to the functional module when the test scenario is running;

[0119] The inserting unit 33 may be used to insert a protection module and an attack module into the functional link obtained by the combining unit 32 to obtain a test link, wherein the attack module may be a virtual module used to simulate the function of an actual attack behavior; and the protection module may be a virtual module used to simulate the function of protecting the functional link when the attack behavior exists.

[0120] The execution unit 34 can be used to execute the test link obtained by the insertion unit 33 and obtain a test result, wherein the test result can be used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

[0121] Further, such as Figure 4 As shown, the test scenario includes at least one of a login scenario and an industrial control scenario; the login scenario can be used to perform an attack and defense drill test on a login operation, and the industrial control scenario can be used to perform an attack and defense drill test on an industrial equipment operation process;

[0122] The functional modules include a message processing module, a message judgment module, a message output module and an industrial control module;

[0123] The message processing module may be used to process the message content and / or message attributes; the message content may be used to represent the data content of the message itself; the message attributes may be used to represent the attribute information associated with the message;

[0124] The message judgment module can be used to judge the message content and / or message attributes; the message output module can be used to output and display the message content or message attributes;

[0125] The industrial control module may be configured to perform a control operation on the industrial device based on the message content and / or message attributes.

[0126] Further, such as Figure 4 As shown, the insertion unit 33 can be specifically used for the first insertion module, and can be used to determine the first insertion position of the protection module in the functional link according to the protection target of the protection module, and insert the protection module in the functional link based on the first insertion position, and the protection target includes at least one of the functional modules in the functional link;

[0127] The insertion unit 33 can also be specifically used to determine a second insertion position of the attack module in the functional link according to the attack mode of the attack module, and insert the attack module in the functional link based on the second insertion position. The attack mode can be used to characterize the functional module targeted by the attack module in the functional link by simulating attack behavior.

[0128] Further, such as Figure 4 As shown, the acquisition unit 31 can be specifically used to determine that the test scenario is the login scenario when it is determined that the test requirement is a login test, and acquire the message processing module, the message judgment module, and the message output module corresponding to the login scenario according to the preset corresponding relationship;

[0129] The combining unit 32 may be specifically configured to combine the message processing module, the message judging module and the message output module according to the operation logic of the function of each module in the login scenario to obtain a functional link corresponding to the login scenario;

[0130] The message processing module includes a message content receiving module and / or a message attribute receiving module. The message content receiving module can be used to receive the message itself, and the message attribute receiving module can be used to receive attribute information of the message.

[0131] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module can be used to determine the message itself, and the message attribute determination module can be used to determine the attribute information of the message.

[0132] The message output module may be used to output target data and / or display a target page based on the judgment result.

[0133] Further, such as Figure 4 As shown, the acquisition unit 31 can also be specifically used to determine that the test scenario is the industrial control scenario when it is determined that the test requirement is an industrial control test, and acquire the message processing module, the message judgment module, and the industrial control module corresponding to the industrial control scenario according to a preset corresponding relationship;

[0134] The combining unit 32 may also be specifically configured to combine the message processing module, the message determination module and the industrial control module according to the operation logic of the function of each module in the industrial control scenario to obtain a functional link corresponding to the industrial control scenario;

[0135] The message processing module includes a message content receiving module and / or a message attribute receiving module. The message content receiving module can be used to receive the message itself, and the message attribute receiving module can be used to receive the attribute information of the message.

[0136] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module can be used to determine the message itself, and the message attribute determination module can be used to determine the attribute information of the message.

[0137] Among them, the industrial control module includes a device control module and / or a device alarm module. The device control module can be used to perform corresponding control operations based on the judgment results, and the device alarm module can be used to feedback alarm information when an abnormality occurs when the device performs a control operation.

[0138] Further, such as Figure 4 As shown, the device also includes:

[0139] A display unit 35 may be used to display the test link and the corresponding test result obtained by the execution unit 34 through a preset interactive interface;

[0140] The modification unit 36 ​​may be configured to modify at least one module in the test link displayed by the display unit 35 based on the modification instruction when receiving the modification instruction, and re-execute the test after the modification is completed, wherein the modification instruction includes an instruction obtained by performing a point selection operation based on the preset interactive interface;

[0141] Further, such as Figure 4 As shown, the device also includes:

[0142] The setting unit 37 can be used to set the corresponding virtual module based on the functional parameters of each function in the test scenario to obtain the functional module, wherein each functional module is provided with configuration information for simulating the corresponding function. So that the acquisition unit 31 selects the corresponding functional module based on the test scenario.

[0143] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned attack and defense drill test method.

[0144] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application also provides a testing device for attack and defense drills, the device comprising a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are run, the above-mentioned attack and defense drill testing method is executed.

[0145] The embodiment of the present application provides a test method and device for attack and defense drills. The present application can first determine the corresponding test scenario according to the test requirements, and obtain the corresponding functional module based on the test scenario, wherein the functional module is a virtual module of the functions required when executing the attack and defense drill test in the test scenario, and each of the test scenarios corresponds to at least one functional module; then, the functional modules are combined according to the execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the running logic of the function corresponding to the functional module when the test scenario is running; thereafter, a protection module and an attack module are inserted into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; finally, the test link is executed and a test result is obtained, wherein the test result is used to characterize the impact on the functional link in the test scenario after simulating the attack behavior based on the attack module, thereby realizing the test function of the attack and defense drill. Compared with the prior art, in the present application, during the test process of attack and defense drills, it is no longer necessary to use physical equipment to build test scenarios. Instead, it can be built directly based on virtual modules. That is to say, the functional link obtained by combining functional modules simulates the actual test scenario, and simulates an actual functional scenario in the form of electrical digital signals. This saves the hardware equipment required to build the actual scenario. Therefore, during the test process of attack and defense drills, there is no need for a large amount of material resources to build the scenario required for the test, so that the process of building the scenario saves a lot of hardware equipment, thereby saving costs.

[0146] The test device for the attack and defense drill includes a processor and a memory. The above-mentioned acquisition unit, combination unit, insertion unit and execution unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0147] The processor includes a kernel, and the kernel calls the corresponding program unit from the memory. One or more kernels can be set, and a test method of attack and defense drills is implemented by adjusting kernel parameters to solve the problem of excessive cost in the existing attack and defense drill test process.

[0148] An embodiment of the present application provides a test device for attack and defense drills, the device comprising a storage medium; and one or more processors, the storage medium is coupled to the processor, the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the test method for attack and defense drills described in any one of the above items is executed.

[0149] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned attack and defense drill test method.

[0150] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0151] An embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: determining a corresponding test scenario according to a test requirement, and acquiring a corresponding functional module based on the test scenario, wherein the functional module is a virtual module having functions required when executing an attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module; combining the functional modules according to an execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the running logic of the function corresponding to the functional module when the test scenario is running; inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of an actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; executing the test link and obtaining a test result, wherein the test result is used to characterize the impact on the functional link in the test scenario after simulating the attack behavior based on the attack module.

[0152] Furthermore, the test scenario includes at least one of a login scenario and an industrial control scenario; the login scenario is used to perform an attack and defense drill test on the login operation, and the industrial control scenario is used to perform an attack and defense drill test on the operation process of the industrial equipment;

[0153] The functional modules include a message processing module, a message judgment module, a message output module and an industrial control module;

[0154] The message processing module is used to process the message content and / or message attributes; the message content is used to represent the data content of the message itself; the message attributes are used to represent the attribute information associated with the message;

[0155] The message judgment module is used to judge the message content and / or message attributes; the message output module is used to output and display the message content or message attributes;

[0156] The industrial control module is used to perform a control operation on the industrial device based on the message content and / or message attributes.

[0157] Further, inserting a protection module and an attack module into the functional link to obtain a test link includes:

[0158] Determining a first insertion position of the protection module in the functional link according to a protection target of the protection module, and inserting the protection module in the functional link based on the first insertion position, wherein the protection target includes at least one of the functional modules in the functional link;

[0159] A second insertion position of the attack module in the functional link is determined according to the attack mode of the attack module, and the attack module is inserted into the functional link based on the second insertion position. The attack mode is used to characterize the functional module targeted by the attack module in the functional link by simulating attack behavior.

[0160] Further, determining a corresponding test scenario according to the test requirements, and acquiring a corresponding functional module based on the test scenario, includes:

[0161] When it is determined that the test requirement is a login test, the test scenario is determined to be the login scenario, and a message processing module, a message judgment module, and a message output module corresponding to the login scenario are obtained according to a preset corresponding relationship;

[0162] Combining the functional modules according to the execution logic to obtain a functional link includes:

[0163] According to the operation logic of the function of each module in the login scenario, the message processing module, the message judgment module and the message output module are combined to obtain a functional link corresponding to the login scenario;

[0164] The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message;

[0165] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message.

[0166] The message output module is used to output target data and / or display a target page based on the judgment result.

[0167] Further, determining a corresponding test scenario according to the test requirements, and acquiring a corresponding functional module based on the test scenario, includes:

[0168] When it is determined that the test requirement is an industrial control test, the test scenario is determined to be the industrial control scenario, and a message processing module, a message judgment module, and an industrial control module corresponding to the industrial control scenario are obtained according to a preset corresponding relationship;

[0169] Combining the functional modules according to the execution logic to obtain a functional link includes:

[0170] According to the operation logic of the function of each module in the industrial control scenario, the message processing module, the message judgment module and the industrial control module are combined to obtain a functional link corresponding to the industrial control scenario;

[0171] The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message;

[0172] The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message.

[0173] Among them, the industrial control module includes an equipment control module and / or an equipment alarm module, the equipment control module is used to perform corresponding control operations based on the judgment results, and the equipment alarm module is used to feedback alarm information when an abnormality occurs when the equipment performs a control operation.

[0174] Further, after executing the test link and obtaining the test result, the method further includes:

[0175] Display the test link and the corresponding test result through a preset interactive interface;

[0176] When a modification instruction is received, modify at least one module in the test link based on the modification instruction, and re-execute the test after the modification is completed, wherein the modification instruction includes an instruction obtained by performing a point selection operation based on the preset interactive interface;

[0177] Furthermore, before determining the corresponding test scenario according to the test requirements and acquiring the corresponding functional module based on the test scenario, the method further includes:

[0178] The corresponding virtual module is set based on the functional parameters of each function in the test scenario to obtain the functional module, wherein each of the functional modules is provided with configuration information for simulating the corresponding function.

[0179] The present application also provides a computer program product, which can execute corresponding functions, including: after metadata is generated in a generation environment, transmitting the metadata to a computing environment; determining a corresponding test scenario according to test requirements, and acquiring a corresponding functional module based on the test scenario, wherein the functional module is a virtual module of the functions required when executing an attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module; combining the functional modules according to execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the running logic of the function corresponding to the functional module when the test scenario is running; inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; executing the test link and obtaining a test result, wherein the test result is used to characterize the impact on the functional link in the test scenario after simulating the attack behavior based on the attack module.

[0180] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0181] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1A device that provides the functions specified in a block or multiple blocks.

[0182] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0183] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0184] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0185] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0186] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0187] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0188] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0189] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A test method for attack and defense drills, characterized in that: The method comprises: Determine a corresponding test scenario according to the test requirements, and obtain a corresponding functional module based on the test scenario, wherein the functional module is a virtual module of the functions required when performing the attack and defense drill test in the test scenario, and each of the test scenarios corresponds to at least one functional module; Combining the functional modules according to the execution logic to obtain a functional link; wherein the execution logic of the functional modules is consistent with the operation logic of the functions corresponding to the functional modules when the test scenario is executed; Inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of an actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; The test link is executed and a test result is obtained, wherein the test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

2. The method according to claim 1, characterized in that The test scenario includes at least one of a login scenario and an industrial control scenario; the login scenario is used to perform an attack and defense drill test on the login operation, and the industrial control scenario is used to perform an attack and defense drill test on the operation process of the industrial equipment; The functional modules include a message processing module, a message judgment module, a message output module and an industrial control module; The message processing module is used to process the message content and / or message attributes; the message content is used to represent the data content of the message itself; the message attributes are used to represent the attribute information associated with the message; The message judgment module is used to judge the message content and / or message attributes; the message output module is used to output and display the message content or message attributes; The industrial control module is used to perform a control operation on the industrial device based on the message content and / or message attributes.

3. The method according to claim 1, characterized in that Inserting a protection module and an attack module into the functional link to obtain a test link comprises: Determining a first insertion position of the protection module in the functional link according to a protection target of the protection module, and inserting the protection module in the functional link based on the first insertion position, wherein the protection target includes at least one of the functional modules in the functional link; A second insertion position of the attack module in the functional link is determined according to the attack mode of the attack module, and the attack module is inserted into the functional link based on the second insertion position. The attack mode is used to characterize the functional module targeted by the attack module in the functional link by simulating attack behavior.

4. The method according to claim 2, characterized in that: Determining the corresponding test scenario according to the test requirements, and acquiring the corresponding functional module based on the test scenario, includes: When it is determined that the test requirement is a login test, the test scenario is determined to be the login scenario, and a message processing module, a message judgment module, and a message output module corresponding to the login scenario are obtained according to a preset corresponding relationship; Combining the functional modules according to the execution logic to obtain a functional link includes: According to the operation logic of the function of each module in the login scenario, the message processing module, the message judgment module and the message output module are combined to obtain a functional link corresponding to the login scenario; The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message; The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message. The message output module is used to output target data and / or display a target page based on the judgment result.

5. The method according to claim 2, characterized in that: Determining the corresponding test scenario according to the test requirements, and acquiring the corresponding functional module based on the test scenario, includes: When it is determined that the test requirement is an industrial control test, the test scenario is determined to be the industrial control scenario, and a message processing module, a message judgment module, and an industrial control module corresponding to the industrial control scenario are obtained according to a preset corresponding relationship; Combining the functional modules according to the execution logic to obtain a functional link includes: According to the operation logic of the function of each module in the industrial control scenario, the message processing module, the message judgment module and the industrial control module are combined to obtain a functional link corresponding to the industrial control scenario; The message processing module includes a message content receiving module and / or a message attribute receiving module, wherein the message content receiving module is used to receive the message itself, and the message attribute receiving module is used to receive the attribute information of the message; The message determination module includes a message content determination module and / or a message attribute determination module. The message content determination module is used to determine the message itself, and the message attribute determination module is used to determine the attribute information of the message. Among them, the industrial control module includes an equipment control module and / or an equipment alarm module, the equipment control module is used to perform corresponding control operations based on the judgment results, and the equipment alarm module is used to feedback alarm information when an abnormality occurs when the equipment performs a control operation.

6. The method according to claim 1, characterized in that After executing the test link and obtaining the test result, the method further includes: Display the test link and the corresponding test result through a preset interactive interface; When a modification instruction is received, at least one module in the test link is modified based on the modification instruction, and the test is re-executed after the modification is completed, wherein the modification instruction includes an instruction obtained by performing a point selection operation based on the preset interactive interface.

7. The method according to claim 1, characterized in that Before determining the corresponding test scenario according to the test requirements and acquiring the corresponding functional module based on the test scenario, the method further includes: The corresponding virtual module is set based on the functional parameters of each function in the test scenario to obtain the functional module, wherein each of the functional modules is provided with configuration information for simulating the corresponding function.

8. A test device for attack and defense drills, characterized in that: The device comprises: An acquisition unit, configured to determine a corresponding test scenario according to a test requirement, and acquire a corresponding functional module based on the test scenario, wherein the functional module is a virtual module having a function required when performing an attack and defense drill test in the test scenario, and each test scenario corresponds to at least one functional module; A combining unit, used to combine the functional modules according to the execution logic to obtain a functional link; wherein the execution logic of the functional module is consistent with the operation logic of the function corresponding to the functional module when the test scenario is running; An inserting unit, used for inserting a protection module and an attack module into the functional link to obtain a test link, wherein the attack module is a virtual module for simulating the function of an actual attack behavior; and the protection module is a virtual module for simulating the function of protecting the functional link when the attack behavior exists; An execution unit is used to execute the test link and obtain a test result, wherein the test result is used to characterize the impact on the functional link in the test scenario after the attack behavior is simulated based on the attack module.

9. A storage medium, characterized in that: The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the attack and defense drill testing method described in any one of claims 1-7.

10. A test device for attack and defense drills, characterized in that: The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the attack and defense drill testing method described in any one of claims 1-7 is executed.

Images