Generation parameter completion method and system of network security test case and storage medium

Abstract

The invention discloses a generation parameter complementing method for a network security test case. The generation parameter complementing method comprises the following steps: acquiring data information of a target power system network; extracting query elements; constructing a generated parameter non-connected graph; embedding the generation parameter non-connected graph into the knowledge graph to obtain a knowledge graph query result; and generating data information required by the generation of the test case according to a knowledge graph query result, and completing the completion of the generation parameters of the network security test case. The invention also discloses a system for realizing the generation parameter completion method of the network security test case, and a storage medium comprising the generation parameter completion method of the network security test case. According to the method and the device, the acquired data information is associated, and the missing parameters required for constructing the test case are automatically generated; therefore, complementation of the generation parameters of the network security test case can be realized, and the method is second-level, higher in reliability, better in accuracy and higher in efficiency.

Description

Technical Field

[0001] The present invention belongs to the field of electrical automation, and in particular relates to a generation parameter completion method, system and storage medium for network security test cases. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] At present, the Internet of Things and artificial intelligence technologies have been widely used in power systems, bringing about rapid development of power systems. Network security is the basic guarantee for the Internet of Things and intelligentization of power systems. In order to ensure the network security of power systems, network security testing is particularly important.

[0004] In network security testing, test cases are used to verify the security of the power system network and its ability to resist risks. Test cases generally include remote code execution (RCE), interactive shell, buffer overflow, SQL injection and other types.

[0005] At present, the test case generation schemes commonly used in power systems are all manually generated schemes, that is, power system researchers manually write test cases based on static rules according to their own understanding and research of the power system network. However, this scheme of manually generating test cases is not only inefficient, but also has poor reliability and accuracy. In addition, although there are tools for automatic test case generation, such tools still require researchers to manually write test case parameters. Summary of the invention

[0006] One of the purposes of the present invention is to provide a method for completing generation parameters of network security test cases with high reliability, good accuracy and high efficiency.

[0007] A second object of the present invention is to provide a system for implementing the method for completing generation parameters of the network security test case.

[0008] A third object of the present invention is to provide a storage medium that includes the method for completing generation parameters of the network security test case.

[0009] The method for generating parameters for network security test cases provided by the present invention comprises the following steps:

[0010] S1. Obtain data information of the target power system network;

[0011] S2. Extract the query element from the data information obtained in step S1;

[0012] S3. Based on the query element obtained in step S2, construct a non-connected graph of generated parameters;

[0013] S4. embed the generated parameter non-connected graph obtained in step S3 into the knowledge graph to obtain the knowledge graph query result;

[0014] S5. Based on the knowledge graph query results obtained in step S4, generate the data information required for test case generation and complete the generation parameters of the network security test case.

[0015] The step S1 of acquiring the data information of the target power system network specifically includes the following steps:

[0016] A sniffing tool is used to obtain data information of a target power system network; the data information includes log record information of the target power system network.

[0017] Step S2 extracts the query element from the data information acquired in step S1, including the following steps:

[0018] In the data information obtained in step S1, redundant information is deleted;

[0019] Identify and extract entities from the obtained data information;

[0020] Based on the obtained entities, entity relationships are extracted.

[0021] The step S2 specifically includes the following steps:

[0022] Deletion of redundant information:

[0023] According to the domain dictionary and based on the parser, remove the elements irrelevant to the test case construction in the log records obtained in step S1 to ensure that the obtained data is a structured or semi-structured log record;

[0024] Entity recognition and extraction:

[0025] Based on the domain dictionary and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information;

[0026] Among them, the domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of proprietary features;

[0027] Extraction of entity relationships:

[0028] Entity relationships are used to describe the subordinate relationships of entities in a physical network environment;

[0029] Match the obtained entities according to the domain dictionary to extract entity relationships;

[0030] The obtained relationships between entities are stored in the form of triples.

[0031] The step S3 of constructing a parameter disconnected graph based on the query element obtained in step S2 specifically includes the following steps:

[0032] In the entity-relationship data information obtained in step S2, the entity is regarded as a node of the graph, the data field of the node includes parameter type and parameter value, and the pointer field of the node includes adjacent node information;

[0033] In the entity-relationship data information obtained in step S2, the relationship between entities is traversed, and the edges between nodes are constructed according to whether there is a direct relationship between entities: if there is a direct relationship between entities, there is an edge between the nodes corresponding to the entities, otherwise there is no edge;

[0034] At the same time, several empty nodes are established, and the data fields and pointer fields of the empty nodes are in default state;

[0035] Finally, a non-connected graph of generated parameters is obtained.

[0036] Step S4 embeds the non-connected graph of generated parameters obtained in step S3 into the knowledge graph to obtain the knowledge graph query result, which specifically includes the following steps:

[0037] For the generated parameter non-connected graph obtained in step S3, embedding the connected components based on the attribute index;

[0038] Expand the adjacent nodes according to the obtained data;

[0039] The obtained data is traversed to obtain a complete set of parameter information for generating test cases.

[0040] The step S4 specifically comprises the following steps:

[0041] Connected component embedding:

[0042] The generated parameter non-connected graph G obtained in step S3 u , according to G uThe data domain attribute of the entity node in the knowledge graph is used to find the corresponding node in the knowledge graph: the parameter value of the entity node is used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval result of the first attribute; if the number of returned nodes is greater than 1, a second traversal is performed according to the parameter type; after the node matching is completed, the node is searched according to the node in G u The connection status in G is retrieved, the edge set between nodes is retrieved, and the corresponding edges are obtained by filtering according to the associated attributes; finally, G u The corresponding mapping relationship G between known entities and relationships between entities in the knowledge graph s ;

[0043] Extension of adjacent nodes:

[0044] For G s Traverse the adjacent nodes of the nodes in G u The parameter types corresponding to the isolated nodes are screened to obtain a node set S containing nodes with missing parameters;

[0045] Traversal:

[0046] Setting G u The number of isolated nodes in is C;

[0047] Exhaust the node combinations in S to ensure that G u The isolated nodes in can all find corresponding mapping relationships in the exhaustive result;

[0048] The node combination that can make the graph G a connected graph is obtained, which constitutes a complete parameter information set D for generating test cases; the graph G is represented by G(N i +G s ,e), where N i ∈S and satisfies the parameter type and G u The nodes in the graph are consistent, e represents the edge set consisting of all edges in the graph G, i∈C.

[0049] Step S5 generates the data information required for test case generation based on the knowledge graph query result obtained in step S4, which specifically includes the following steps:

[0050] Traverse the values ​​of the data domain of the node data in the set D, output the traversal results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation;

[0051] The text file is called by external tools to generate test cases.

[0052] The present invention also provides a system for implementing the method for completing the generation parameters of the network security test case, comprising a data acquisition module, an element extraction module, a graph construction module, a query generation module and a parameter completion module; the data acquisition module, the element extraction module, the graph construction module, the query generation module and the parameter completion module are connected in series in sequence; the data acquisition module is used to acquire data information of the target power system network, and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information according to the received data information, and upload the data information to the graph construction module; the graph construction module is used to construct a non-connected graph of generation parameters based on the received data information and the obtained query elements, and upload the data information to the query generation module; the query generation module is used to embed the obtained non-connected graph of generation parameters into a knowledge graph according to the received data information, obtain a knowledge graph query result, and upload the data information to the parameter completion module; the parameter completion module is used to generate the data information required for test case generation according to the received data information and the obtained knowledge graph query result, and complete the completion of the generation parameters of the network security test case.

[0053] The present invention also provides a storage medium on which a computer program is stored; when the computer program is executed by a processor, the method for completing generation parameters of network security test cases is implemented.

[0054] The network security test case generation parameter completion method, system and storage medium provided by the present invention associate the acquired data information and automatically generate the missing parameters required for constructing the test case; therefore, the present invention can not only realize the completion of the network security test case generation parameters, but also has higher reliability, better accuracy and higher efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 The figure is a schematic diagram of the method flow of the present invention.

[0056] Figure 2 Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0057] like Figure 1 The method flow diagram of the method of the present invention is shown as follows: the method for generating parameter completion of network security test cases disclosed in the present invention comprises the following steps:

[0058] S1. Obtaining data information of the target power system network; specifically comprising the following steps:

[0059] Using a sniffing tool to obtain data information of a target power system network; the data information includes log record information of the target power system network;

[0060] S2. Extracting query elements from the data information obtained in step S1; comprising the following steps:

[0061] In the data information obtained in step S1, redundant information is deleted: according to the domain dictionary and based on the parser, elements irrelevant to the test case construction (such as generation time, tool signature, etc.) in the log record obtained in step S1 are removed to ensure that the obtained data is a structured or semi-structured log record;

[0062] Identify and extract entities from the obtained data information: Entities specifically refer to attributes that describe the characteristics of the target host and its network, such as IP address, running services, operating system, etc., which serve as nodes of the graph when establishing an incomplete graph for query; Based on the domain dictionary and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information;

[0063] Among them, the domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of proprietary features; general concepts such as the operating system, applications, and services running on the target host can be directly matched for consistency through the domain dictionary; features such as the unique IP address of the target host and the port number occupied by the service can be matched for structural consistency through regular expressions;

[0064] Based on the obtained entities, entity relationships are extracted: entity relationships are used to describe the subordinate relationships of entities in the physical network environment (such as a service running on a port);

[0065] Since the relationship set between related entities is limited or even unique (for example, the two entities "Windows operating system" and "x86 architecture" may have compatible, incompatible, natively supported, etc. relationships depending on version differences), the obtained entities are matched according to the domain dictionary to extract entity relationships.

[0066] The obtained relationships between entities are stored in the form of triples;

[0067] S3. Based on the query element obtained in step S2, construct a non-connected graph of generation parameters; specifically comprising the following steps:

[0068] In the entity-relationship data information obtained in step S2, the entity is taken as a node of the graph, the data field of the node includes parameter type and parameter value, and the pointer field of the node includes adjacent node information;

[0069] In the entity-relationship data information obtained in step S2, the relationship between entities is traversed, and the edges between nodes are constructed according to whether there is a direct relationship between entities: if there is a direct relationship between entities, there is an edge between the nodes corresponding to the entities, otherwise there is no edge; due to the existence of parameters that need to be queried, these missing parameters exist in the form of isolated empty nodes in the graph, so the Figure 1 It is a non-connected graph. The graph data structure will be used to maintain the query state and use the query results to complete the empty nodes and the relationship between them and the entity nodes;

[0070] At the same time, several empty nodes are established, and the data fields and pointer fields of the empty nodes are in default state;

[0071] Finally, the generated parameter non-connected graph is obtained;

[0072] S4. Embed the generated parameter non-connected graph obtained in step S3 into the knowledge graph to obtain the knowledge graph query result; specifically comprising the following steps:

[0073] For the generated parameter non-connected graph obtained in step S3, connected component embedding is performed based on the attribute index: the generated parameter non-connected graph G obtained in step S3 u , according to G u The data domain attribute of the entity node in the knowledge graph is used to find the corresponding node in the knowledge graph: the parameter value of the entity node is used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval result of the first attribute; if the number of returned nodes is greater than 1, a second traversal is performed according to the parameter type; after the node matching is completed, the node is searched according to the node in G u The connection status in G is retrieved, the edge set between nodes is retrieved, and the corresponding edges are obtained by filtering according to the associated attributes; finally, G u The corresponding mapping relationship G between known entities and relationships between entities in the knowledge graph s ;

[0074] According to the obtained data, the adjacent nodes are expanded: s Traverse the adjacent nodes of the nodes in G u The parameter types corresponding to the isolated nodes are screened to obtain a node set S containing nodes with missing parameters;

[0075] Traverse the obtained data to obtain a complete set of parameter information for generating test cases:

[0076] According to S, and G s ∪S contains potential parameter pairing patterns that can be used to generate test cases. Take node N i ∈S,N i Satisfies its parameter type and G uThe isolated nodes in S and G are the same. s Adjacent, so N i +G s It must be connected, that is, N i The entity information corresponding to the node is logically associated with the given parameter information, so the parameter value stored in its data domain is valid information that can be used to generate test cases;

[0077] Setting G u The number of isolated nodes in is C;

[0078] Exhaust the node combinations in S to ensure that G u The isolated nodes in can all find corresponding mapping relationships in the exhaustive result;

[0079] The node combination that can make the graph G a connected graph is obtained, which constitutes a complete parameter information set D for generating test cases; the graph G is represented by G(N i +G s ,e), where N i ∈S and satisfies the parameter type and G u The nodes in the graph are consistent, e represents the edge set composed of all edges in the graph G, i∈C;

[0080] S5. According to the knowledge graph query result obtained in step S4, the data information required for test case generation is generated to complete the generation parameters of the network security test case; specifically, the following steps are included:

[0081] Traverse the values ​​of the data domain of the node data in the set D, output the traversal results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation;

[0082] The text file is called by external tools to generate test cases.

[0083] The method of the present invention is further described below in conjunction with embodiments:

[0084] Before network security testing, a sniffing tool is used to monitor and capture data packets in network communications. Information about the target host is obtained through network traffic analysis, packet content inspection, network topology discovery, protocol analysis, etc., and fingerprint features of the target host are extracted, including operating system fingerprints, service and application fingerprints, protocol features, etc. After obtaining the above information through the sniffing tool, security personnel infer or retrieve information based on experience and relevant information to derive possible vulnerabilities of the target host, and manually input parameters into testing tools such as Metasploit Framework to build test cases for further testing. Taking the msfvenom standard test case as an example, when building a test case, the user needs to manually specify the following parameters: payload type, listening host IP and port, target host IP and port, output format, encoder, encoding times, etc. Among them, the payload type, output format, encoder and other parameters are determined by the sniffing tool after inferring the target host information. The inference result is usually obtained after integrating the characteristic fingerprints of the target host's running services and its components.

[0085] In this embodiment, a rule-based matching method is used to process the output data of the sniffing tool, including steps such as redundancy removal, entity recognition and relationship extraction. In this example, nmap is selected to sniff the target host, and the output result is as follows:

[0086] Starting Nmap 7.91(https: / / nmap.org)at 2024-07-27 11:00PDT

[0087] Nmap scan report for 192.168.1.100

[0088] Host is up (0.0012s latency).

[0089] Not shown: 995 closed ports

[0090] PORT STATE SERVICE VERSION

[0091] 135 / tcp open msrpc Microsoft Windows RPC

[0092] 139 / tcp open netbios-ssn Microsoft Windows netbios-ssn

[0093] 445 / tcp open microsoft-ds Microsoft Windows 7-10microsoft-ds

[0094] 3389 / tcp open ms-wbt-server Microsoft Terminal Services

[0095] 10243 / tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP / UPnP)

[0096] Service Info:OS:Windows; CPE:cpe: / o:microsoft:windows

[0097] Nmap done:1IP address(1host up)scanned in 10.45seconds

[0098] Obviously, the output includes a lot of redundant information that is invalid for generating test cases, such as scanning time, number of closed ports, etc. Split the message data by line and traverse each line of data, build a semantic library according to the parameters required for test case construction for rule matching, truncate and delete non-matching items, and obtain an unordered string array s containing key information of the target host = ["192.168.1.100", "135tcp msrpc", "139tcp netbios-ssn", "445tcp microsoft-ds", "3389tcp ms-wbt-server", "10243tcp http", "OS Windows CPE cpe: / o:microsoft:windows"].

[0099] Further, entity recognition is performed on s. There are many different types of parameter values ​​in s, such as "192.168.1.100" is an IP address, "msrpc" is the proprietary name of the running service, etc. For simplicity, only the more typical 445 port-related parameters are taken as examples in the following process. First, domain dictionary matching is performed on the string. Through this process, the proprietary concepts "microsoft-ds", "tcp", and "Windows" in s can be obtained. Regular expressions are used to match numeric type parameters. The IP address "192.168.1.100" in s is matched with the rule "r'\b((25[0-5]|2[0-4][0-9]|

[01] ?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|

[01] ?[0-9][0-9]?)\.\d+\b'". The remaining numeric parameter "445" can be directly matched by simple rules. After the entity recognition process, s is finally split into several entities, and the entity set U is defined as {service: "microsoft-ds", IP: "192.168.1.100", protocol: "tcp", platform: "Windows", unknown: "445"}.

[0100] By traversing U, entity relationship matching can be performed based on the original data input type and public data resource information (such as IANA, etc.). Since the relationships between computer components are relatively fixed, the matching process does not involve complex relationship derivation, and logical judgment can be performed based on component information. Since the IP address does not participate in the parameter completion process, the relationship extraction about the IP address is skipped, and several groups of entity relationships in U are obtained, such as: "microsoft-ds"-running-"445", etc. In this example, the entity type of the value "445" is determined to be the service running port through relationship extraction. Define relationship group R = {<service,port> ,<service,OS> ,<service,protocol>}Record the entity relationships existing in U. UR consists of a triple data structure that records entity nodes and entity relationships;

[0101] A parameter disconnected graph is constructed based on the UR triple data, where the UR records the known parameters contained in the target host information obtained by the sniffing tool. The entity nodes corresponding to the unknown parameters need to be supplemented so that the number of nodes in the disconnected graph corresponds to the parameters required to construct the payload. Taking the msfvenom construction tool as an example, the msfvenom specified parameters include: payload vulnerability exploit type, LHOST (IP address of the listening host), LPORT (listening port), output format, encoder, encoding times, architecture, platform, etc. In this example, for the convenience of explanation, the minimum specified parameter set is selected, including payload vulnerability exploit type (payload), file output format (format), encoder (encoder), platform (platform) and listening host network information (IP+port), where the listening host network information does not participate in the query. Comparing with the entities in UR, the entity directly corresponding to the parameter set element is platform:Windows. Then, empty key-value pairs are created for other elements of the parameter set and appended to the entity set U. At this time, U = {service: "microsoft-ds", IP: "192.168.1.100", protocol: "tcp", platform: "Windows", unknown: "445", payload: "", format: "", encoder: ""}, which includes the target host information for query and the test case generation parameters to be completed, and defines the generation parameter non-connected graph G. u =(U,R);

[0102] Then, mainly based on the known test case construction parameters and information, the network security knowledge graph is queried to obtain other parameters to be completed. The knowledge graph involved in this process can be a knowledge graph constructed by the user through local data or a public network security knowledge graph. In this embodiment, the topological structure of a simplified network security knowledge graph is used as an example for explanation. u The non-empty entity nodes with known parameters are stored in U, that is, the non-empty key-value pairs in U. For each parameter attribute recorded in the key-value pair, the index of the corresponding attribute is found in the knowledge graph. For example, for the key-value pair service: "microsoft-ds", the index of commonly used computer software services in the knowledge graph is found according to its attribute service, and the node information corresponding to the value in the knowledge graph is further obtained according to the value of the key-value pair "microsoft-ds" in the index. The purpose of using the index is to reduce the number of matches of the key-value pair in the knowledge graph and thus improve time efficiency. After traversing all non-empty nodes, the corresponding nodes are found according to their values ​​in G. u The connection situation in R, that is, the edges contained in R, is mapped one by one in the knowledge graph to obtain G uThe embedding mapping of known entities and relationships between entities in the knowledge graph G s .

[0103] For G s The nodes in G can be expanded by using the breadth-first search method. s The nodes in G are added to the traversal queue, and the adjacent nodes are expanded in sequence until the queue is empty. s For example, the node that stores the service: "microsoft-ds" key-value pair in the network security knowledge graph. The entity described by this node is a software service named microsoft-ds. Other entities that are logically associated with the "microsoft-ds" entity concept in the network security knowledge graph may include: T1203-Exploitationfor Client Execution, MS17-010, MS08-067, WannaCry, Metasploit, etc. The corresponding nodes of the above entities in the knowledge graph should have an edge connected to the microsoft-ds node, that is, they are adjacent to the microsoft-ds node. Traverse the above nodes to check whether the parameter type stored in their key-value pairs is consistent with the G u The empty node parameter type in is matched, and the matched nodes are appended to the parameter set S. In this example, MS17-010 and MS08-067 both meet the matching conditions and have the same parameter type. Therefore, multiple query results may be provided for a certain type of missing parameters in S, so S is called a parameter superset.

[0104] For G s G is obtained after completing the adjacency expansion of the nodes in s ∪S contains the u The known parameters in G can generate parameter patterns for test cases that match the knowledge graph, and G s ∪All nodes in S are either directly adjacent or indirectly related through other intermediate nodes in the union, and the parameter values ​​stored in their node key-value pairs meet the parameter requirements for generating test cases. Exhaustively enumerate the parameter value combination patterns in S. If the combination of different types of parameter values ​​can make all node key values ​​in U valid and of matching types, then the parameters in U are a set of complete parameter information that can be used to generate test cases, such as U 1 ={service: "microsoft-ds", IP: "192.168.1.100", protocol: "tcp", platform: "Windows", port: "445", payload: "MS17-010", format: "exe", encoder: "xor"}, etc.;

[0105] Finally, the test case generation parameters suitable for the target host are obtained, and all parameter key-value pairs that meet the conditions are exported to a text file so that an external tool can call its results to generate a test case file.

[0106] like Figure 2 The functional module schematic diagram of the system of the present invention is shown as follows: the system disclosed in the present invention for realizing the generation parameter completion method of the network security test case includes a data acquisition module, an element extraction module, a graph construction module, a query generation module and a parameter completion module; the data acquisition module, the element extraction module, the graph construction module, the query generation module and the parameter completion module are connected in series in sequence; the data acquisition module is used to acquire data information of the target power system network, and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information according to the received data information, and upload the data information to the graph construction module; the graph construction module is used to construct a non-connected graph of generation parameters based on the received data information and the obtained query elements, and upload the data information to the query generation module; the query generation module is used to embed the obtained non-connected graph of generation parameters into the knowledge graph according to the received data information, obtain the knowledge graph query result, and upload the data information to the parameter completion module; the parameter completion module is used to generate the data information required for the test case generation according to the received data information and the obtained knowledge graph query result, and complete the completion of the generation parameters of the network security test case.

[0107] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0108] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0109] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0111] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0112] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for generating parameter completion for a network security test case, comprising the following steps: S1. Obtain data information of the target power system network; S2. Extract the query element from the data information obtained in step S1; S3. Based on the query element obtained in step S2, construct a non-connected graph of generated parameters; S4. embed the generated parameter non-connected graph obtained in step S3 into the knowledge graph to obtain the knowledge graph query result; S5. Based on the knowledge graph query results obtained in step S4, generate the data information required for test case generation and complete the generation parameters of the network security test case.

2. The method for completing network security test case generation parameters according to claim 1, characterized in that The step S1 of acquiring the data information of the target power system network specifically includes the following steps: A sniffing tool is used to obtain data information of a target power system network; the data information includes log record information of the target power system network.

3. The method for completing network security test case generation parameters according to claim 2, characterized in that Step S2 extracts the query element from the data information acquired in step S1, including the following steps: In the data information obtained in step S1, redundant information is deleted; Identify and extract entities from the obtained data information; Based on the obtained entities, entity relationships are extracted.

4. The method for completing network security test case generation parameters according to claim 3 is characterized in that The step S2 specifically includes the following steps: Deletion of redundant information: According to the domain dictionary and based on the parser, remove the elements irrelevant to the test case construction in the log records obtained in step S1 to ensure that the obtained data is a structured or semi-structured log record; Entity recognition and extraction: Based on the domain dictionary and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information; Among them, the domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of proprietary features; Extraction of entity relationships: Entity relationships are used to describe the subordinate relationships of entities in a physical network environment; Match the obtained entities according to the domain dictionary to extract entity relationships; The obtained relationships between entities are stored in the form of triples.

5. The method for completing network security test case generation parameters according to claim 4, characterized in that The step S3 of constructing a parameter disconnected graph based on the query element obtained in step S2 specifically includes the following steps: In the entity-relationship data information obtained in step S2, the entity is regarded as a node of the graph, the data field of the node includes parameter type and parameter value, and the pointer field of the node includes adjacent node information; In the entity-relationship data information obtained in step S2, the relationship between entities is traversed, and the edges between nodes are constructed according to whether there is a direct relationship between entities: if there is a direct relationship between entities, there is an edge between the nodes corresponding to the entities, otherwise there is no edge; At the same time, several empty nodes are established, and the data fields and pointer fields of the empty nodes are in default state; Finally, a non-connected graph of generated parameters is obtained.

6. The method for completing network security test case generation parameters according to claim 5, characterized in that Step S4 embeds the non-connected graph of generated parameters obtained in step S3 into the knowledge graph to obtain the knowledge graph query result, which specifically includes the following steps: For the generated parameter non-connected graph obtained in step S3, embedding the connected components based on the attribute index; Expand the adjacent nodes according to the obtained data; The obtained data is traversed to obtain a complete set of parameter information for generating test cases.

7. The method for completing network security test case generation parameters according to claim 6, characterized in that The step S4 specifically comprises the following steps: Connected component embedding: The generated parameter non-connected graph G obtained in step S3 u , according to G u The data domain attribute of the entity node in the knowledge graph is used to find the corresponding node in the knowledge graph: the parameter value of the entity node is used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval result of the first attribute; if the number of returned nodes is greater than 1, a second traversal is performed according to the parameter type; after the node matching is completed, the node is searched according to the node in G u The connection status in G is retrieved, the edge set between nodes is retrieved, and the corresponding edges are obtained by filtering according to the associated attributes; finally, G u The corresponding mapping relationship G between known entities and relationships between entities in the knowledge graph s ; Extension of adjacent nodes: For G s Traverse the adjacent nodes of the nodes in G u The parameter types corresponding to the isolated nodes are screened to obtain a node set S containing nodes with missing parameters; Traversal: Setting G u The number of isolated nodes in is C; Exhaust the node combinations in S to ensure that G u The isolated nodes in can all find corresponding mapping relationships in the exhaustive result; The node combination that can make the graph G a connected graph is obtained, which constitutes a complete parameter information set D for generating test cases; the graph G is represented by G(N i +G s ,e), where N i ∈S and satisfies the parameter type and G u The nodes in the graph are consistent, e represents the edge set consisting of all edges in the graph G, i∈C.

8. The method for completing network security test case generation parameters according to claim 7, characterized in that Step S5 generates the data information required for test case generation based on the knowledge graph query result obtained in step S4, which specifically includes the following steps: Traverse the values ​​of the data domain of the node data in the set D, output the traversal results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation; The text file is called by external tools to generate test cases.

9. A system for implementing the method for completing generation parameters of network security test cases according to any one of claims 1 to 8, characterized in that It includes a data acquisition module, an element extraction module, a graph construction module, a query generation module and a parameter completion module; the data acquisition module, the element extraction module, the graph construction module, the query generation module and the parameter completion module are connected in series in sequence; the data acquisition module is used to acquire data information of the target power system network, and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information according to the received data information, and upload the data information to the graph construction module; The graph construction module is used to construct a non-connected graph of generation parameters based on the received data information and the obtained query elements, and upload the data information to the query generation module; The query generation module is used to embed the generated parameter non-connected graph into the knowledge graph according to the received data information, obtain the knowledge graph query result, and upload the data information to the parameter completion module; The parameter completion module is used to generate the data information required for test case generation based on the received data information and the obtained knowledge graph query results, and complete the completion of the generation parameters of the network security test case.

10. A storage medium having a computer program stored thereon; when the computer program is executed by a processor, the method for completing parameters for generating network security test cases according to any one of claims 1 to 8 is implemented.

Images