Network attack and defense tool management system

Abstract

The invention discloses a network attack and defense tool management system, and the system comprises a tool storage module which is used for carrying out the standardized detection of a newly stored network attack and defense tool, and adding the network attack and defense tool meeting the standard into a tool library; the network attack and defense tool identification and screening module is used for providing a network attack and defense tool rapid positioning function for the user through feature tags including classification and functions of the tool, an environment on which the tool depends and a certain grammar of the tool; the network attack and defense tool attack template is used for providing guidance for calling a certain specific function of the tool for a user and receiving target information required during operation of the tool; and the attack template data transmission module is used for direct data transmission between network attack and defense templates, and the transmitted data comprises effective information in an execution result returned by the specific function indicated by the tool execution template. According to the system, the usability and the attack efficiency of a network attack tool are improved.

Description

Technical Field

[0001] The present invention relates to network security technology, and in particular to a network attack and defense tool management system. Background Art

[0002] From the perspective of function, existing network attack and defense tools can be divided into categories such as information collection, vulnerability analysis, WEB attack, database attack, password attack, penetration attack, reverse analysis, terminal attack, network attack, server cluster attack, etc. Different types of tools are suitable for different network attack scenarios, and technicians should choose appropriate tools for attack testing.

[0003] Faced with the diverse forms and complex syntax of network attack and defense tools, the training and learning costs of cultivating skilled technicians are becoming increasingly high. At the same time, a large number of network attack and defense platforms have emerged on the market, and most of their technologies focus on the construction and configuration of the attack and defense environment and system, while the integration and management of network attack and defense tools are not perfect enough, and there are many situations where technicians need to manually configure and use tools. Faced with the network attack and defense of large systems, a mature tool management system is needed to uniformly manage the available network attack and defense tools. Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a network attack and defense tool management system in view of the defects in the prior art.

[0005] The technical solution adopted by the present invention to solve the technical problem is: a network attack and defense tool management system, comprising:

[0006] The tool library module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library;

[0007] The standardized detection includes detecting the properties of the network attack and defense tool, and the properties include: the input, output, operating efficiency and operating environment of the network attack and defense tool;

[0008] The network attack and defense tool identification and screening module is used to provide users with the function of quickly locating network attack and defense tools through feature tags including the classification and function of the tools, the environment on which the tools depend, and a certain syntax of the tools;

[0009] Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and receive target information required for the tool to run;

[0010] The template configuration for the network attack and defense tool is as follows:

[0011] For each specific function of a network attack and defense tool, define an attack process and required parameters, encapsulate the attack function into a template, hide the specific use process of the parameters, and present it as a tool template that can realize the function;

[0012] The attack template data transfer module is used for direct data transfer between network attack and defense templates. The transferred data includes valid information in the execution results returned by the specific functions indicated by the tool execution template, including the results of attack success or failure, the network address and port number information of the attack.

[0013] According to the above scheme, in the tool storage module, the standardized testing includes the following normative standards:

[0014] 1) Normative standards: The use of network attack and defense tools that are checked and stored must be realized only through command lines. They must not be called in other forms or combined with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output interaction of the command;

[0015] 2) Functional standards: The network attack and defense tools that are checked and included in the database must be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms;

[0016] 3) Performance standards: The performance indicators of network attack and defense tools that are checked and stored must meet the set standards. The performance indicators include response time, system resource usage, and throughput.

[0017] 4) Compatibility standards: Network attack and defense tools that are included in the inspection database must be compatible with the latest mainstream operating systems;

[0018] 5) Compliance standards: Network attack and defense tools that are inspected and stored must comply with relevant regulations and technical specifications.

[0019] According to the above scheme, the feature tags are set from the following perspectives:

[0020] From the perspective of attack target classification, the targets of network attack and defense tools are divided into the following categories: terminal workstations, data storage services, server clusters, network equipment, software applications, domestic platforms, and Internet of Things devices, and feature labels are established;

[0021] From a functional perspective, feature tag classification includes: information collection, vulnerability analysis, WEB attack, database attack, password attack, penetration attack, reverse analysis, terminal attack, network attack, and server cluster attack.

[0022] According to the above scheme, in the attack template data transmission module, the transmitted data is obtained from the output of the network attack tool through the result regularization.

[0023] According to the above scheme, in the attack template data transmission module, the result regularization acts on the output result returned by the network attack tool after the template is executed. The result regularization captures and outputs the content matched by the regularization and stores it in the form of a variable. The result of the success or failure of the attack is used as a branch judgment condition to select the next template, and the network address and port number information of the attack is used as the input of the next template.

[0024] The beneficial effects produced by the present invention are:

[0025] The present invention proposes an expandable tool storage method and formulates standard specifications for tool storage, realizes standardized tool storage review, modification and deletion, as well as multi-angle and multi-category tool identification and screening, and has powerful comprehensive tool management capabilities.

[0026] The present invention proposes and implements a template configuration method for network attack and defense tools and a data transmission method between templates, realizes the templated configuration of network attack and defense tools, and the serial use of tool templates, thereby improving the usability and attack efficiency of network attack tools. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments, in which:

[0028] Figure 1 is a schematic structural diagram of an embodiment of the present invention;

[0029] Figure 2 It is a schematic diagram of attack template data transmission according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0031] like Figure 1 As shown, a network attack and defense tool management system includes:

[0032] The tool library module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library;

[0033] The standardized detection includes detecting the properties of the network attack and defense tool, and the properties include: the input, output, operating efficiency and operating environment of the network attack and defense tool;

[0034] Standardized testing includes the following normative standards:

[0035] 1) Normative standards: The use of network attack and defense tools that are checked and stored must be realized only through command lines. They must not be called in other forms or combined with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output interaction of the command;

[0036] 2) Functional standards: The network attack and defense tools that are checked and included in the database must be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms;

[0037] 3) Performance standards: The performance indicators of network attack and defense tools that are checked and stored must meet the set standards. The performance indicators include response time, system resource usage, and throughput.

[0038] 4) Compatibility standards: Network attack and defense tools that are included in the inspection database must be compatible with the latest mainstream operating systems;

[0039] 5) Compliance standards: Network attack and defense tools that are inspected and stored must comply with relevant regulations and technical specifications;

[0040] For an attack tool to be included in the database, it is necessary to record the tool name, tool category, network attack target, brief introduction, detailed introduction and all parameter information as required, and then check whether it meets the specifications for tool inclusion in the database. Only after the information is filled in and the tool passes the normative test can it be officially included in the database.

[0041] If the tool fails to enter the warehouse, the specific reasons for the failure will be displayed, such as incomplete information, the tool does not meet the warehouse specifications, etc. If the tool passes the warehouse, the pass result will be displayed and the tool can be found in the library. For the existing tools displayed by the system, similar logic can also be used to delete, modify, and check. When modifying the tool, the system will also detect whether the modified tool meets the warehouse specifications to prevent the use of rule loopholes to introduce tools that do not meet the specifications.

[0042] The network attack and defense tool identification and screening module is used to provide users with the function of quickly locating network attack and defense tools through tags including the classification and function of the tool, the environment on which the tool depends, and a certain syntax of the tool; users can query network attack and defense tools in multiple dimensions based on the feature tags of the tools from multiple angles.

[0043] From the perspective of functional identification, attack and defense tools are divided into categories such as information collection, vulnerability analysis, WEB attack, database attack, password attack, penetration attack, reverse analysis, terminal attack, network attack, and server cluster attack. From the perspective of attack process identification, attack and defense tools are divided into categories such as information collection, vulnerability discovery, password attack, penetration attack, and reverse analysis. From the perspective of attack target identification, the targets of attack and defense tools are divided into categories such as terminal workstations, data storage services, server clusters, network equipment, software applications, domestic platforms, and Internet of Things devices. For example, for the Nmap tool, the system labels it with network attacks, information collection, and server clusters, and technicians can use these labels to locate and filter out the Nmap tool.

[0044] Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and receive target information required for the tool to run;

[0045] The template configuration for the network attack and defense tool is as follows:

[0046] For each specific function of a network attack and defense tool, define an attack process and required parameters, encapsulate the attack function into a template, hide the specific use process of the parameters, present it as an achievable function, and simplify the complex syntax of the network attack and defense tool into a tool template that is easy to understand and use;

[0047] Through the encapsulation of the template, users do not need to remember the specific meaning of the tool parameters and the details of the combination of parameters. They can quickly call a specific function indicated by the tool template according to the text description of the template. At the same time, the tool template uses probe technology during execution. During the execution process, the attack process probe is configured, which can report abnormal information in time and capture the execution results returned by the tool for subsequent operations;

[0048] The attack template data transmission module is used for direct data transmission between network attack and defense templates. The transmitted data includes valid information in the execution results returned by the specific functions indicated by the tool execution template, including the result of attack success or failure, the network address and port number of the attack; Figure 2 ;

[0049] When configuring the template, the collection of execution results returned by the tool is provided. On this basis, the execution results are filtered, and valid information in the execution results is obtained and saved, and stored in the form of variables. The saved results can be used for branching, identification, and calling in subsequent steps.

[0050] After executing an attack template, the result regularization is used to obtain useful information from the output of the tool for data transfer between templates, including attack success or failure, network address and port number information. This information is saved in the database in the form of key-value pairs. The result of attack success or failure can be used for branch judgment, and the network address and port number information can be passed to the next template.

[0051] The data transmission between templates realized by the present invention saves the information in the form of key-value pairs into a database, which can be used for branch judgment and can also be passed to the next template to participate in the writing of the calling command as part of its input. In this way, data transmission between network attack and defense tools is realized, creating conditions for the combined use of tools.

[0052] In order to capture and store the output and return results when the tool is running, the present invention uses the subprocess library of Python language to capture the console output of the tool.

[0053] Each result regular expression also has its name, description and content. The result regular expression acts on the output result returned by the tool after the template is executed. The result regular expression captures and outputs the content matched by the regular expression and stores it in the form of variables. The variables stored in the result regular expression can be called when needed later, such as as the input of the next template, branch judgment condition, etc. The result regular expression can also be added, modified and deleted to change the output of the regular expression.

[0054] A specific application of template configuration and data transfer:

[0055] For example, Medusa is a tool for password cracking. When it is added to the tool library, it can be identified by tool name, tool category (network cracking authentication, password attack), tool parameters, etc. The template can also be configured according to its parameters. The commonly used parameters and parameter functions of Medusa are as follows:

[0056] -h: target IP address;

[0057] -H: file containing the target IP address;

[0058] -u: specifies the user name for the test;

[0059] -U: specifies the user name dictionary for the test;

[0060] -p: specifies the test password;

[0061] -P: specifies the password dictionary for the test;

[0062] -C: specifies the test format as a dictionary of "user:password";

[0063] -O: Save the output results in the specified file;

[0064] -M: specifies the module to be executed (without the .mod extension);

[0065] -m: specifies the parameters passed to the module;

[0066] -d: View modules that support cracking;

[0067] -n: specifies a non-default TCP port;

[0068] -s: Enable SSL;

[0069] -g: Set the connection timeout (the default value is 3);

[0070] -r: Set the number of retries (the default value is 3);

[0071] -T: Set the total number of logins to be tested simultaneously;

[0072] According to the above parameters, you can configure templates such as Medusa brute force ssh, Medusa brute force password, etc. For Medusa brute force password, we can set the following parameter list:

[0073] Parameter name: username, type: str, content: -u@arg;

[0074] Parameter name: password, type: str, content: -P@arg;

[0075] Parameter name: module, type: str, content: -M@arg;

[0076] Parameter name: ip, type: str, content: -h@arg;

[0077] Parameter name: port, type: str, content: -n@arg;

[0078] Among them, @arg indicates the target information that needs to be manually entered when the template is called. When calling the template, there is no need to manually enter the tool parameters of Medusa, only the relevant information of the target needs to be entered, which is convenient to use.

[0079] At the same time, you can configure the result regularization for this template:

[0080] ACCOUNT FOUND.*User:(?P <username>\w+).*Password:(?P <password>\w+).*\[SUCCESS\]

[0081] The regular expression returned by the result is username and password, which is the result of the tool's brute force attack on the password. By using the result regular expression method, you can match and obtain valid information in the tool's return results, which simplifies the use of the tool.

[0082] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.< / password> < / username>

Claims

1. A network attack and defense tool management system, characterized in that: include: The tool library module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library; The standardized detection includes detecting the properties of the network attack and defense tool, and the properties include: the input, output, operating efficiency and operating environment of the network attack and defense tool; The network attack and defense tool identification and screening module is used to provide users with the function of quickly locating network attack and defense tools through feature tags including the classification and function of the tools, the environment on which the tools depend, and a certain syntax of the tools; Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and receive target information required for the tool to run; The template configuration for the network attack and defense tool is as follows: For a specific function of each network attack and defense tool, define an attack step process and required parameters, encapsulate the attack function into a template, hide the specific use process of the parameters, and present it as a tool template of the function that can be realized, thereby obtaining the tool template; The attack template data transfer module is used for direct data transfer between network attack and defense templates. The transferred data includes valid information in the execution results returned by the specific functions indicated by the tool execution template, including the results of attack success or failure, the network address and port number information of the attack.

2. The network attack and defense tool management system according to claim 1, characterized in that: In the tool storage module, standardized testing includes the following normative standards: 1) Normative standards: The use of network attack and defense tools that are checked and stored must be realized only through command lines. They must not be called in other forms or combined with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output interaction of the command; 2) Functional standards: The network attack and defense tools that are checked and included in the database must be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms; 3) Performance standards: The performance indicators of network attack and defense tools that are checked and stored must meet the set standards. The performance indicators include response time, system resource usage, and throughput. 4) Compatibility standards: Network attack and defense tools that are included in the inspection database must be compatible with the latest mainstream operating systems; 5) Compliance standards: Network attack and defense tools that are inspected and stored must comply with relevant regulations and technical specifications.

3. The network attack and defense tool management system according to claim 1, characterized in that: The feature tags are set from the following perspectives: From the perspective of attack target classification, the targets of network attack and defense tools are divided into the following categories: terminal workstations, data storage services, server clusters, network equipment, software applications, domestic platforms, and Internet of Things devices, and feature labels are established; From a functional perspective, feature tag classification includes: information collection, vulnerability analysis, WEB attack, database attack, password attack, penetration attack, reverse analysis, terminal attack, network attack, and server cluster attack.

4. The network attack and defense tool management system according to claim 1, characterized in that: In the attack template data transmission module, the transmitted data is obtained from the output of the network attack tool through the result regularization.

5. The network attack and defense tool management system according to claim 4, characterized in that: In the attack template data transmission module, the result regularization acts on the output result returned by the network attack tool after the template is executed. The result regularization captures and outputs the content matched by the regularization and stores it in the form of a variable. The result of the success or failure of the attack is used as a branch judgment condition to select the next template, and the network address and port number information of the attack is used as the input of the next template.

Images