TCP attack protection performance test method and device and processing equipment

Abstract

The invention provides a TCP attack protection performance test method, a TCP attack protection performance test device and processing equipment, which are used for establishing a set of specific data packet configuration architecture aiming at TCP flag bit attack test work and configuring a more adaptive data packet for current equipment to be tested so as to promote deeper and more accurate TCP attack protection performance test and improve the test efficiency. And higher-quality network security working requirements in practical application are met. The method comprises the following steps: acquiring a TCP attack protection performance test task which needs to be executed by current equipment to be tested; determining data packet parameters of the TCP attack protection performance test task; configuring a corresponding RST attack data packet based on the data packet parameter; sending the RST attack data packet to the to-be-tested device to carry out RST attack simulation, and collecting the response of the to-be-tested device in the test process; and generating a performance test result of the to-be-tested equipment in the TCP attack protection performance test task based on the response result of the to-be-tested equipment.

Description

Technical Field

[0001] The present application relates to the field of network security, and specifically to a TCP attack protection performance testing method, device and processing equipment. Background Art

[0002] The Transmission Control Protocol (TCP) is a connection-oriented communication protocol that can provide reliable data transmission services and ensure that data is delivered to the intended recipient in order and without errors in the network. TCP flag attacks, as a major type of network attack, carry specific flags in the header of data messages (or data packets) and use the automatic response of the attacked device to the TCP flag to implement corresponding network attacks. If the attacked device handles such messages improperly, it may crash. Therefore, if the TCP abnormal attack protection function is turned on, by default, the security gateway will directly discard such attack packets after discovering that it has been attacked by TCP abnormal attacks.

[0003] In this case, corresponding to the security performance testing requirements in network security work, the corresponding TCP attack can be launched to the device under test in the network architecture, so as to achieve the test goal of testing the TCP attack protection performance of the device under test.

[0004] However, the inventors of the present application have discovered that existing TCP flag attack methods generally focus on how to better identify, resist and eliminate TCP flag attacks in normal network security work, but ignore how to better carry out TCP flag attack tests during TCP attack protection performance testing. In other words, they are accustomed to using general sample TCP attack data packets by default. Therefore, in terms of details, it is difficult to achieve a deeper and more accurate TCP attack protection performance test effect for the current device under test. Summary of the invention

[0005] The present application provides a TCP attack protection performance testing method, apparatus and processing equipment, which are used to build a specific data packet configuration architecture for TCP flag attack testing. More suitable data packets can be configured for the current device under test to promote deeper and more accurate TCP attack protection performance testing, and meet higher quality network security work requirements in actual applications.

[0006] In a first aspect, the present application provides a TCP attack protection performance testing method, the method comprising:

[0007] Obtain the TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of the enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks;

[0008] Determine the data packet parameters of the TCP attack protection performance test task, where the data packet parameters specifically include local network card parameters, source MAC address and destination IP address;

[0009] Based on the data packet parameters, a corresponding RST attack data packet is configured, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit;

[0010] Send RST attack packets to the device under test to simulate the RST attack, and collect the response of the device under test during the test;

[0011] Based on the response result of the device under test, a performance test result of the device under test in the TCP attack protection performance test task is generated.

[0012] In combination with the first aspect of the present application, in a first possible implementation of the first aspect of the present application, determining the data packet parameters of the TCP attack protection performance test task includes:

[0013] Call the preset source MAC address random generation strategy to generate different source MAC addresses;

[0014] or,

[0015] Under the manual construction scheme configuration, different source MAC addresses entered by the user are received.

[0016] In combination with the first aspect of the present application, in a second possible implementation of the first aspect of the present application, configuring a corresponding RST attack data packet based on a data packet parameter includes:

[0017] Calling a pre-configured RST attack data packet template, and configuring a corresponding RST attack data packet based on the RST attack data packet template and combining data packet parameters;

[0018] or,

[0019] Based on the specific value of the RST flag configured in real time and in combination with the data packet parameters, a corresponding RST attack data packet is configured.

[0020] In combination with the first aspect of the present application, in a third possible implementation manner of the first aspect of the present application, sending an RST attack data packet to the device under test includes:

[0021] Under the constraints of the set packet quantity and the set packet sending time interval, RST attack data packets are sent to the device under test.

[0022] In combination with the third possible implementation of the first aspect of the present application, in a fourth possible implementation of the first aspect of the present application, the method further includes:

[0023] Analyze the differences between the device characteristics of the device under test and the general device characteristics;

[0024] Based on the difference analysis results, the set package quantity and the set package time interval are determined on the basis of the general package quantity and the general package time interval.

[0025] In combination with the third possible implementation of the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, an RST attack data packet is sent to the device under test to simulate the RST attack, and during the test, a response of the device under test is collected, including:

[0026] Send RST attack data packets to the device under test to simulate the RST attack. During the test, collect the response of the device under test, adjust the number of packets and the time interval of packets according to the collected real-time response results, and continue to send RST attack data packets to the device under test until the test is completed.

[0027] In combination with the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, the method corresponds to an application service configured based on a programming language Python.

[0028] In a second aspect, the present application provides a TCP attack protection performance testing device, the device comprising:

[0029] An acquisition unit is used to acquire a TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of the enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks;

[0030] A determination unit, used to determine the data packet parameters of the TCP attack protection performance test task, wherein the data packet parameters specifically include local network card parameters, source MAC address and destination IP address;

[0031] A configuration unit, configured to configure a corresponding RST attack data packet based on data packet parameters, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit;

[0032] The simulation unit is used to send RST attack data packets to the device under test to simulate the RST attack and collect the response of the device under test during the test;

[0033] The generating unit is used to generate a performance test result of the device under test in a TCP attack protection performance test task based on a response result of the device under test.

[0034] In conjunction with the second aspect of the present application, in a first possible implementation manner of the second aspect of the present application, the determining unit is specifically configured to:

[0035] Call the preset source MAC address random generation strategy to generate different source MAC addresses;

[0036] or,

[0037] Under the manual construction scheme configuration, different source MAC addresses entered by the user are received.

[0038] In conjunction with the second aspect of the present application, in a second possible implementation manner of the second aspect of the present application, the configuration unit is specifically configured to:

[0039] Calling a pre-configured RST attack data packet template, and configuring a corresponding RST attack data packet based on the RST attack data packet template and combining data packet parameters;

[0040] or,

[0041] Based on the specific value of the RST flag configured in real time and in combination with the data packet parameters, a corresponding RST attack data packet is configured.

[0042] In conjunction with the second aspect of the present application, in a third possible implementation manner of the second aspect of the present application, the simulation unit is specifically used to:

[0043] Under the constraints of the set packet quantity and the set packet sending time interval, RST attack data packets are sent to the device under test.

[0044] In combination with the third possible implementation of the second aspect of the present application, in a fourth possible implementation of the second aspect of the present application, the simulation unit is further used for:

[0045] Analyze the differences between the device characteristics of the device under test and the general device characteristics;

[0046] Based on the difference analysis results, the set package quantity and the set package time interval are determined on the basis of the general package quantity and the general package time interval.

[0047] In combination with the third possible implementation of the second aspect of the present application, in a fifth possible implementation of the second aspect of the present application, the simulation unit is specifically used for:

[0048] Send RST attack data packets to the device under test to simulate the RST attack. During the test, collect the response of the device under test, adjust the number of packets and the time interval of packets according to the collected real-time response results, and continue to send RST attack data packets to the device under test until the test is completed.

[0049] In combination with the second aspect of the present application, in a sixth possible implementation of the second aspect of the present application, the device corresponds to an application service configured based on the programming language Python.

[0050] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0051] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0052] From the above content, it can be concluded that the present application has the following beneficial effects:

[0053] For the TCP flag attack test, this application obtains the TCP attack protection performance test task that the current device under test needs to execute, determines the data packet parameters of the TCP attack protection performance test task, and then configures the corresponding RST attack data packet based on the data packet parameters, and then sends the RST attack data packet to the device under test to simulate the RST attack. During the test, the response of the device under test is collected. At this time, based on the response result of the device under test, the performance test result of the device under test in the TCP attack protection performance test task is generated. In this way, this application builds a specific data packet configuration architecture, and a more suitable data packet can be configured for the current device under test to promote deeper and more accurate TCP attack protection performance testing to meet the higher quality network security work needs in actual applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 A flowchart of a TCP attack protection performance testing method for this application;

[0056] Figure 2 This is a schematic diagram of an example of a TCP data packet in this application;

[0057] Figure 3 This is a schematic diagram of an example of RST attack in this application;

[0058] Figure 4 A logical schematic diagram for processing TCP attack packets for this application;

[0059] Figure 5 A schematic diagram of the structure of a TCP attack protection performance test device for this application;

[0060] Figure 6 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0061] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0062] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0063] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0064] Before introducing the TCP attack protection performance testing method provided by this application, the background content involved in this application is first introduced.

[0065] The TCP attack protection performance testing method, device and computer-readable storage medium provided in this application can be applied to processing equipment to build a specific data packet configuration architecture. For the current device under test, a more suitable data packet can be configured to promote a deeper and more accurate TCP attack protection performance test to meet the higher quality network security work requirements in actual applications.

[0066] The TCP attack protection performance test method mentioned in this application can be executed by a TCP attack protection performance test device, or a server, physical host or user equipment (UE) and other different types of processing devices integrated with the TCP attack protection performance test device. Among them, the TCP attack protection performance test device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0067] In specific applications, the processing device (also referred to as a test device) that executes the TCP attack protection performance test method of the present application or is equipped with the application service corresponding to the TCP attack protection performance test method of the present application is usually a device on the side of relevant staff responsible for network security work, and specifically a relevant device node in the internal network architecture of the enterprise or a third-party device outside the internal network architecture of the enterprise. Furthermore, with the flexible and changeable application requirements in actual situations, the specific device type and device deployment form of the processing device can be flexibly configured, and this application does not specifically limit this.

[0068] Next, we will introduce the TCP attack protection performance testing method provided by this application.

[0069] First, see Figure 1 , Figure 1 A flow chart of a TCP attack protection performance test method of the present application is shown. The TCP attack protection performance test method provided by the present application may specifically include the following steps S101 to S105:

[0070] Step S101, obtaining a TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of the enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks;

[0071] It can be understood that, corresponding to the TCP attack protection performance test requirements of the specific device under test, the corresponding test processing can be carried out in the form of a TCP attack protection performance test task, and the current specific test object, that is, the device under test, can be executed.

[0072] Among them, the device to be tested corresponds to the needs of the enterprise's network security work, and can be any device node in the enterprise's internal network architecture, such as ordinary device nodes, network device nodes and other types of device nodes. In other words, the network attack protection performance test is achieved by simulating network attacks with the knowledge and permission of the enterprise itself. The security risk is controllable, or in other words, the corresponding security risk is very low or even no security risk.

[0073] In addition, it can be seen that the TCP attack protection performance that this application specifically wants to test is specifically the RST attack in the TCP flag attack.

[0074] For RST attack, specifically, in the TCP protocol, flag is a part of the TCP header (or header), which is used to control the behavior and status of data transmission. Flag consists of a group of flag bits, each bit represents a specific function, which is used to indicate the type of data packet or control instruction. Figure 2 An example schematic diagram of a TCP data packet of the present application is shown. In the header of the TCP data packet, common TCP flags are:

[0075] SYN (Synchronize) is a flag indicating a request to establish a connection, usually used in the first data packet of a three-way handshake; ACK (Acknowledgment) is a flag indicating confirmation of data receipt, and the data packet contains a confirmation number; FIN (Finish) is a flag indicating a request to close the connection, usually used for connection removal; RST (Reset) is a flag indicating a reset connection, used in abnormal situations or connection rejection; PSH (Push) indicates that data is pushed to the application layer immediately without waiting for the buffer to fill up; URG (Urgent) indicates that the data packet contains urgent data and needs to be processed first; ECE (Explicit Congestion Notification Echo) is used to explicitly notify congestion and to support congestion control; CWR (Congestion Window Reduced) indicates that the sender has reduced the congestion window and is used for congestion control.

[0076] TCP packets can usually set multiple flag combinations as needed (this also corresponds to the actual situation that the flag combination can be adjusted as needed under normal operation), for example: SYN: used to initialize the connection; SYN+ACK: respond to the connection request; FIN+ACK: request to close the connection and confirm. These flags are important components of the TCP protocol to achieve reliable transmission and connection management.

[0077] The RST Flood attack (abbreviated as RST attack) imposed by the RST flag is Figure 3 Taking the illustrated example of an RST attack of the present application as an example, a large number of forged data packets with the RST flag are sent to the target server, causing the target server to believe that the business host is requesting to close the service connection. Therefore, the target server will interrupt the service. The business host is currently in normal service, but cannot complete the normal service. In this way, the effective connection of the attacked device is forced to be closed, making its service unstable, thereby achieving the purpose of the attack.

[0078] In terms of network security, relevant devices can be deployed with corresponding security policies / systems to directly discard data packets such as RST attacks after identifying corresponding TCP abnormal attacks to resist RST attacks.

[0079] It is worth adding that, although it is a TCP attack protection performance test initiated on the device under test, the relevant security policies / systems involved are not necessarily configured on the device under test. For example, in actual situations, the network security equipment can provide network security protection services to the corresponding device nodes in the network architecture. In this way, the TCP attack protection performance test initiated by the device under test in this application is essentially a TCP attack protection performance test of the network security equipment that protects the device under test.

[0080] Step S102, determining the data packet parameters of the TCP attack protection performance test task, wherein the data packet parameters specifically include local network card parameters, source MAC address and destination IP address;

[0081] After determining the TCP attack protection performance test task, the corresponding data packet parameters that can be used for subsequent configuration of RST attack data packets can be directly extracted from the task information, or the corresponding data packet parameters can be extracted based on the task information, or the corresponding data packet parameters can be configured as the task is triggered.

[0082] In terms of details, it may specifically involve specific parameters such as local network card parameters, source MAC address, destination IP address, local IP address (ie source IP address), etc.

[0083] As an exemplary implementation method here, determining the data packet parameters of the TCP attack protection performance test task may specifically include:

[0084] Calling the preset source MAC address random generation strategy to generate different source MAC addresses (i.e., random source MAC addresses);

[0085] Alternatively, it may also include:

[0086] Under the manual construction scheme configuration, a different source MAC address (ie, a custom source MAC address) entered by a user is received.

[0087] It can be seen that in the specific design of the present application scheme, in addition to using the source MAC address paired with the original network card, the hidden source MAC address function can also be used, and specifically through random or manual construction, without using the real source MAC, a normal RST attack data packet carrying the source MAC address can be sent, thereby further improving the diversity of the subsequently generated TCP attack data packets.

[0088] Step S103, configuring a corresponding RST attack data packet based on the data packet parameters, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit;

[0089] Based on the data packet parameters determined above, it can be used to construct the corresponding RST attack data packet for this TCP attack protection performance test task.

[0090] Among them, it can be understood that there are a lot of differences between the determined data packet parameters, so that there can be a batch of similar RST attack data packets, rather than exactly the same RST attack data packets, to avoid the possibility that the same RST attack data packets are easily detected by the device under test (this will reduce the TCP attack protection performance test effect to a certain extent).

[0091] As an exemplary implementation method here, configuring a corresponding RST attack data packet based on data packet parameters may specifically include:

[0092] Calling a pre-configured RST attack data packet template, and configuring a corresponding RST attack data packet based on the RST attack data packet template (i.e., TCP flag template) and combining data packet parameters;

[0093] Alternatively, it may also include:

[0094] Based on the specific value of the RST flag configured in real time (ie, the custom TCP flag parameter), the corresponding RST attack data packet is configured in combination with the data packet parameters.

[0095] It can be understood that in the process of constructing a TCP attack data packet based on data packet parameters, you can directly call the template (which may also involve multiple templates, i.e., multiple TCP flag exception messages), or call the real-time configured template (which involves the specific value of the RST flag configured in real time). In this way, there is no need to manually construct the specific data packet content of each TCP / IP layer. You only need to determine the sending network card and the destination IP address to highly automatically construct the TCP attack data packet. The learning cost is low, and it has the significant advantages of high system freedom and customization, to carry out efficient and highly adaptable TCP attack data packet automation / autonomous generation and processing.

[0096] In addition, in the process of configuring the corresponding RST attack data packet, the specific position of the RST flag in the packet header may also be adjusted (the specific position may also be understood as a TCP flag parameter involved in a template). In other words, the specific position of the RST flag is not necessarily fixed, which is usually performed in the case of a flag combination.

[0097] Step S104, sending an RST attack data packet to the device under test to simulate the RST attack, and collecting the response of the device under test during the test;

[0098] After completing the configuration of the RST attack data packet, it can be understood that you can start sending it to the device under test to simulate the RST attack, simulating the RST attack received by the device under test in a real application scenario.

[0099] Moreover, in the specific test process of this link, the response of the device under test can be actively collected and observed through the monitoring component built into the device under test, or from the outside of the device under test, or the device under test can actively report the response, or the work log and other files that originally record the corresponding response of the device under test can be extracted to realize the collection of the response of the device under test, so as to provide data basis for the analysis and processing of the TCP attack protection performance of the device under test.

[0100] Among them, we continue to focus on the sending and processing of large batches or large orders of magnitude of RST attack data packets. As an exemplary implementation, sending RST attack data packets to the device under test may specifically include:

[0101] Under the constraints of the set packet quantity and the set packet sending time interval, RST attack data packets are sent to the device under test.

[0102] It can be seen that in the process of sending RST attack data packets, this application may also involve the specific configuration of the number of packets (number) and the time interval for sending packets, so as to simulate a more realistic RST attack situation. At the same time, the TCP attack protection performance test can be carried out in a more delicate and in-depth manner by adjusting the number of packets and the time interval for sending packets. In other words, this application believes that the appropriate number of packets and the time interval for sending packets can help to more accurately test the TCP attack protection performance of the device under test.

[0103] The setting of the number of packets to be sent and the setting of the time interval for sending packets involved here may be pre-set or set in real time in a specific application, which is possible.

[0104] Corresponding to the former, as a further implementation, the method of the present application may further include:

[0105] Analyze the differences between the device characteristics of the device under test and the general device characteristics;

[0106] Based on the difference analysis results, the set package quantity and the set package time interval are determined on the basis of the general package quantity and the general package time interval.

[0107] It can be understood that in the implementation method here, the corresponding general template can be used to understand the general packet quantity and the general packet sending time interval. On the basis of the general template, further fine-tuning and adaptability adjustment can be performed through the characteristic differences between the current device under test and the general device to obtain a more adaptive packet sending quantity and packet sending time interval.

[0108] In specific operations, the difference analysis and processing involved may specifically involve differences in the functional services undertaken by devices in the network architecture, the specific performance of the same functional service, specific test requirements, specific test intensity, specific test time period, and the software and hardware performance of the specific test equipment that initiates the test. Obviously, the greater the difference, the greater the adjustment range of the specific value, and conversely, the smaller the difference, the smaller the adjustment range of the specific value. It can also be seen that in addition to the characteristics of the two devices themselves, it can also involve the differences between the two devices when it comes to TCP attack performance testing. In this way, the number of packets sent and the time interval for sending packets can be adjusted more delicately to ensure better test costs (costs involving software and hardware resources, etc.), test efficiency and test accuracy.

[0109] Corresponding to the latter, as a further implementation method, a RST attack data packet is sent to the device under test to simulate the RST attack, and during the test, the response of the device under test is collected, which may specifically include:

[0110] Send RST attack data packets to the device under test to simulate the RST attack. During the test, collect the response of the device under test, adjust the number of packets and the time interval of packets according to the collected real-time response results, and continue to send RST attack data packets to the device under test until the test is completed.

[0111] It can be understood that in the implementation method here, the present application believes that it is also possible to dynamically adjust the number of packets sent and the packet sending time interval during the test process, and specifically carry out specific dynamic adjustment processing based on the response of the device under test.

[0112] Among them, the dynamic adjustment mechanism involved here aims to balance the test cost (involving the cost of software and hardware resources, etc.), test efficiency and test accuracy. In specific operations, dynamic adjustment can be carried out in a random adjustment manner to search for the best balance point and maintain it, or it can be carried out in a dynamic adjustment manner in accordance with the specific response conditions reflected and dynamically changed by corresponding indicators so that the test process approaches or maintains a specific state. Both methods are possible in actual situations.

[0113] In specific operations, considering the complexity of the settings here, the present application can also introduce artificial intelligence (AI) technology with strong learning and computing capabilities to better realize the calculation processing involved here. For example, a deep learning neural network model in a machine learning model can be used. The model can be obtained by training the initial model through sample response description data (used to characterize the response of the device under test during the TCP attack protection performance test) annotated with the corresponding number of packets and packet time intervals.

[0114] Among them, the specific model structure, model training architecture and loss function used in the model training process can adopt the existing solutions, or make further optimization and improvement on the basis of the existing solutions, or even adopt novel self-developed solutions. These are all possible and can be configured according to actual needs.

[0115] At the same time, for the above solutions, you can also combine Figure 4 A logical schematic diagram of the present application processing TCP attack data packets is shown for a more vivid understanding.

[0116] Furthermore, the following set of examples from the specific function level can be combined to more vividly understand the generation and sending of TCP attack data packets involved in this application: #TCP flag abnormal packet input function

[0117] def tcp_flag_parser(self):

[0118] #Set parameter group 1. Only one of the parameters belonging to a parameter group can be passed in.

[0119] group_1=self.__tcp_flag_subparser.add_mutually_exclusive_group()

[0120] #Set parameter group 2, the function is the same as above

[0121] group_2=self.__tcp_flag_subparser.add_mutually_exclusive_group()

[0122] #Input network card parameters and select the network card to send the packet

[0123] self.__tcp_flag_subparser.add_argument("-i","--int",type=int,metavar="index",required=True,help="Network card index value.")

[0124] #Input the destination address parameter, set the attack target, and the IP address of the attacked host

[0125] self.__tcp_flag_subparser.add_argument("-d","--dst",type=str,metavar="xxx.xxx.xxx.xxx",required=True,help="Target target address.")

[0126] #Parameter group 1 parameters, custom source MAC address, you can set the MAC address according to your needs

[0127] group_1.add_argument("-m","--smac",type=str,metavar="XX:XX:XX:XX:XX:XX",help="MAC address of packet sending source.")

[0128] #Parameter group 1 parameters, select random MAC address, the system automatically generates a MAC address for packet sending, and the previous parameter group 1 parameters can only select one configuration

[0129] group_1.add_argument("--hide-srcmac",action="store_true",help="HideSource MAC Address.")

[0130] #Parameter group 2 parameters, set the source address, you can customize your own IP address, you can write a real address or a fictitious address

[0131] group_2.add_argument("-s","--src",type=str,metavar="xxx.xxx.xxx.xxx",help="Custom source IP address.")

[0132] #Parameter group 2 parameters, set random source IP address, the system automatically generates

[0133] group_2.add_argument("--hide-srcip",action="store_true",help="HideSource IP Address.")

[0134] #Set the flag bit, you can choose a template, you can customize it

[0135] self.__tcp_flag_subparser.add_argument("-f","--flags",choices=["F","FR","SU","SR","SF"],help="Configure abnormal TCP identification bit.")

[0136] #Set the number of packets sent

[0137] self.__tcp_flag_subparser.add_argument("-n","--num",type=int,metavar="number",help="Number of packets sent.")

[0138] #Set the packet sending interval

[0139] self.__tcp_flag_subparser.add_argument("-t","--time",type=float,metavar="second",help="Transmission interval between each data packet.")

[0140] #tcp flag constructs the main function and calls other functions

[0141] def tcp_flag(self):

[0142] #Get input parameters

[0143] network_card=iface(module.int)

[0144] #Get the host MAC

[0145] smac=smac_choice()

[0146] #Get the host source IP

[0147] src = src_choice()

[0148] #Call the packet encapsulation function to encapsulate the TCP flag exception packet

[0149] pkt=ipv4_tcp_flag(smac=smac,src=src,dst=module.dst,flags=module.flags)

[0150] #Print the encapsulated data packet structure

[0151] pkt.show()

[0152] #Select the sending method

[0153] if module.num:

[0154] #Limited number of packets, pass in the constructed data packet, number of packets, packet interval time and packet sending network card

[0155] loop_packets(pkt=pkt,num=module.num,tim=module.time,net=network_card)

[0156] else:

[0157] #Infinite packet sending, pass in the constructed data packet, packet sending interval time and packet sending network card

[0158] infinite_packets(pkt=pkt,tim=module.time,net=network_card)

[0159] #Message sending function

[0160] #Send data link layer message in a loop (customize the number of loops)

[0161] def loop_packets(pkt,tim,num,net):

[0162] if time:

[0163] sendp(pkt, inter=tim, count=num, iface=net)

[0164] else:

[0165] sendp(pkt,inter=0,count=num,iface=net)

[0166] #Send data link layer messages in a loop (the default number of loops is 100,000, a pseudo-dead loop, the number of loops is the number of packets sent, and it will automatically exit after the loop is completed)

[0167] def infinite_packets(pkt,tim,net):

[0168] if time:

[0169] sendp(pkt,inter=tim,count=100000,iface=net)

[0170] else:

[0171] sendp(pkt,inter=0,count=100000,iface=net)

[0172] Step S105: generating a performance test result of the device under test in the TCP attack protection performance test task based on the response result of the device under test.

[0173] In this way, after completing the TCP simulation attack on the device under test, the performance test results of the device under test in this TCP attack protection performance test task can be generated according to the collected response results of the device under test, the corresponding result summary logic and output format requirements.

[0174] Among them, the result aggregation logic can be understood as the conversion logic between the specific content in the response results and the specific content in the performance test results, which mainly involves the conversion and calculation of indicators. The output format requirements can involve both the format requirements of the data content and the format requirements of the file itself (such as text, pdf, pictures, videos and other formats), thus forming standardized and high-quality performance test results.

[0175] After obtaining the performance test results, corresponding data application processing may also be involved, for example, local storage, remote storage, file forwarding, content display, output of test completion prompts, further analysis and processing, etc. Obviously, the data application strategies / rules specifically involved in the data application link can be pre-set or set in real time, and the content of the specific strategies / rules can also be flexibly configured in actual applications, and this application does not make specific limitations.

[0176] Furthermore, the present application also considers the convenience of application of the present application scheme. As an exemplary implementation method, the application service (or functional service) corresponding to the present application method can be specifically configured based on the programming language Python.

[0177] It is understandable that due to the cross-platform nature of Python, the present application solution can be easily ported to other operating systems or platforms, making it easier to deploy and more universal.

[0178] For example, the present application may specifically use Python's scapy to construct and send TCP flag abnormal data packets, simulate attacks on devices, and perform stress tests on devices.

[0179] Among them, scapy is a Python module and interactive program used to parse the underlying network data packets. It abstracts and packages the underlying packet processing, making the processing of network data packets very simple. It is not only a tool, but also a third-party library of the Python language. It needs to be introduced by the Python language before use. It is mainly responsible for receiving, constructing, and sending data packets.

[0180] Finally, for the above solution content, in general, for the TCP flag attack test work, this application obtains the TCP attack protection performance test task that the current device under test needs to execute, determines the data packet parameters of the TCP attack protection performance test task, and then configures the corresponding RST attack data packet based on the data packet parameters, and then sends the RST attack data packet to the device under test to simulate the RST attack, and collects the response of the device under test during the test. At this time, based on the response result of the device under test, the performance test result of the device under test in the TCP attack protection performance test task is generated. Based on this processing content, this application has built a specific data packet configuration architecture, and a more suitable data packet can be configured for the current device under test to promote deeper and more accurate TCP attack protection performance testing to meet the higher quality network security work needs in actual applications.

[0181] The above is an introduction to the TCP attack protection performance testing method provided by this application. In order to facilitate better implementation of the TCP attack protection performance testing method provided by this application, this application also provides a TCP attack protection performance testing device from the perspective of functional modules.

[0182] See also Figure 5 , Figure 5 This is a schematic diagram of the structure of the TCP attack protection performance test device of the present application. In the present application, the TCP attack protection performance test device 500 may specifically include the following structure:

[0183] The acquisition unit 501 is used to acquire the TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of the enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks;

[0184] The determining unit 502 is used to determine the data packet parameters of the TCP attack protection performance test task, wherein the data packet parameters specifically include local network card parameters, source MAC address and destination IP address;

[0185] The configuration unit 503 is used to configure a corresponding RST attack data packet based on the data packet parameters, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit;

[0186] The simulation unit 504 is used to send an RST attack data packet to the device under test to simulate the RST attack, and collect the response of the device under test during the test;

[0187] The generating unit 505 is used to generate a performance test result of the device under test in the TCP attack protection performance test task based on the response result of the device under test.

[0188] In an exemplary implementation, the determining unit 502 is specifically configured to:

[0189] Call the preset source MAC address random generation strategy to generate different source MAC addresses;

[0190] or,

[0191] Under the manual construction scheme configuration, different source MAC addresses entered by the user are received.

[0192] In yet another exemplary implementation, the configuration unit 503 is specifically configured to:

[0193] Calling a pre-configured RST attack data packet template, and configuring a corresponding RST attack data packet based on the RST attack data packet template and combining data packet parameters;

[0194] or,

[0195] Based on the specific value of the RST flag configured in real time and in combination with the data packet parameters, a corresponding RST attack data packet is configured.

[0196] In yet another exemplary implementation, the simulation unit 504 is specifically configured to:

[0197] Under the constraints of the set packet quantity and the set packet sending time interval, RST attack data packets are sent to the device under test.

[0198] In yet another exemplary implementation, the simulation unit 504 is further configured to:

[0199] Analyze the differences between the device characteristics of the device under test and the general device characteristics;

[0200] Based on the difference analysis results, the set package quantity and the set package time interval are determined on the basis of the general package quantity and the general package time interval.

[0201] In yet another exemplary implementation, the simulation unit 504 is specifically configured to:

[0202] Send RST attack data packets to the device under test to simulate the RST attack. During the test, collect the response of the device under test, adjust the number of packets and the time interval of packets according to the collected real-time response results, and continue to send RST attack data packets to the device under test until the test is completed.

[0203] In yet another exemplary implementation, the device corresponding to the application service is configured based on the programming language Python.

[0204] This application also provides a processing device from the perspective of hardware structure, see Figure 6 , Figure 6 601, a memory 602, and an input / output device 603. The processor 601 is used to execute the computer program stored in the memory 602 to implement the following Figure 1 The steps of the TCP attack protection performance testing method in the corresponding embodiment; or, the processor 601 is used to execute the computer program stored in the memory 602 to implement the following Figure 5 Corresponding to the functions of each unit in the embodiment, the memory 602 is used to store the processor 601 executing the above Figure 1 The computer program required by the TCP attack protection performance testing method in the corresponding embodiment.

[0205] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 602, and executed by the processor 601 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0206] The processing device may include, but is not limited to, a processor 601, a memory 602, and an input / output device 603. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 601, the memory 602, the input / output device 603, etc. are connected via a bus.

[0207] The processor 601 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0208] The memory 602 can be used to store computer programs and / or modules. The processor 601 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 602 and calling the data stored in the memory 602. The memory 602 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0209] When the processor 601 is used to execute the computer program stored in the memory 602, the following functions can be implemented:

[0210] Obtain the TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of the enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks;

[0211] Determine the data packet parameters of the TCP attack protection performance test task, where the data packet parameters specifically include local network card parameters, source MAC address and destination IP address;

[0212] Based on the data packet parameters, a corresponding RST attack data packet is configured, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit;

[0213] Send RST attack packets to the device under test to simulate the RST attack, and collect the response of the device under test during the test;

[0214] Based on the response result of the device under test, a performance test result of the device under test in the TCP attack protection performance test task is generated.

[0215] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the TCP attack protection performance test device, processing equipment and its corresponding units described above can refer to the following. Figure 1 The description of the TCP attack protection performance testing method in the corresponding embodiment will not be repeated here.

[0216] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0217] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the TCP attack protection performance testing method in the corresponding embodiment, the specific operations can be referred to as follows Figure 1 The description of the TCP attack protection performance testing method in the corresponding embodiment will not be repeated here.

[0218] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0219] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the TCP attack protection performance testing method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the TCP attack protection performance testing method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0220] The TCP attack protection performance testing method, device, processing equipment and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the core idea of ​​the present application; at the same time, for technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A TCP attack protection performance testing method, characterized in that: The method comprises: Obtain a TCP attack protection performance test task that the current device under test needs to execute, wherein the device under test is a related device node in the internal network architecture of an enterprise, and the TCP attack protection performance test task is specifically used to test the protection performance of the device under test against RST attacks; Determine the data packet parameters of the TCP attack protection performance test task, wherein the data packet parameters specifically include local network card parameters, source MAC address and destination IP address; Based on the data packet parameters, configure a corresponding RST attack data packet, wherein the RST attack data packet is specifically a data packet carrying a RST flag bit; Sending the RST attack data packet to the device under test to perform RST attack simulation, and collecting the response of the device under test during the test; Based on the response result of the device under test, a performance test result of the device under test in the TCP attack protection performance test task is generated.

2. The method according to claim 1, characterized in that Determining the data packet parameters of the TCP attack protection performance test task includes: Calling a preset source MAC address random generation strategy to generate different source MAC addresses; or, Under the manual configuration scheme, a different source MAC address entered by a user is received.

3. The method according to claim 1, characterized in that Based on the data packet parameters, configuring the corresponding RST attack data packet includes: Calling a pre-configured RST attack data packet template, and configuring the corresponding RST attack data packet based on the RST attack data packet template and in combination with the data packet parameters; or, Based on the specific value of the RST flag configured in real time and in combination with the data packet parameters, the corresponding RST attack data packet is configured.

4. The method according to claim 1, characterized in that: Sending the RST attack data packet to the device under test includes: Under the constraints of a set packet sending quantity and a set packet sending time interval, the RST attack data packet is sent to the device under test.

5. The method according to claim 4, characterized in that The method further comprises: Analyzing the differences between the device characteristics of the device under test and general device characteristics; Based on the difference analysis result, the set packet sending quantity and the set packet sending time interval are determined on the basis of the general packet sending quantity and the general packet sending time interval.

6. The method according to claim 4, characterized in that Sending the RST attack data packet to the device under test to perform RST attack simulation, and collecting the response of the device under test during the test, including: The RST attack data packet is sent to the device under test to simulate the RST attack, and during the test, the response of the device under test is collected, the number of packets and the time interval of packets are adjusted according to the collected real-time response results, and the RST attack data packet is continued to be sent to the device under test until the test is completed.

7. The method according to claim 1, characterized in that The method corresponds to the configuration of the application service based on the programming language Python.

8. A TCP attack protection performance testing device, characterized in that: The device comprises: An acquisition unit, used for acquiring a TCP attack protection performance test task that needs to be performed by the current device under test, wherein the device under test is a related device node in the internal network architecture of an enterprise, and the TCP attack protection performance test task is specifically used for testing the protection performance of the device under test against RST attacks; A determination unit, used to determine the data packet parameters of the TCP attack protection performance test task, wherein the data packet parameters specifically include local network card parameters, source MAC address and destination IP address; A configuration unit, configured to configure a corresponding RST attack data packet based on the data packet parameters, wherein the RST attack data packet is specifically a data packet carrying an RST flag bit; A simulation unit, used for sending the RST attack data packet to the device under test to simulate the RST attack, and collecting the response of the device under test during the test; A generating unit is used to generate a performance test result of the device under test in the TCP attack protection performance test task based on the response result of the device under test.

9. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 7 when calling the computer program in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 7.

Images