Methods, systems, and storage media for generating parameters for network security test cases.

Abstract

This invention discloses a method for completing generation parameters of network security test cases, including acquiring data information of a target power system network; extracting query elements; constructing a non-connected graph of generation parameters; embedding the non-connected graph of generation parameters into a knowledge graph to obtain knowledge graph query results; and generating the data information required for test case generation based on the knowledge graph query results, thus completing the parameter completion for network security test case generation. This invention also discloses a system for implementing the method for completing generation parameters of the network security test cases, and a storage medium including the method for completing generation parameters of the network security test cases. This invention, by associating the acquired data information and automatically generating the missing parameters required for constructing test cases, not only achieves parameter completion for network security test cases but also has higher reliability, accuracy, and efficiency.

Description

Technical Field

[0001] This invention belongs to the field of electrical automation, and specifically relates to a method, system, and storage medium for generating parameters to complete network security test cases. Background Technology

[0002] With economic and technological development and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and daily life, bringing endless convenience. Therefore, ensuring a stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] Currently, IoT and AI technologies are being widely applied to power systems, leading to their rapid development. Cybersecurity is the fundamental guarantee for the IoT-based and intelligent transformation of power systems. Therefore, cybersecurity testing is particularly important to ensure the cybersecurity of power systems.

[0004] In cybersecurity testing, test cases are used to verify the security and resilience of power system networks. Test cases typically include various types such as Remote Code Execution (RCE), interactive shell, buffer overflow, and SQL injection.

[0005] Currently, the most common method for generating test cases in power systems is manual generation. This involves power system researchers manually writing test cases based on their understanding and research of the power system network and static rules. However, this manual method is not only inefficient but also suffers from poor reliability and accuracy. Furthermore, while tools for automatically generating test cases exist, these tools still require researchers to manually write the test case parameters. Summary of the Invention

[0006] One of the objectives of this invention is to provide a method for generating parameters for network security test cases that is highly reliable, accurate, and efficient.

[0007] The second objective of this invention is to provide a system for implementing the parameter completion method for generating network security test cases.

[0008] A third objective of this invention is to provide a storage medium that includes a method for completing the generation parameters of the aforementioned network security test cases.

[0009] The method for generating parameters to complete network security test cases provided by this invention includes the following steps:

[0010] S1. Obtain data information from the target power system network;

[0011] S2. Extract the query elements from the data information obtained in step S1;

[0012] S3. Based on the query elements obtained in step S2, construct the non-connected graph with generated parameters;

[0013] S4. Embed the non-connected graph of generated parameters obtained in step S3 into the knowledge graph to obtain the knowledge graph query results;

[0014] S5. Based on the knowledge graph query results obtained in step S4, generate the data information required for test case generation and complete the generation parameters of network security test cases.

[0015] Step S1, which involves obtaining data information from the target power system network, specifically includes the following steps:

[0016] Sniffing tools are used to obtain data information from the target power system network; the data information includes log records of the target power system network.

[0017] Step S2, which involves extracting query elements from the data information obtained in step S1, includes the following steps:

[0018] In the data information obtained in step S1, redundant information is deleted;

[0019] The obtained data is then used for entity identification and extraction.

[0020] Based on the obtained entities, entity relationships are extracted.

[0021] Step S2 specifically includes the following steps:

[0022] Redundant information removal:

[0023] Based on the domain dictionary and the parser, elements irrelevant to test case construction are removed from the log records obtained in step S1 to ensure that the obtained data is structured or semi-structured log records.

[0024] Entity identification and extraction:

[0025] Based on domain dictionaries and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information;

[0026] Among them, the domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of specific features.

[0027] Extraction of entity relations:

[0028] Entity relationships are used to describe the hierarchical relationships between entities in a physical network environment;

[0029] The obtained entities are matched with the domain dictionary to extract entity relationships;

[0030] The obtained entities and their relationships are stored in the form of triples.

[0031] Step S3, which involves constructing a non-connected graph based on the query elements obtained in step S2, specifically includes the following steps:

[0032] In the entity-relationship data information obtained in step S2, entities are treated as nodes in the graph. The data field of a node includes parameter type and parameter value, and the pointer field of a node includes information about adjacent nodes.

[0033] In the entity-relationship data information obtained in step S2, the relationships between entities are traversed, and edges between nodes are constructed based on whether there is a direct relationship between entities: if there is a direct relationship between entities, then there are edges between the nodes corresponding to the entities; otherwise, there are no edges.

[0034] At the same time, several empty nodes are created, with the data field and pointer field of the empty nodes in the default state;

[0035] Ultimately, a non-connected graph with generated parameters is obtained.

[0036] Step S4, which involves embedding the non-connected graph of the generated parameters obtained in step S3 into the knowledge graph to obtain the knowledge graph query results, specifically includes the following steps:

[0037] For the non-connected graph with generated parameters obtained in step S3, connected component embedding is performed based on attribute index;

[0038] Based on the obtained data, expand the adjacent nodes;

[0039] The obtained data is traversed to obtain a complete set of parameter information used to generate test cases.

[0040] Step S4 specifically includes the following steps:

[0041] Connected component embedding:

[0042] The generated parameter disconnected graph G obtained in step S3 u According to G uFor the data domain attributes of entity nodes, the corresponding nodes are found in the knowledge graph: The parameter values ​​of the entity nodes are used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval results for the first attribute; if more than one node is returned, a second traversal is performed according to the parameter type; after node matching is completed, the nodes are then traversed according to their location in the knowledge graph. u The connection state in the graph is used to retrieve the set of edges between nodes, and the corresponding edges are filtered according to the association attributes; finally, G is obtained. u The known entities and the corresponding mapping relationships G in the knowledge graph. s ;

[0043] Expansion of adjacent nodes:

[0044] For G s Traverse the adjacent nodes of the nodes in G, and follow the order of G. u The parameter types corresponding to isolated nodes are filtered to obtain a set S of nodes containing nodes with missing parameters;

[0045] Traversal:

[0046] Setting G u The number of isolated nodes in the array is C;

[0047] Exhaustively search for all possible combinations of nodes in S, ensuring that G u All isolated nodes in the list can find their corresponding mapping relationships in the exhaustive search results;

[0048] The node combinations that make graph G a connected graph are obtained, forming a complete set of parameter information D for generating test cases; graph G is represented as G(N) i +G s ,e), where N i ∈S and satisfy the parameter type is the same as G u The nodes in the graph are consistent, and e represents the edge set consisting of all edges in graph G, i∈C.

[0049] Step S5, which involves generating the data information needed for test case generation based on the knowledge graph query results obtained in step S4, specifically includes the following steps:

[0050] Iterate through the values ​​of the data fields of the nodes in set D, and output the results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation.

[0051] The text file is provided for external tools to use in generating test cases.

[0052] This invention also provides a system for implementing the parameter completion method for generating network security test cases, comprising a data acquisition module, an element extraction module, a graph construction module, a query generation module, and a parameter completion module; the data acquisition module, element extraction module, graph construction module, query generation module, and parameter completion module are connected in series; the data acquisition module is used to acquire data information of the target power system network and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information based on the received data information and upload the data information to the graph construction module; the graph construction module is used to construct a non-connected graph of generation parameters based on the obtained query elements and upload the data information to the query generation module; the query generation module is used to embed the obtained non-connected graph of generation parameters into a knowledge graph based on the received data information to obtain the knowledge graph query results and upload the data information to the parameter completion module; the parameter completion module is used to generate the data information required for generating test cases based on the received data information and the obtained knowledge graph query results, thus completing the parameter completion for generating network security test cases.

[0053] The present invention also provides a storage medium on which a computer program is stored; when the computer program is executed by a processor, it implements the method for generating parameters to complete network security test cases.

[0054] The method, system, and storage medium for generating parameters to complete network security test cases provided by this invention automatically generate the missing parameters required to build test cases by associating the acquired data information. Therefore, this invention can not only complete the parameters for generating network security test cases, but also achieve higher reliability, better accuracy, and higher efficiency. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the method flow of the present invention.

[0056] Figure 2 This is a schematic diagram of the functional modules of the system of the present invention. Detailed Implementation

[0057] like Figure 1 The diagram shown is a flowchart of the method of the present invention: The method for generating parameters to complete network security test cases disclosed in this invention includes the following steps:

[0058] S1. Obtain data information from the target power system network; specifically including the following steps:

[0059] Sniffing tools are used to obtain data information from the target power system network; the data information includes log records of the target power system network.

[0060] S2. Extract query elements from the data information obtained in step S1; including the following steps:

[0061] In the data information obtained in step S1, redundant information is deleted: based on the domain dictionary and the parser, elements unrelated to the test case construction (such as generation time, tool signature, etc.) in the log records obtained in step S1 are removed to ensure that the obtained data is a structured or semi-structured log record.

[0062] The obtained data information is used for entity identification and extraction: Entities specifically refer to attributes that describe the characteristics of the target host and its network, such as IP address, running services, operating system, etc., and are used as nodes in the graph when an incomplete graph is built for querying; based on the domain dictionary and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information.

[0063] The domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of specific features. For example, general concepts such as the operating system, applications and services running on the target host can be directly matched for consistency through the domain dictionary; features such as the unique IP address of the target host and the port number occupied by the service can be matched for structural consistency through regular expressions.

[0064] Based on the obtained entities, entity relationships are extracted: entity relationships are used to describe the subordinate relationships of entities in the physical network environment (e.g., a service - running on - a port);

[0065] Since the set of relationships between related entities is finite and may even be unique (for example, the entities "Windows operating system" and "x86 architecture" may have relationships such as compatibility, incompatibility, and native support depending on version differences); therefore, the obtained entities are matched according to the domain dictionary to extract entity relationships.

[0066] The obtained entities and the relationships between them are stored in the form of triples;

[0067] S3. Based on the query elements obtained in step S2, construct the parameter-disconnected graph; specifically including the following steps:

[0068] In the entity-relationship data information obtained in step S2, entities are treated as nodes in the graph. The data field of a node includes parameter type and parameter value, and the pointer field of a node includes information about adjacent nodes.

[0069] In the entity-relationship data obtained in step S2, the relationships between entities are traversed. Based on whether a direct relationship exists between entities, edges are constructed between nodes: if a direct relationship exists between entities, an edge exists between the corresponding nodes; otherwise, no edge exists. Since there are parameters that need to be queried, these missing parameters exist in the graph as isolated empty nodes. Figure 1 It is definitely a disconnected graph. This graph data structure will be used to maintain the query state and use the query results to fill in empty nodes and their relationship with entity nodes.

[0070] At the same time, several empty nodes are created, with the data field and pointer field of the empty nodes in the default state;

[0071] Finally, a non-connected graph with generated parameters is obtained;

[0072] S4. Embed the non-connected graph generated in step S3 into the knowledge graph to obtain the knowledge graph query results; specifically including the following steps:

[0073] For the non-connected graph with generated parameters obtained in step S3, connected component embedding is performed based on attribute index: the non-connected graph with generated parameters G obtained in step S3 u According to G u For the data domain attributes of entity nodes, the corresponding nodes are found in the knowledge graph: The parameter values ​​of the entity nodes are used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval results for the first attribute; if more than one node is returned, a second traversal is performed according to the parameter type; after node matching is completed, the nodes are then traversed according to their location in the knowledge graph. u The connection state in the graph is used to retrieve the set of edges between nodes, and the corresponding edges are filtered according to the association attributes; finally, G is obtained. u The known entities and the corresponding mapping relationships G in the knowledge graph. s ;

[0074] Based on the obtained data, expand the adjacent nodes: for G s Traverse the adjacent nodes of the nodes in G, and follow the order of G. u The parameter types corresponding to isolated nodes are filtered to obtain a set S of nodes containing nodes with missing parameters;

[0075] The obtained data is iterated through to obtain a complete set of parameter information used to generate test cases:

[0076] Based on the obtained S, and G s ∪S contains potential parameter pairing patterns that can be used to generate test cases, taking node N. i ∈S,N i Satisfy its parameter type and G uThe isolated nodes in S and G are the same, since S and G are identical. s Adjacent, therefore N i +G s It must be connected, that is, N i The entity information corresponding to the node is logically related to the given parameter information, so the parameter values ​​stored in its data field are valid information that can be used to generate test cases.

[0077] Setting G u The number of isolated nodes in the array is C;

[0078] Exhaustively search for all possible combinations of nodes in S, ensuring that G u All isolated nodes in the list can find their corresponding mapping relationships in the exhaustive search results;

[0079] The node combinations that make graph G a connected graph are obtained, forming a complete set of parameter information D for generating test cases; graph G is represented as G(N) i +G s ,e), where N i ∈S and satisfy the parameter type is the same as G u The nodes in graph G are consistent, and e represents the edge set consisting of all edges in graph G, i∈C;

[0080] S5. Based on the knowledge graph query results obtained in step S4, generate the data information required for test case generation and complete the parameter completion for network security test case generation; specifically including the following steps:

[0081] Iterate through the values ​​of the data fields of the nodes in set D, and output the results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation.

[0082] The text file is provided for external tools to use in generating test cases.

[0083] The method of the present invention will be further described below with reference to the embodiments:

[0084] Before network security testing, sniffing tools are used to monitor and capture data packets in network communication. Information about the target host is obtained through network traffic analysis, packet content inspection, network topology discovery, and protocol analysis. The target host's fingerprint characteristics are extracted, including operating system fingerprints, service and application fingerprints, and protocol characteristics. After obtaining this information through sniffing tools, security personnel use experience and relevant materials to infer or search for information to determine potential vulnerabilities on the target host. They then manually input parameters into testing tools such as the Metasploit Framework to construct test cases for further testing. Taking the msfvenom standard test case as an example, when constructing test cases, the user needs to manually specify the following parameters: payload type, listening host IP and port, target host IP and port, output format, encoder, and number of encodings. The payload type, output format, and encoder parameters are determined by the user based on inferences made by the sniffing tool about the target host information. The inference results are usually derived by comprehensively considering the characteristic fingerprints of the services running on the target host and its constituent components.

[0085] In this embodiment, a rule-based matching method is used to process the output data of the sniffing tool, including steps such as redundancy removal, entity recognition, and relationship extraction. In this example, nmap is selected to sniff the target host, and its output results are as follows:

[0086] Starting Nmap 7.91(https: / / nmap.org)at 2024-07-27 11:00PDT

[0087] Nmap scan report for 192.168.1.100

[0088] Host is up (0.0012s latency).

[0089] Not shown: 995 closed ports

[0090] PORT STATE SERVICE VERSION

[0091] 135 / tcp open msrpc Microsoft Windows RPC

[0092] 139 / tcp open netbios-ssn Microsoft Windows netbios-ssn

[0093] 445 / tcp open microsoft-ds Microsoft Windows 7-10microsoft-ds

[0094] 3389 / tcp open ms-wbt-server Microsoft Terminal Services

[0095] 10243 / tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP / UPnP)

[0096] Service Info:OS:Windows; CPE:cpe: / o:microsoft:windows

[0097] Nmap done:1IP address(1host up)scanned in 10.45seconds

[0098] This output clearly includes a large amount of redundant information that is invalid for generating test cases, such as scan time and number of ports closed. The packet data is split line by line and each line is traversed. A semantic database is built according to the parameters required for test case construction for rule matching. Non-matching items are truncated and deleted, resulting in an unordered string array s = ["192.168.1.100", "135tcp msrpc", "139tcp netbios-ssn", "445tcp microsoft-ds", "3389tcp ms-wbt-server", "10243tcp http", "OS Windows CPE cpe: / o:microsoft:windows"].

[0099] Further, entity recognition is performed on s. s contains various parameter value types, such as "192.168.1.100" being an IP address and "msrpc" being the proprietary name of the running service. For simplicity, the following process only uses the relatively typical 445 port-related parameter as an example. First, domain dictionary matching is performed on the string, which yields the proprietary concepts "microsoft-ds", "tcp", and "Windows" in s. Regular expressions are used to match numeric parameters. The rule "r'\b((25[0-5]|2[0-4][0-9]|

[01] ?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|

[01] ?[0-9][0-9]?)\.\d+\b'" matches the IP address "192.168.1.100" in s. The remaining numeric parameter "445" can be directly obtained through simple matching rules. After the entity recognition process, s is finally split into several entities, and the entity set U = {service:“microsoft-ds”,IP:“192.168.1.100”,protocol:“tcp”,platform:“Windows”,unknown:“445”} is defined.

[0100] Traversing U allows for entity relationship matching based on the original data input type and publicly available data resource information (such as IANA). Since the relationships between computer components are relatively fixed, this matching process does not involve complex relationship derivation; logical judgment based on component information is sufficient. Because IP addresses are not involved in the parameter completion process, relationship extraction related to IP addresses is skipped, resulting in several sets of entity relationships in U, such as "microsoft-ds"-running-"445". In this example, relationship extraction simultaneously determines that the entity type of the value "445" is a service running port. Define the relationship group R = {<service,port> ,<service,OS> ,<service,protocol> The entity relationships that exist in U are recorded. UR forms a triplet data structure that records entity nodes and entity relationships.

[0101] Based on the UR triplet data, a parameter-disconnected graph is constructed. The UR records known parameters from the target host information obtained through sniffing tools. Entity nodes corresponding to unknown parameters need to be added to ensure the number of nodes in the disconnected graph corresponds to the parameters required for constructing the payload. Taking the msfvenom tool as an example, msfvenom specifies parameters including: payload exploit type, LHOST (IP address of the listening host), LPORT (listening port), output format, encoder, number of encodings, architecture, and platform. For ease of explanation, this example uses the minimum set of specified parameters, including payload exploit type, file output format, encoder, platform, and listening host network information (IP + port). The listening host network information is not included in the query. Comparing the entities in UR, the entity directly corresponding to the parameter set element is platform:Windows. Therefore, empty key-value pairs are created for the other elements of the parameter set and appended to the entity set U. At this point, U = {service:“microsoft-ds”,IP:“192.168.1.100”,protocol:“tcp”,platform:“Windows”,unknown:“445”,payload:“”,format:“”,encoder:“”} contains the target host information used for querying and the test case generation parameters to be completed. A non-connected graph G is defined for generating the parameters. u = (U,R);

[0102] Then, based primarily on known test cases, parameters and information are queried within the cybersecurity knowledge graph to obtain the remaining parameters to be completed. This process involves a knowledge graph that the user has constructed using local data or a publicly available cybersecurity knowledge graph. This embodiment uses a simplified cybersecurity knowledge graph topology as an example. Traversing G u The system stores non-empty entity nodes with known parameters, i.e., non-empty key-value pairs in U. For each key-value pair, the parameter attribute is searched for its corresponding index in the knowledge graph. For example, for the key-value pair "service: "microsoft-ds", the index of common computer software services in the knowledge graph is found based on its attribute "service". Then, based on the value "microsoft-ds" in the index, the corresponding node information in the knowledge graph is obtained. The purpose of using indexes is to reduce the number of key-value pair matches in the knowledge graph, thereby improving time efficiency. After traversing all non-empty nodes, the system retrieves the node information corresponding to the key-value pair in G based on its position in the knowledge graph. u The connections in R, i.e., the edges contained in R, are mapped one-to-one in the knowledge graph to obtain G. uThe embedding mapping G of known entities and relationships between entities in the knowledge graph s .

[0103] For G s To expand the adjacency of nodes in G, a breadth-first search-based method can be used. s The middle node is added to the traversal queue, and adjacent nodes are expanded sequentially until the queue is empty. Let G be an example. s Taking a node storing the key-value pair "service: "microsoft-ds" as an example, this node describes a software service named "microsoft-ds". Other entities logically related to the "microsoft-ds" entity concept in the network security knowledge graph might include: T1203-ExploitationforClientExecution, MS17-010, MS08-067, WannaCry, Metasploit, etc. Therefore, the nodes corresponding to these entities in the knowledge graph should have an edge connecting them to the "microsoft-ds" node, meaning they should be adjacent to the "microsoft-ds" node. Traversing these nodes and checking whether the parameter types stored in their key-value pairs match the G... u The empty node parameter type in the parameter set S is matched, and the matched node is appended to the parameter set S. In this example, MS17-010 and MS08-067 both meet the matching conditions and have the same parameter type. Therefore, S may provide multiple query results for a certain type of missing parameter. Hence, S is called the parameter superset.

[0104] For G s G is obtained after the nodes in the array complete the adjacency expansion. s ∪S contains G u The known parameters can generate parameter patterns for test cases that match in the knowledge graph, and G s All nodes in ∪S are either directly adjacent or indirectly related through other intermediate nodes in the union set. The parameter values ​​stored in their node key-value pairs meet the parameter requirements for generating test cases. An exhaustive list of parameter value combinations in S is performed. If a combination of different types of parameter values ​​makes all node key values ​​in U valid and of the same type, then the parameters in U constitute a complete set of parameter information that can be used to generate test cases, such as U1 = {service:“microsoft-ds”,IP:“192.168.1.100”,protocol:“tcp”,platform:“Windows”,port:“445”,payload:“MS17-010”,format:“exe”,encoder:“xor”}, etc.

[0105] Finally, the test case generation parameters suitable for the target host are obtained, and all parameter key-value pairs that meet the conditions are exported to a text file so that external tools can call the results to generate test case files.

[0106] like Figure 2 The diagram shows the functional modules of the system of the present invention: The system for implementing the parameter completion method for generating network security test cases disclosed in this invention includes a data acquisition module, an element extraction module, a graph construction module, a query generation module, and a parameter completion module; the data acquisition module, element extraction module, graph construction module, query generation module, and parameter completion module are connected in series; the data acquisition module is used to acquire data information of the target power system network and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information based on the received data information and upload the data information to the graph construction module; the graph construction module is used to construct a non-connected graph of generation parameters based on the obtained query elements based on the received data information and upload the data information to the query generation module; the query generation module is used to embed the obtained non-connected graph of generation parameters into a knowledge graph based on the received data information to obtain the knowledge graph query results and upload the data information to the parameter completion module; the parameter completion module is used to generate the data information required for generating test cases based on the received data information and the obtained knowledge graph query results, thus completing the parameter completion for generating network security test cases.

[0107] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0108] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0109] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0110] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0111] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0112] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for generating parameters to complete network security test cases, comprising the following steps: S1. Obtain data information from the target power system network; S2. Extract the query elements from the data information obtained in step S1; S3. Based on the query elements obtained in step S2, construct the non-connected graph with generated parameters; S4. Embed the non-connected graph generated in step S3 into the knowledge graph to obtain the knowledge graph query results; specifically including the following steps: For the non-connected graph with generated parameters obtained in step S3, connected component embedding is performed based on attribute indexing to obtain... The mapping relationship between known entities and the relationships between entities in the knowledge graph ;in, The generated parameter is a disconnected graph obtained in step S3; Based on the obtained data, expand the adjacent nodes; right Traverse the adjacent nodes of the nodes in the array, and follow the order of nodes. By filtering the parameter types corresponding to isolated nodes, a set of nodes containing nodes with missing parameters is obtained. ; The obtained data is iterated through to obtain a complete set of parameter information used to generate test cases; Exhaustively search for all possible combinations of nodes in the array to ensure that The isolated nodes in the list can all find the corresponding mapping relationship in the exhaustive results, forming a complete set of parameter information D for generating test cases; S5. Based on the knowledge graph query results obtained in step S4, generate the data information required for test case generation and complete the generation parameters of network security test cases.

2. The method for generating parameters to complete network security test cases according to claim 1, characterized in that... Step S1, which involves obtaining data information from the target power system network, specifically includes the following steps: Sniffing tools are used to obtain data information from the target power system network; the data information includes log records of the target power system network.

3. The method for generating parameters to complete network security test cases according to claim 2, characterized in that... Step S2, which involves extracting query elements from the data information obtained in step S1, includes the following steps: In the data information obtained in step S1, redundant information is deleted; The obtained data is then used for entity identification and extraction. Based on the obtained entities, entity relationships are extracted.

4. The method for generating parameters to complete network security test cases according to claim 3, characterized in that... Step S2 specifically includes the following steps: Redundant information removal: Based on the domain dictionary and the parser, elements irrelevant to test case construction are removed from the log records obtained in step S1 to ensure that the obtained data is structured or semi-structured log records. Entity identification and extraction: Based on domain dictionaries and regular expression rules, named entity recognition technology is used to extract entities from the obtained data information; Among them, the domain dictionary is used to extract entities composed of general concepts; regular expressions are used to extract entities composed of specific features. Extraction of entity relations: Entity relationships are used to describe the hierarchical relationships between entities in a physical network environment; The obtained entities are matched with the domain dictionary to extract entity relationships; The obtained entities and their relationships are stored in the form of triples.

5. The method for generating parameters to complete network security test cases according to claim 4, characterized in that... Step S3, which involves constructing a non-connected graph based on the query elements obtained in step S2, specifically includes the following steps: In the entity-relationship data information obtained in step S2, entities are treated as nodes in the graph. The data field of a node includes parameter type and parameter value, and the pointer field of a node includes information about adjacent nodes. In the entity-relationship data information obtained in step S2, the relationships between entities are traversed, and edges between nodes are constructed based on whether there is a direct relationship between entities: if there is a direct relationship between entities, then there are edges between the nodes corresponding to the entities; otherwise, there are no edges. At the same time, several empty nodes are created, with the data field and pointer field of the empty nodes in the default state; Ultimately, a non-connected graph with generated parameters is obtained.

6. The method for generating parameters to complete network security test cases according to claim 5, characterized in that... Step S4 further includes the following steps: Connected component embedding: The generated parameter non-connected graph obtained in step S3 ,according to For the data domain attributes of entity nodes, the corresponding nodes are found in the knowledge graph: The parameter values ​​of the entity nodes are used as the first attribute, and the knowledge graph is traversed to obtain the index retrieval results for the first attribute; if more than one node is returned, a second traversal is performed according to the parameter type; after node matching is completed, the nodes are then traversed according to their data domain attributes. The connection state is used to retrieve the set of edges between nodes, and the corresponding edges are obtained by filtering based on the association attributes; finally, the result is obtained. The mapping relationship between known entities and the relationships between entities in the knowledge graph ; Traversal: set up The number of isolated nodes in the array is C; right Exhaustively search for all possible combinations of nodes in the array to ensure that All isolated nodes in the list can find their corresponding mapping relationships in the exhaustive search results; The node combinations that make graph G a connected graph are obtained, forming a complete set of parameter information D for generating test cases; graph G is represented as... ,in ∈S and satisfy the parameter type and The middle nodes are consistent. Let G represent the set of edges consisting of all edges in graph G. .

7. The method for generating parameters to complete network security test cases according to claim 6, characterized in that... Step S5, which involves generating the data information needed for test case generation based on the knowledge graph query results obtained in step S4, specifically includes the following steps: Iterate through the values ​​of the data fields of the nodes in set D, and output the results in the form of a dictionary and store them in a text file to obtain the data information required for test case generation. The text file is provided for external tools to use in generating test cases.

8. A system for implementing the parameter completion method for generating network security test cases according to any one of claims 1 to 7, characterized in that... It includes a data acquisition module, an element extraction module, a graph construction module, a query generation module, and a parameter completion module; the data acquisition module, element extraction module, graph construction module, query generation module, and parameter completion module are connected in series; the data acquisition module is used to acquire data information of the target power system network and upload the data information to the element extraction module; the element extraction module is used to extract query elements from the acquired data information based on the received data information and upload the data information to the graph construction module; The graph construction module is used to construct a non-connected graph with generated parameters based on the received data information and the obtained query elements, and then upload the data information to the query generation module. The query generation module is used to embed the generated parameter non-connected graph into the knowledge graph based on the received data information, obtain the knowledge graph query results, and upload the data information to the parameter completion module. The parameter completion module is used to generate the necessary data information for test cases based on the received data and the query results from the obtained knowledge graph, thus completing the parameter completion for generating network security test cases. In specific implementation, the query generation module's processing includes: for the obtained non-connected graph with generated parameters, embedding connected components based on the attribute index to obtain... The mapping relationship between known entities and the relationships between entities in the knowledge graph ;in, The resulting parameter is a disconnected graph; Based on the obtained data, expand the adjacent nodes; Traverse the adjacent nodes of the nodes in the array, and follow the order of nodes. By filtering the parameter types corresponding to isolated nodes, a set of nodes containing nodes with missing parameters is obtained. ; The obtained data is iterated through to obtain a complete set of parameter information used to generate test cases; Exhaustively search for all possible combinations of nodes in the array to ensure that The isolated nodes in the list can all find the corresponding mapping relationship in the exhaustive results, forming a complete set of parameter information D for generating test cases.

9. A storage medium storing a computer program thereon; when the computer program is executed by a processor, it implements the parameter completion method for generating network security test cases according to any one of claims 1 to 7.

Images