Network range creation method and device, electronic equipment, storage medium and program

Abstract

The embodiment of the invention discloses a network target range creating method and device, electronic equipment, a storage medium and a program, and the method comprises the steps: obtaining network topology equipment association information of a target actual network topology; constructing a typical network topology structure of the target actual network topology according to the network topology equipment association information; configuring a simulation target for virtual network equipment in the typical network topology structure according to the network topology equipment association information; and creating a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure. According to the technical scheme provided by the embodiment of the invention, the simulation fidelity of the network target range can be improved, so that the safety and reliability of the existing network equipment maintained based on the network target range are improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a network range creation method, device, electronic device, storage medium and program. Background Art

[0002] With the rapid development of the Internet and the widespread application of information technology, network security issues have become increasingly prominent. In this era of the Internet of Everything, the Internet has become an important platform for people's lives and work. However, at the same time, network attacks have become more and more frequent, and cyberspace is facing unprecedented security challenges. In order to cope with this severe situation, a cyber range can be established according to needs.

[0003] A cyber range is a technology or product that simulates and reproduces the operating status and operating environment of network architecture, system equipment, and business processes in real cyberspace based on virtualization technology. It aims to realize activities such as learning, research, testing, competition, and exercises related to cybersecurity, thereby improving the cybersecurity confrontation capabilities and levels of personnel and institutions. A cyber range can simulate a real cyber attack and defense combat environment, provide real-time feedback, and increase the pertinence and value of training.

[0004] Considering the real-time nature and high reliability of network application services, it is unrealistic to conduct network attack drills or penetration test research directly on the user's business network. The risk is too high, so the general practice is to build a virtual network range for drills or tests. Due to the complexity of the existing network environment, the simulation construction process of the network range faces the problem of unrealistic simulation and no real simulation. At present, the simulated network range is generally constructed based on typical security events and typical network topology to simulate a real network environment. There is no necessary connection between the constructed simulated range and the real business network. Summary of the invention

[0005] The embodiments of the present invention provide a network range creation method, device, electronic device, storage medium and program, which can improve the simulation fidelity of the network range, and further improve the security and reliability of existing network equipment maintained based on the network range.

[0006] According to one aspect of the present invention, a method for creating a network range is provided, comprising:

[0007] Obtain network topology device association information of the target actual network topology;

[0008] Constructing a typical network topology structure of the target actual network topology according to the network topology device association information;

[0009] According to the network topology device association information, a simulation target is configured for the virtual network device in the typical network topology structure;

[0010] A typical network target range corresponding to the target actual network topology is created according to the simulation target and the typical network topology structure.

[0011] According to another aspect of the present invention, there is provided a network range creation device, comprising:

[0012] A network topology device association information acquisition module is used to acquire network topology device association information of a target actual network topology;

[0013] A typical network topology structure building module, used to build a typical network topology structure of the target actual network topology according to the network topology device association information;

[0014] A simulation target configuration module, used for configuring a simulation target for the typical network topology structure;

[0015] A typical network target range creation module is used to generate a typical network target range corresponding to the target actual network topology based on the simulation target and the typical network topology structure.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network target range creation method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network range creation method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, which, when executed by a processor, implements the network range creation method described in any embodiment of the present invention.

[0022] The embodiments of the present invention obtain network topology device association information of the target actual network topology to construct a typical network topology structure of the target actual network topology according to the network topology device association information, and further configure a simulation target for the typical network topology structure, so as to generate a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure, thereby solving the problem that the existing network target range creation method is difficult to highly simulate the existing network devices, and can improve the simulation fidelity of the network target range, thereby improving the safety and reliability of the existing network devices maintained based on the network target range.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a method for creating a network range provided in Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a method for creating a network range provided in Embodiment 2 of the present invention;

[0027] Figure 3 It is a structural diagram of a network range construction system provided by Embodiment 2 of the present invention;

[0028] Figure 4 is a schematic diagram of an initial network topology structure provided by Embodiment 2 of the present invention;

[0029] Figure 5 is a schematic diagram of an optimized network topology structure provided by Embodiment 2 of the present invention;

[0030] Figure 6 is a schematic diagram of a typical network topology structure provided by Embodiment 2 of the present invention;

[0031] Figure 7 This is a schematic diagram of the effect of the simulation degree of a simulation target provided by the second embodiment of the present invention;

[0032] Figure 8 This is a schematic diagram of a system structure for performing security verification on a typical network target range provided by Embodiment 2 of the present invention;

[0033] Fig. 9 It is a schematic diagram of a network range creation device provided by Embodiment 3 of the present invention;

[0034] Fig.10 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] Embodiment 1

[0038] Figure 1 This is a flowchart of a network range creation method provided by the first embodiment of the present invention. This embodiment is applicable to the case where a simulation target is configured for a typical network topology structure created according to an actual network topology structure to simulate the creation of a typical network range. The method can be executed by a network range creation device, which can be implemented by software and / or hardware, and can generally be integrated in an electronic device. The electronic device can be a terminal device or a server device. As long as it can execute the network range creation method, the embodiment of the present invention does not limit the specific device type of the electronic device. Accordingly, Figure 1 As shown, the method includes the following operations:

[0039] S110 , obtaining network topology device association information of the target actual network topology.

[0040] The target actual network topology may be a network topology structure that needs to be simulated to create a corresponding network target range. The network topology structure is a real topology structure constructed by various real network devices. The network topology device association information may be the network topology structure in the target actual network topology and the related information of the network devices constituting the target actual network topology.

[0041] In an embodiment of the present invention, in order to improve the high degree of matching between the network target range and the corresponding actual network, the actual network topology used for reference in creating the network target range can be determined as the target actual network topology, and information on the network topology structure of the target actual network topology and related information of the network devices can be obtained as network topology device association information of the target actual network topology.

[0042] Exemplarily, the network topology structure of the target actual network topology may include but is not limited to the connection relationship between each network device. The relevant information of the network device of the target actual network topology may include but is not limited to the device type, operating system, and device communication address, etc., which are related information needed to be referenced for building the network target site.

[0043] S120: Construct a typical network topology structure of the target actual network topology according to the network topology device association information.

[0044] The typical network topology structure may be a topology structure that is highly similar to the target actual network topology structure.

[0045] Accordingly, after obtaining the network topology device association information of the target actual network topology, the network topology device association information of the target actual network topology can be used as a reference to determine the network topology structure information of the target actual network topology, thereby simulating the target actual network topology to construct a virtual network topology structure that is highly similar to the target actual network topology as a typical network topology structure adapted to the target actual network topology. It can be understood that each network node device included in the typical network topology structure is a virtual abstract network device.

[0046] S130: configuring simulation targets for virtual network devices in the typical network topology structure according to the network topology device association information.

[0047] Among them, it can be a virtual abstract network device that constitutes a typical network topology. The simulation target can be various software entities to be simulated, for example, it can include but not be limited to various operating systems, software and related services required by the corresponding real network device to simulate the virtual network device when it actually runs in the target actual network topology.

[0048] It should be noted that the existing network range creation methods are basically based on the simulation environment. A virtual simulation environment is created in advance as needed to generate the corresponding network range. Alternatively, some related technologies directly construct a network range based on the actual network topology structure without considering the matching relationship between the virtual network devices and the real network devices in the network range. Therefore. The network range created by the target network range creation method has a low degree of simulation and a low degree of matching with the actual network topology structure.

[0049] To solve the above problems, after constructing a typical network topology structure corresponding to the target actual network topology based on the network topology device association information, the embodiment of the present invention further uses it as a benchmark to configure various simulation targets such as the operating system, software installed in the device, and service types used by the device for the typical network topology structure, so that the typical network topology structure can further highly simulate the real network devices in the target actual network topology in terms of function and performance.

[0050] S140. Create a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure.

[0051] Among them, the typical network target range is also a network target range that simulates the actual network topology of the target.

[0052] Correspondingly, after configuring the simulation target for the typical network topology according to the relevant information of the actual network equipment, a typical network target range corresponding to the target actual network topology can be generated based on the simulation target and the typical network topology.

[0053] It can be seen that the typical network range created by the network range creation method provided by the embodiment of the present invention can not only highly match the target actual network topology in terms of network topology structure, but also the functions and performances of the network devices in the network topology structure can highly match the network devices in the target actual network topology, thereby truly realizing a high degree of simulation of the existing network devices and improving the simulation fidelity of the network range. Since the simulation fidelity of the network range is high, it can truly simulate the actual network resources. Therefore, when maintenance measures are taken on the actual network resources based on the typical network range, such as determining to reinforce and upgrade the actual network resources of the target actual network topology based on the attack and reinforcement simulation operations of the network range, the risk of impact on the actual existing network equipment can be reduced, thereby improving the stability and reliability of the maintenance measures for the actual existing network equipment, which has high economic value and practical significance.

[0054] The embodiments of the present invention obtain network topology device association information of the target actual network topology to construct a typical network topology structure of the target actual network topology according to the network topology device association information, and further configure a simulation target for the typical network topology structure, so as to generate a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure, thereby solving the problem that the existing network target range creation method is difficult to highly simulate the existing network devices, and can improve the simulation fidelity of the network target range, thereby improving the safety and reliability of the existing network devices maintained based on the network target range.

[0055] Embodiment 2

[0056] Figure 2 This is a flowchart of a network range creation method provided by the second embodiment of the present invention. This embodiment is specific based on the above embodiment. In this embodiment, a typical network topology structure of the target actual network topology is constructed according to the network topology device association information, a simulation target is configured for the virtual network device in the typical network topology structure according to the network topology device association information, and a typical network range corresponding to the target actual network topology is created according to the simulation target and the typical network topology structure. Correspondingly, as Figure 2 As shown, the method of this embodiment may include:

[0057] S210. Obtain network topology device association information of a target actual network topology; the network topology device association information includes device login information of network devices in the target actual network topology.

[0058] Among them, the device login information can be used to log in to the network device in the target actual network topology.

[0059] S220, querying the adjacent network devices of each network device within the network address simulation range of the target actual network topology according to the device login information, and constructing an initial network topology structure of the target actual network topology according to the association relationship between the network devices.

[0060] The initial network topology structure may be a network topology structure initially constructed according to network topology device association information of the target actual network topology.

[0061] In an embodiment of the present invention, the initial network topology structure initially constructed based on the network topology device association information of the target actual network topology includes the connection relationship between and . The connection relationship between and included in the initial network topology structure is simulated and constructed based on the connection relationship between the real network devices and the real network devices in the target actual network topology, and can effectively simulate the actual connection relationship between the real network devices in the target actual network topology.

[0062] In an optional embodiment of the present invention, the acquisition of network topology device association information of the target actual network topology may include: determining the network address simulation range of the target actual network topology based on the network address range information of the target actual network topology; acquiring network device fingerprint information of the network devices included in the network address simulation range; acquiring device login information of the network devices included in the network address simulation range based on the network device fingerprint information; and using the device login information as the network topology device association information.

[0063] Figure 3 is a schematic diagram of the structure of a network range construction system provided by Embodiment 2 of the present invention. In a specific example, Figure 3 As shown, the network range construction system may include various functional modules such as a topology discovery module, a typical topology generation module, an environment construction module, and a security verification module. Among them, the main function of the topology discovery module is to complete the generation of the initial network topology structure. The generation process of the initial network topology structure is as follows: receiving the network address range input by the user end, determining the user network address range of this simulation, and using it as the network address range information of the target actual network topology. Obtain the network devices included in the network address simulation range and the network device fingerprint information of each network device. Exemplarily, the network device fingerprint information may include but is not limited to information such as IP (Internet Protocol) address, MAC (Media Access Control Address, Media Access Control Address) address, device type, and operating system. It can be understood that the process of obtaining the network device fingerprint information of each network device is actually the process of asset discovery. When the network device can be discovered, it means that the network device is communicable to the outside. Further, the corresponding network device information in the system asset library can be queried based on the acquired network device fingerprint information, thereby generating an initial network topology structure. Specifically, the device login information of the corresponding network device can be searched in the system asset library according to the network device fingerprint information, and then the real network device can be logged in according to the device login information obtained to discover the adjacent network devices of each real network device. Optionally, the Link Layer Discovery Protocol (LLDP) can be used to discover the adjacent network devices based on the logged-in real network device. Accordingly, according to the real network devices obtained in the asset discovery process, combined with the information of their adjacent network devices, the association relationship between the network devices is determined, so as to generate the initial network topology structure of the target actual network topology according to the association relationship between the network devices.

[0064] Figure 4 is a schematic diagram of an initial network topology structure provided by Embodiment 2 of the present invention. In a specific example, Figure 4 As shown, the initial network topology may include various discovered network devices, such as R1, SW1, and PC11-PC62. R1 may represent a router device simulated from a real router device, SW1 may represent a switch device simulated from a real switch device, and PC11-PC62 may represent network devices simulated from real servers and various types of network devices such as computers. The embodiment of the present invention does not limit the specific device types of virtual network devices included in the initial network topology.

[0065] S230: Optimize the initial network topology structure to obtain an optimized network topology structure.

[0066] The optimized network topology structure may be a network topology structure obtained after optimizing the initial network topology structure.

[0067] It is understandable that the connection relationships included in the initial network topology may not be comprehensive enough, and there may be isolated devices, which cannot fully simulate the actual connection relationships between real network devices in the actual network topology of the simulation target. Therefore, after obtaining the initial network topology, the missing connection relationships in the initial network topology can be supplemented to optimize the initial network topology and obtain an optimized network topology.

[0068] In an optional embodiment of the present invention, the optimizing the initial network topology structure to obtain the optimized network topology structure may include: determining an isolated point device in the initial network topology structure; configuring a logical switching device for the isolated point device; wherein the logical switching device includes a logical switch and a logical router; configuring a cloud network between the logical router and the virtual router in the initial network topology structure to obtain the optimized network topology structure.

[0069] Among them, an isolated point device can be an isolated network device that has no connection relationship with other network devices. A logical switching device can be a switching device that satisfies a logical communication relationship. A logical switch can be a switch device that satisfies a logical communication relationship. A logical router can be a router device that satisfies a logical communication relationship.

[0070] Optionally, the initial network topology can be optimized by supplementing the configuration of logical switching devices such as logical switches and logical routers. Specifically, the initial network topology can first screen out isolated devices that have no connection relationship between other network devices, and configure logical switches and logical routers for the isolated devices to connect the isolated devices. Furthermore, the corresponding logical routers are configured for the logical switches, and a cloud network is configured between the logical routers and the virtual routers in the initial network topology, so that each isolated device can communicate and connect with other network devices logically, thereby obtaining an optimized network topology.

[0071] In an optional embodiment of the present invention, configuring a logical switching device for the isolated point device may include: when it is determined that the number of the isolated point devices is multiple, classifying each of the isolated point devices according to the subnet range to obtain an isolated point device classification set; wherein each of the isolated point device classification sets includes isolated point devices in a subnet range; configuring a logical switch for each of the isolated point device classification sets; wherein each of the isolated point devices included in the isolated point device classification set is communicatively connected to the corresponding logical switch; configuring a logical router for each of the logical switches; wherein the logical switch is communicatively connected to the logical router.

[0072] The isolated point device classification set may be a classification set that divides isolated point devices according to subnet areas, that is, each of the isolated point device classification sets may include isolated point devices within a subnet range.

[0073] Specifically, each isolated point device can be divided according to the subnet range to which it belongs, and the isolated point devices within a subnet range can be divided into an isolated point device classification set. Furthermore, each isolated point device classification set can be configured with a corresponding logical switch, and the logical switch can communicate with the isolated point devices in the corresponding isolated point device classification set. At the same time, each logical switch is configured with a logical router, and each logical switch can also communicate with the logical router. If there is only one isolated point device, a subnet area can be determined for the isolated point device alone, and a logical switch and a logical router can be configured.

[0074] Figure 5 is a schematic diagram of an optimized network topology structure provided by Embodiment 2 of the present invention. In a specific example, Figure 4 and Figure 5 As shown, optional, you can Figure 4 The initial network topology structure shown in the figure is divided into subnet areas. For subnets that do not include switch devices, a new logical switch can be created for them, such as Figure 5As shown in SWv1 and SWv2, an isolated device in a subnet can be configured with a logical switch, and each logical switch can be connected to the same logical router Rv. Furthermore, a cloud network cloud is configured for the entire network topology, and the virtual router devices corresponding to the logical router and the real router are connected through the cloud network, indicating that the networks between them are connected. Figure 4 The optimized network topology structure formed after the initial network topology structure is optimized is as follows Figure 5 As shown, devices in the same network segment are located under the same switch. It is understandable that in the target actual network topology, there may be a real switching device corresponding to the logical switching device, or there may not be a real switching device corresponding to the logical switching device.

[0075] S240: Classify and aggregate the optimized network topology structure to obtain the typical network topology structure.

[0076] It is understandable that a subnet area may include multiple network devices with the same functions and types. Therefore, after obtaining the optimized network topology, in order to further simplify the optimized network topology and reduce the simulation resources of the network target range, the optimized network topology can also be classified and aggregated, thereby reducing the number of virtual network devices in the optimized network topology and obtaining the final typical network topology.

[0077] In an optional embodiment of the present invention, the classification and aggregation processing of the optimized network topology structure to obtain the typical network topology structure may include: determining the to-be-classified aggregation devices included in the current to-be-classified aggregation subnet in the optimized network topology structure; screening target classification aggregation devices from the to-be-classified aggregation devices; and grouping and aggregating the target classification aggregation devices according to the operating system type and operating system version to obtain the typical network topology structure.

[0078] The current subnet to be classified and aggregated may be a subnet area that currently needs to be classified and aggregated. The devices to be classified and aggregated may be all virtual network devices included in the current subnet to be classified and aggregated. The target classified and aggregated devices may be virtual network devices that can be classified and aggregated among the devices to be classified and aggregated.

[0079] It is understandable that some virtual network devices in the subnet cannot be processed by classification and aggregation. Therefore, when performing classification and aggregation processing on the optimized network topology structure, the subnet that currently needs to be processed by classification and aggregation can be first determined from the optimized network topology structure as the current subnet to be classified and aggregated, and all virtual network devices in the current subnet to be classified and aggregated can be used as devices to be classified and aggregated. Furthermore, virtual network devices that cannot be processed by classification and aggregation are screened out from the devices to be classified and aggregated, and virtual network devices that can be processed by classification and aggregation are obtained as target classified and aggregated devices. After determining the target classified and aggregated devices, the target classified and aggregated devices can be grouped and aggregated according to the operating system type and operating system version to obtain the typical network topology structure.

[0080] In a specific example, Figure 3 As shown, the typical topology generation module in the network range construction system can be classified and aggregated on the basis of the optimized network topology to generate a typical network topology. Specifically, the process of generating a typical network topology by the typical topology generation module may include the following operations: the device login information of the corresponding network device can be found in the system asset library according to the network device fingerprint information of the network device in the target actual network topology, the corresponding network device can be logged in, and the installation software and software version information of each network device can be found. The network device fingerprint information and the information in the system asset library can be combined to obtain the device category (such as server equipment, office equipment, and security equipment, etc.), operating system type, operating system name and version, installation software and software version and other related information. In a network topology, the devices in the same subnet often have the same characteristics and functions, so the virtual network devices included in each subnet in the optimized network topology are grouped and aggregated. Optionally, the devices of each subnet in the optimized network topology, that is, the network devices under each switch (including the logical switch and the virtual switch corresponding to the real switch), the switch includes a physical switch and a logical switch, and the network devices under each switch are grouped and aggregated respectively.

[0081] Exemplarily, the devices can be grouped based on their operating system type and operating system version. For example, according to the acquired operating system type and version, the virtual network devices are grouped into win7 (Windows 7, Windows 7 operating system) group, win10 (Windows 10, Windows 10 operating system) group and ubuntu20 (Ubuntu 20.04LTS, LTS stands for Long Term Support, i.e., long-term support version. Ubuntu is an open source operating system mainly based on desktop applications) group. For each group of virtual network devices, they are aggregated into one or more devices according to the installed software and software version information. For example, for multiple virtual network devices in the win10 group, if the installation rate of a certain software reaches more than 80%, then this software can be aggregated to a certain virtual network device. Similarly, if the installation rate of another software also reaches 80%, it can also be aggregated to this virtual network device or another virtual network device. For server devices and security devices, generally the number will not be too large, and they all have their own unique characteristics. They are not suitable for grouping and aggregation as target classification aggregation devices, and can be presented separately.

[0082] Figure 6 is a schematic diagram of a typical network topology provided by Embodiment 2 of the present invention. In a specific example, Figure 5 and Figure 6 As shown, Figure 5 The PC1X and PC2X series virtual network devices are servers and are retained without classification and aggregation. For the virtual network devices under the logical switch SWv1, the PC3X series devices are win7 group devices and can be aggregated into a win7 group typical device PCV3. Similarly, the PC4X series devices are win10 group devices and can be aggregated into a win10 group typical device PCV4. Similarly, the devices under the logical switch SWv2 are processed in the same way as the devices under the logical switch SWv1, and are aggregated into win10 group typical device PCV5 and ubuntu20 group typical device PCV6, generating the following: Figure 6 The typical network topology is shown in Figure 1.

[0083] S250. Construct and generate the simulation target according to the device configuration attribute association information of each device in the network topology device association information; wherein the simulation target includes a simulation matching identifier.

[0084] The device configuration attribute association information may be the configuration attribute information of the network device, for example, it may include but is not limited to the device type, operating system type, operating system version, installed software and software version, etc. The embodiment of the present invention does not limit the specific information type and information content of the device configuration attribute association information. The simulation match identifier may be used to identify whether the simulation target successfully matches the corresponding device configuration information.

[0085] In the embodiment of the present invention, based on the device configuration attribute association information of each real network device in the target actual network topology, the device configuration attribute association information of the real network device can be used as a basis to automatically construct and generate a simulation target with a simulation matching identifier. That is, if the simulation target matches successfully, a simulation matching identifier of a successful match is generated; if the simulation target fails to match, a simulation matching identifier of a failed match is generated.

[0086] S260. Create a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure.

[0087] In an optional embodiment of the present invention, the generation of a typical network target range corresponding to the target actual network topology based on the simulation target and the typical network topology structure may include: screening out simulation targets that fail to match from each of the simulation targets based on the simulation matching identifier; adjusting the simulation targets that fail to match; establishing a one-to-one mapping relationship between the adjusted simulation targets and the typical network topology structure to obtain an initial typical network target range; determining a device to be replaced in the initial typical network target range that cannot be automatically constructed to generate the simulation target, and determining a target replacement real device for the device to be replaced; and using virtual-reality interconnection technology to connect the target replacement real device to the initial typical network target range to obtain a typical network target range corresponding to the target actual network topology.

[0088] Among them, the match failure simulation target can be a simulation target whose simulation match is marked as a match failure. The initial typical network target range can be a network target range generated by initial construction using the simulation target, and the network target range still needs to be adjusted and optimized. The device to be replaced can be a network device that needs to be manually adjusted for simulation. The target replacement real device can be a real network device that can simulate the device to be replaced in the network topology structure in the network target range.

[0089] It is understandable that in the process of automatically building and generating simulation targets, some simulation targets may fail to simulate due to limited resources and other reasons. Therefore, when the automation process of the simulation target is completed, the simulation target identified by simulation can be screened out from each simulation target as a simulation target with failed matching according to the simulation matching identifier, and the simulation target with failed matching can be adjusted manually so that the adjusted simulation target can simulate and match successfully. Further, a one-to-one mapping relationship is established between all simulation targets that are automatically built and successfully matched and the adjusted simulation targets and the typical network topology structure to obtain an initial typical network target range, so that the virtual network devices in the initial typical network target range can be benchmarked against the real network devices with corresponding software functions and service types, etc., to achieve a high degree of simulation from the software level. Considering that some devices are simulated automatically, for such devices to be replaced, the real network devices in the corresponding actual network topology results can be determined as the target to replace the real devices, and the virtual-real interconnection technology can be used to connect the target replacement real devices to the initial typical network target range to obtain the typical network target range corresponding to the target actual network topology. It can be seen from this that the typical network target range finally generated not only includes the actual network topology relationship between the real network devices in the target actual network topology, but also can effectively simulate the software functions that can be realized by the real network devices in the target actual network topology, thereby achieving a highly simulated image of the target actual network topology.

[0090] Optionally, an initial typical network target range can be constructed first, and based on the initial typical network target range, the virtual-real interconnection technology can be used to connect the target to replace the real device. Alternatively, after the simulation target is adjusted, the virtual-real interconnection technology can be used to connect the target to replace the real device to the typical network topology structure generation, and finally generate a typical network target range corresponding to the actual network topology of the target. The embodiment of the present invention does not limit the execution order of the above links.

[0091] In a specific example, Figure 3 As shown, the environment construction module in the network range construction system can use virtualization technology to virtualize and simulate the typical network topology to form a typical network range. The specific process requires the following operations.

[0092] (1) Automatically build simulation targets. Based on the real information of each virtual network device corresponding to the real network device in the typical network topology, including device type, operating system type, operating system version, installed software and software version, etc., the simulation targets are automatically built using the resources in the image library and software library. Figure 7 Schematic diagram of the effect of the simulation target simulation degree provided by the second embodiment of the present invention. Figure 7As shown, during the process of simulating the target, the degree of simulation of the simulated target to the real target can be displayed, and specifically the difference between the overall simulation degree and the specific simulated target can be displayed. If the simulated target matches successfully, a simulation matching mark of "√" can be configured, and if it does not match, a simulation matching mark of "×" can be configured. Among them, the real target can be a software object entity in the corresponding real network device, such as the device type, operating system type, operating system version, installed software and software version, etc. in the real network device.

[0093] (2) Manually adjust the simulation target. Correspondingly, we get Figure 7 After the simulation target shown is automatically generated, the simulation target identified by simulation matching can be manually adjusted, such as installing related software or services, to improve the overall simulation degree.

[0094] (3) For devices to be replaced that cannot automatically build simulation targets, such as PLC (Programmable Logic Controller) devices, the corresponding real network devices can be used as targets to replace the real devices, and the technology of virtual-real interconnection can be applied to typical network topology structures.

[0095] (4) After each simulation target is constructed, each simulation target is mapped to a typical network topology structure one by one to automatically generate a typical network target range.

[0096] It should be noted that the environment construction module can also support operations such as adding (adding new devices, etc., or adding new simulation targets to devices), editing, deleting and opening the typical network target range, such as adding new devices to the typical network target range or adding new simulation targets to existing devices, editing and deleting existing devices or simulation targets in the typical network target range, etc. The opening operation refers to the use of virtualization technology and virtual-real interconnection technology to virtualize the device nodes and networks in the typical network target range to achieve interconnection between device nodes and networks.

[0097] In an optional embodiment of the present invention, after obtaining the typical network target range corresponding to the actual network topology of the target, it may also include: configuring an operating machine for the typical network target range; after obtaining the typical network target range corresponding to the actual network topology of the target, it may also include: performing a vulnerability scan on the typical network target range to obtain vulnerability scan results; obtaining target machine attack samples and script reinforcement samples according to the vulnerability scan results; executing the target machine attack samples on the operating machine in the typical network target range to generate a vulnerability attack result report; executing the script reinforcement sample on the operating machine in the typical network target range to generate a reinforcement protection report.

[0098] The operator can be used as an external device of virtual simulation to implement corresponding security verification operations on the typical network target range. The target machine attack sample can be an example of attacking each virtual network device in the typical network target range. The script reinforcement sample can be a step sample for reinforcing the protection of each virtual network device in the typical network target range.

[0099] Figure 8 Schematic diagram of a system structure for security verification of a typical network range provided by Embodiment 2 of the present invention. Figure 3 and Figure 8 As shown, the environment construction module can also be used to configure the operation machine for the typical network target range and configure the corresponding switch and router network for the operation machine to form a security verification scenario for the typical network target range, such as Figure 8 , where cloud represents a logical cloud network, indicating that the network between the operating machine and the typical network target range is reachable.

[0100] For example, Figure 3 As shown in the figure, the security verification module in the system can be built through the network target range, which is responsible for attack testing and reinforcement protection testing of the typical network target range. The specific processing flow is as follows:

[0101] (1) Perform vulnerability scans on typical network target ranges, obtain corresponding attack scripts from the vulnerability attack script library based on the vulnerability scan results, and generate target machine attack samples for each target machine in the typical network target range.

[0102] (2) Execute target attack samples against each target machine in a typical network target range on the operating machine in the verification scenario, and generate a vulnerability attack result report.

[0103] (3) According to the vulnerability scanning results, obtain the corresponding reinforcement protection script from the vulnerability reinforcement protection script library to generate the corresponding script reinforcement sample.

[0104] (4) Execute the script hardening samples for each target machine in the typical network target range on the operating machine in the verification scenario.

[0105] (5) Execute the target attack samples against each target machine in the typical network target range again on the operating machine in the verification scenario to verify the reinforcement protection effect of the script reinforcement sample and generate a reinforcement protection report.

[0106] Optionally, the target machine attack sample or script reinforcement sample can be dynamically adjusted according to the actual situation, and the above steps (1) to (5) can be executed in a loop multiple times, that is, the reinforcement protection verification can be executed in a loop multiple times.

[0107] Through the vulnerability attack result report and reinforcement protection report, you can weigh and decide whether to directly reinforce the actual target network topology. According to the process of generating a typical network target range, it is easy to reversely find the real network devices corresponding to the nodes in the typical network target range, and you can directly use the script reinforcement sample to reinforce the existing network devices. Reverse reinforcement protection can improve the effectiveness and security of network protection, and because it has been fully verified on the virtual network devices in the typical network target range, it reduces the operational risks of directly attacking and reinforcing real network devices.

[0108] The above technical solution automatically constructs a typical network range based on the way of dynamic device discovery. It is generated based on the actual live network scene and can be considered as a condensed version of the live network scene. The generated typical network range has the characteristics of live network devices. At the same time, the typical network range is obtained by processing the live network scene topology with an intelligent clipping method, rather than a complete digital twin of the live network real device, so the required simulation resources are controllable and limited, which is easy to implement. For real network devices that are difficult to simulate, real network devices are used instead, and the technology of virtual-real interconnection is applied, so the overall simulation fidelity of the typical network range is high. In addition, the typical network range can be attacked and reinforced for multiple cycles, and the reinforcement scheme can be fully verified. Because the typical network range is a condensed version of the live network scene and is closely related to the live network scene, the verified reinforcement scheme is reversely applied to the live network equipment, which has a small impact risk on the live network equipment, and the stability and reliability have been greatly improved, which has high economic value and practical significance.

[0109] The network range creation method provided by the embodiment of the present invention is based on the existing direct network environment. First, the existing network environment information is collected, and the collected information includes topology structure, asset information, and software information. Then, based on the collected information, the virtual network devices are classified and aggregated according to the network level, device characteristics, and software information, and the network topology is simplified, which greatly reduces the simulation amount of the typical network range, and the required simulation resources are controllable and easy to implement. For some network devices that are difficult to simulate, real targets are used to replace them, which generally improves the fidelity of the typical network range simulation. Through this method, a highly realistic typical simulation range based on the existing network environment can be created. Compared with the prior art, the typical network range created by the network range creation method proposed in the embodiment of the present invention is highly associated with the actual existing network scene. At the same time, when the simulation resources are limited and the 1:1 simulation cannot be achieved, the high-fidelity simulation of the existing network scene is achieved, and the fully verified reinforcement protection scheme can be applied to the existing network equipment, which has a high economic value.

[0110] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0111] It should be noted that any arrangement and combination of the technical features in the above embodiments also falls within the protection scope of the present invention.

[0112] Embodiment 3

[0113] Fig. 9 is a schematic diagram of a network range creation device provided by Embodiment 3 of the present invention, such as Fig. 9 As shown, the device includes: a network topology device association information acquisition module 310, a typical network topology structure construction module 320, a simulation target configuration module 330 and a typical network target range creation module 340, wherein:

[0114] A network topology device association information acquisition module 310 is used to acquire network topology device association information of a target actual network topology;

[0115] A typical network topology structure building module 320 is used to build a typical network topology structure of the target actual network topology according to the network topology device association information;

[0116] A simulation target configuration module 330, configured to configure a simulation target for the typical network topology structure;

[0117] The typical network target range creation module 340 is used to generate a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure.

[0118] The embodiments of the present invention obtain network topology device association information of the target actual network topology to construct a typical network topology structure of the target actual network topology according to the network topology device association information, and further configure a simulation target for the typical network topology structure, so as to generate a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure, thereby solving the problem that the existing network target range creation method is difficult to highly simulate the existing network devices, and can improve the simulation fidelity of the network target range, thereby improving the safety and reliability of the existing network devices maintained based on the network target range.

[0119] Optionally, the network topology device association information includes device login information of network devices within the target actual network topology; the typical network topology structure construction module 320 is also used to: query the adjacent network devices of each network device within the network address simulation range of the target actual network topology according to the device login information, and construct the initial network topology structure of the target actual network topology according to the association relationship between the network devices; optimize the initial network topology structure to obtain an optimized network topology structure; classify and aggregate the optimized network topology structure to obtain the typical network topology structure.

[0120] Optionally, the typical network topology structure construction module 320 is also used to: determine the isolated point device in the initial network topology structure; configure a logical switching device for the isolated point device; wherein the logical switching device includes a logical switch and a logical router; configure a cloud network between the logical router and the virtual router in the initial network topology structure to obtain the optimized network topology structure.

[0121] Optionally, the typical network topology structure building module 320 is further used to: when it is determined that there are multiple isolated point devices, classify each of the isolated point devices according to the subnet range to obtain an isolated point device classification set; wherein each of the isolated point device classification sets includes isolated point devices in a subnet range;

[0122] A logical switch is configured for each of the isolated point device classification sets; wherein each isolated point device included in the isolated point device classification set is communicatively connected to the corresponding logical switch; a logical router is configured for each of the logical switches; wherein the logical switch is communicatively connected to the logical router.

[0123] Optionally, the typical network topology structure construction module 320 is also used to: determine the to-be-classified aggregation devices included in the current to-be-classified aggregation subnet in the optimized network topology structure; filter target classified aggregation devices from the to-be-classified aggregation devices; and perform grouping and aggregation processing on the target classified aggregation devices according to the operating system type and operating system version to obtain the typical network topology structure.

[0124] Optionally, the simulation target configuration module 330 is also used to: construct and generate the simulation target according to the device configuration attribute association information of each device in the typical network topology structure; wherein the simulation target includes a simulation matching identifier; the typical network target range creation module 340 is also used to: filter out the simulation targets that fail to match from each of the simulation targets according to the simulation matching identifier; adjust the simulation targets that fail to match; establish a one-to-one mapping relationship between the adjusted simulation targets and the typical network topology structure to obtain an initial typical network target range; determine the devices to be replaced in the initial typical network target range that cannot be automatically constructed to generate the simulation targets, and determine the target replacement real devices for the devices to be replaced; use virtual-reality interconnection technology to connect the target replacement real devices to the initial typical network target range to obtain the typical network target range corresponding to the target actual network topology.

[0125] Optionally, the typical network target range creation module 340 is also used to: configure an operating machine for the typical network target range; the above-mentioned device also includes a network security verification module, which is used to: perform a vulnerability scan on the typical network target range to obtain vulnerability scanning results; obtain target machine attack samples and script reinforcement samples based on the vulnerability scanning results; execute the target machine attack samples on the operating machine in the typical network target range to generate a vulnerability attack result report; execute the script reinforcement sample on the operating machine in the typical network target range to generate a reinforcement protection report.

[0126] The above-mentioned network range creation device can execute the network range creation method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the network range creation method provided by any embodiment of the present invention.

[0127] Since the network range creation device introduced above is a device that can execute the network range creation method in the embodiment of the present invention, based on the network range creation method introduced in the embodiment of the present invention, the technical personnel in this field can understand the specific implementation of the network range creation device of this embodiment and its various variations, so how the network range creation device implements the network range creation method in the embodiment of the present invention is not introduced in detail here. As long as the technical personnel in this field implement the device used by the network range creation method in the embodiment of the present invention, it belongs to the scope of protection of this application.

[0128] Embodiment 4

[0129] Fig.10A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0130] like Fig.10 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0131] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0132] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the network range creation method.

[0133] Optionally, the network target range creation method may include: obtaining network topology device association information of the target actual network topology; constructing a typical network topology structure of the target actual network topology based on the network topology device association information; configuring a simulation target for the typical network topology structure; and generating a typical network target range corresponding to the target actual network topology based on the simulation target and the typical network topology structure.

[0134] In some embodiments, the network range creation method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the network range creation method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the network range creation method in any other appropriate manner (for example, by means of firmware).

[0135] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0136] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0137] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0138] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0139] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0140] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0141] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0142] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for creating a network range, characterized in that: include: Obtain network topology device association information of the target actual network topology; Constructing a typical network topology structure of the target actual network topology according to the network topology device association information; According to the network topology device association information, a simulation target is configured for the virtual network device in the typical network topology structure; A typical network target range corresponding to the target actual network topology is created according to the simulation target and the typical network topology structure.

2. The method according to claim 1, characterized in that The network topology device association information includes device login information of network devices in the target actual network topology; the typical network topology structure of the target actual network topology is constructed according to the network topology device association information, including: Querying the adjacent network devices of each network device within the network address simulation range of the target actual network topology according to the device login information, and constructing the initial network topology structure of the target actual network topology according to the association relationship between the network devices; Optimizing the initial network topology structure to obtain an optimized network topology structure; The optimized network topology structure is classified and aggregated to obtain the typical network topology structure.

3. The method according to claim 2, characterized in that The step of optimizing the initial network topology structure to obtain an optimized network topology structure includes: Determining isolated point devices in the initial network topology; Configuring a logical switching device for the isolated point device; wherein the logical switching device includes a logical switch and a logical router; A cloud network is configured between the logical router and the virtual router in the initial network topology structure to obtain the optimized network topology structure.

4. The method according to claim 3, characterized in that The configuring a logical switching device for the isolated point device comprises: When it is determined that there are multiple isolated point devices, each of the isolated point devices is classified according to the subnet range to obtain an isolated point device classification set; wherein each of the isolated point device classification sets includes isolated point devices in a subnet range; One of the logical switches is configured for each of the isolated point device classification sets; wherein each isolated point device included in the isolated point device classification set is communicatively connected with the corresponding logical switch; A logical router is configured for each of the logical switches; wherein the logical switch is communicatively connected with the logical router.

5. The method according to claim 2, characterized in that: The classifying and aggregating the optimized network topology structure to obtain the typical network topology structure includes: Determine the aggregation devices to be classified included in the current aggregation subnet to be classified in the optimized network topology structure; Selecting target classified aggregation devices from the devices to be classified and aggregated; The target classified aggregation devices are grouped and aggregated according to the operating system type and operating system version to obtain the typical network topology structure.

6. The method according to claim 1, characterized in that The configuring a simulation target for a virtual network device in the typical network topology structure according to the network topology device association information includes: Constructing and generating the simulation target according to the device configuration attribute association information of each device in the network topology device association information; wherein the simulation target includes a simulation matching identifier; The step of creating a typical network target range corresponding to the target actual network topology according to the simulation target and the typical network topology structure includes: Screening out the simulation targets that failed to match from the simulation targets according to the simulation matching identifier; Adjusting the matching failure simulation target; Establishing a one-to-one mapping relationship between the adjusted simulation target and the typical network topology structure to obtain an initial typical network target range; Determine the device to be replaced in the initial typical network target range that cannot automatically build and generate the simulated target, and determine a target replacement real device for the device to be replaced; The target is replaced with a real device by using virtual-reality interconnection technology and connected to the initial typical network target range to obtain a typical network target range corresponding to the actual network topology of the target.

7. The method according to claim 6, characterized in that After obtaining the typical network target range corresponding to the target actual network topology, the method further includes: Configuring an operating machine for the typical network target range; After obtaining the typical network target range corresponding to the target actual network topology, the method further includes: Perform vulnerability scanning on the typical network target range to obtain vulnerability scanning results; Obtain target machine attack samples and script reinforcement samples based on the vulnerability scanning results; Execute the target machine attack sample on the operating machine in the typical network target range to generate a vulnerability attack result report; The script reinforcement example is executed on an operating machine in the typical network target range to generate a reinforcement protection report.

8. A network range creation device, characterized in that: include: A network topology device association information acquisition module is used to acquire network topology device association information of a target actual network topology; A typical network topology structure building module, used to build a typical network topology structure of the target actual network topology according to the network topology device association information; A simulation target configuration module, used for configuring simulation targets for virtual network devices in the typical network topology structure; A typical network target range creation module is used to create a typical network target range corresponding to the target actual network topology based on the simulation target and the typical network topology structure.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network target range creation method described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network range creation method described in any one of claims 1-7 when executed.

11. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the network range creation method described in any one of claims 1-7 is implemented.

Images