A network attack and defense tool management system

Abstract

This invention discloses a network attack and defense tool management system, comprising: a tool entry module, used to perform standardized testing on newly entered network attack and defense tools and add those that meet the standards to the tool library; a network attack and defense tool identification and filtering module, used to provide users with a quick location function for network attack and defense tools through feature tags including tool classification and function, the environment the tool depends on, and a certain syntax of the tool; network attack and defense tool attack templates, used to provide users with guidance on calling a specific function of the tool and to receive the target information required for the tool to run; and an attack template data transmission module, used for direct data transmission between network attack and defense templates, the transmitted data including valid information from the execution results returned by the tool when executing the specific function indicated by the template. This invention improves the usability and attack efficiency of network attack tools.

Description

Technical Field

[0001] This invention relates to network security technology, and more particularly to a network attack and defense tool management system. Background Art

[0002] From a functional perspective, existing network attack and defense tools can be categorized into information gathering, vulnerability analysis, web attack, database attack, password attack, penetration testing, reverse engineering, endpoint attack, network attack, and server cluster attack. Different types of tools are suitable for different network attack scenarios, and technical personnel should select appropriate tools for attack testing.

[0003] Faced with diverse and complex network attack and defense tools, training skilled technicians requires increasingly high training and learning costs. Meanwhile, a large number of network attack and defense platforms have emerged in the market, most of which focus on the construction and configuration of attack and defense environments and systems, while the integration and management of network attack and defense tools are still inadequate, resulting in many situations where technicians need to manually configure and use these tools. For network attack and defense of large-scale systems, a mature tool management system is needed to uniformly manage available network attack and defense tools. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a network attack and defense tool management system to address the deficiencies in the prior art.

[0005] The technical solution adopted by this invention to solve its technical problem is: a network attack and defense tool management system, comprising:

[0006] The tool entry module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library;

[0007] The standardized testing includes testing the attributes of network attack and defense tools, including: the input, output, operating efficiency, and operating environment of the network attack and defense tools;

[0008] The network attack and defense tool identification and filtering module is used to provide users with a quick location function for network attack and defense tools through feature tags including the tool's classification and function, the environment on which the tool depends, and a certain syntax of the tool;

[0009] Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and to receive the target information required for the tool to run.

[0010] The template configuration for network attack and defense tools is as follows:

[0011] For each specific function of a network attack and defense tool, define an attack process and required parameters, encapsulate the attack function into a template, hide the specific usage process of the parameters, and present it as a tool template that can achieve the function.

[0012] The attack template data transmission module is used for direct data transmission between network attack and defense templates. The transmitted data includes valid information from the execution results returned by the tool when executing the specific functions instructed by the template, including the result of whether the attack was successful or failed, and the network address and port number information of the attack.

[0013] According to the above scheme, the standardized testing in the tool storage module includes the following normative standards:

[0014] 1) Normative Standards: Network attack and defense tools that have been verified and entered into the database must be used only through command lines. They must not be invoked in any other form or in combination with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output of commands.

[0015] 2) Functional Standards: For network attack and defense tools that have been verified and included in the database, they should be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms;

[0016] 3) Performance Standards: The performance indicators of network attack and defense tools that are included in the database must meet the set standards. The performance indicators include response time, system resource consumption, and throughput.

[0017] 4) Compatibility Standards: Network attack and defense tools included in the database must be compatible with the latest mainstream operating systems;

[0018] 5) Compliance standards: Network attack and defense tools that are inspected and included in the database must comply with relevant laws and technical specifications.

[0019] According to the above scheme, the feature labels are set from the following perspectives:

[0020] From the perspective of attack target classification, the targets of network attack and defense tools are divided into the following categories: terminal workstations, data storage services, server clusters, network devices, software applications, domestic platforms, and Internet of Things devices, and feature tags are established.

[0021] From a functional perspective, the feature tags can be categorized as follows: information gathering, vulnerability analysis, web attacks, database attacks, password attacks, penetration attacks, reverse engineering, endpoint attacks, network attacks, and server cluster attacks.

[0022] According to the above scheme, in the attack template data transmission module, the transmitted data is obtained from the output of the network attack tool through result regularization.

[0023] According to the above scheme, in the attack template data transmission module, the result regular expression is applied to the output result returned by the network attack tool after the template is executed. The result regular expression captures and outputs the content matched by the regular expression and stores it in the form of variables. The result of attack success or failure is used as a branch judgment condition to select the next template. The network address and port number information of the attack are used as the input of the next template.

[0024] The beneficial effects of this invention are:

[0025] This invention proposes an scalable method for tool entry into the database and establishes standardized specifications for tool entry, enabling standardized entry review, modification and deletion of tools, as well as multi-angle and multi-classification tool identification and screening, thus possessing powerful comprehensive tool management capabilities.

[0026] This invention proposes and implements a template configuration method and a data transmission method between templates for network attack and defense tools, realizing the template-based configuration of network attack and defense tools and the serial use of tool templates, thereby improving the ease of use and attack efficiency of network attack tools. Attached Figure Description

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments. In the accompanying drawings:

[0028] Figure 1 This is a schematic diagram of the structure of an embodiment of the present invention;

[0029] Figure 2 This is a schematic diagram of attack template data transmission according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0031] like Figure 1 As shown, a network attack and defense tool management system includes:

[0032] The tool entry module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library;

[0033] The standardized testing includes testing the attributes of network attack and defense tools, including: the input, output, operating efficiency, and operating environment of the network attack and defense tools;

[0034] Standardized testing includes the following normative standards:

[0035] 1) Normative Standards: Network attack and defense tools that have been verified and entered into the database must be used only through command lines. They must not be invoked in any other form or in combination with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output of commands.

[0036] 2) Functional Standards: For network attack and defense tools that have been verified and included in the database, they should be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms;

[0037] 3) Performance Standards: The performance indicators of network attack and defense tools that are included in the database must meet the set standards. The performance indicators include response time, system resource consumption, and throughput.

[0038] 4) Compatibility Standards: Network attack and defense tools included in the database must be compatible with the latest mainstream operating systems;

[0039] 5) Compliance Standards: Network attack and defense tools that are inspected and included in the database must comply with relevant laws and technical specifications;

[0040] For an attack tool to be added to the database, the following information must be recorded: tool name, tool category, network attack target, brief description, detailed description, and all parameters. Then, it must be checked to see if it conforms to the database addition specifications. Only after the information is filled in and passes the compliance check can the tool be officially added to the database.

[0041] If a tool fails to be added to the database, the system will display the specific reason for the failure, such as incomplete information or non-compliance with the database entry specifications. If the tool is successfully added, the system will display the result and the tool can be found in the database. Similar logic can be used to delete, modify, and query existing tools displayed by the system. When modifying a tool, the system will also check whether the modified tool conforms to the database entry specifications to prevent the introduction of non-compliant tools by exploiting loopholes in the rules.

[0042] The network attack and defense tool identification and filtering module is used to provide users with a quick location function for network attack and defense tools through tags including tool classification and function, the environment on which the tool depends, and a certain syntax of the tool; users can query network attack and defense tools from multiple dimensions based on the feature tags of the tool.

[0043] From a functional identification perspective, attack and defense tools are categorized into information gathering, vulnerability analysis, web attacks, database attacks, password attacks, penetration attacks, reverse engineering, endpoint attacks, network attacks, and server cluster attacks. From an attack process identification perspective, they are categorized into information gathering, vulnerability discovery, password attacks, penetration attacks, and reverse engineering. From an attack target identification perspective, the targets of attack and defense tools are categorized into endpoint workstations, data storage services, server clusters, network devices, software applications, domestic platforms, and IoT devices. For example, the system tags the Nmap tool with network attacks, information gathering, and server cluster attacks, allowing technicians to locate and filter Nmap tools using these tags.

[0044] Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and to receive the target information required for the tool to run.

[0045] The template configuration for network attack and defense tools is as follows:

[0046] For each specific function of a network attack and defense tool, define an attack process and required parameters, encapsulate the attack function into a template, hide the specific usage process of the parameters, and present it as an achievable function, simplifying the complex syntax of network attack and defense tools into an easy-to-understand and easy-to-use tool template;

[0047] By encapsulating the template, users don't need to remember the specific meanings of the tool's parameters or the details of their combinations. They can quickly invoke a specific function indicated by the template's text description. Simultaneously, the tool template uses probe technology during execution, configuring attack process probes to promptly report anomalies and capture the tool's returned execution results for subsequent operations.

[0048] The attack template data transmission module is used for direct data transmission between network attack and defense templates. The transmitted data includes valid information from the execution results returned by the tool when executing the specific functions instructed by the template, such as the attack success or failure result, and the network address and port number information of the attack; for example... Figure 2 ;

[0049] The template configuration includes a feature to collect the execution results returned by the tool. Based on this, the results are filtered to extract and save valid information as variables. These saved results can then be used for branching, identification, and retrieval in subsequent steps.

[0050] After an attack template is executed, useful information is extracted from the tool's output using regular expressions for data transfer between templates. This information includes whether the attack was successful or failed, and the network address and port number. This information is saved in a database as key-value pairs. The success or failure result can be used for branching decisions, and the network address and port number information can be passed to the next template.

[0051] The data transfer between templates implemented in this invention saves this information in the form of key-value pairs in a database. This information can be used for branch judgment or passed to the next template as part of its input for writing call commands. This enables data transfer between network attack and defense tools and creates conditions for the combined use of tools.

[0052] In order to capture and store the output and return results of the tool during runtime, this invention uses the subprocess library of the Python language to capture the console output of the tool.

[0053] Each result regular expression has its own name, description, and content. Result regular expressions affect the output returned by the tool after the template execution. They capture and output the content matched by the regular expression and store it as variables. These stored variables can be accessed later, such as as input for the next template or as branch conditions. Result regular expressions can also be added to, modified, and deleted to change their output.

[0054] A specific application of template configuration and data transfer:

[0055] For example, Medusa is a password brute-force tool. Adding it to your tool library allows you to identify it by tool name, category (network authentication cracking, password attack), and parameters. You can also configure templates based on its parameters. Commonly used Medusa parameters and their functions are as follows:

[0056] -h: target IP address;

[0057] -H: A file containing the target IP address;

[0058] -u: Specifies the username for the test;

[0059] -U: Specifies the dictionary of usernames to be tested;

[0060] -p: Specifies the password for the test;

[0061] -P: Specifies the password dictionary to test;

[0062] -C: Specifies a dictionary to be tested in the format "user:password";

[0063] -O: Save the output to the specified file;

[0064] -M: Specifies the module to execute (without the .mod extension);

[0065] -m: Specifies the parameters to be passed to the module;

[0066] -d: View supported modules for cracking;

[0067] -n: Specifies a non-default TCP port;

[0068] -s: Enable SSL;

[0069] -g: Sets the connection timeout (default value is 3);

[0070] -r: Sets the number of retries (default value is 3);

[0071] -T: Sets the total number of logins that can be tested simultaneously;

[0072] Based on the above parameters, templates for Medusa brute-force SSH and Medusa brute-force password can be configured. For Medusa brute-force passwords, the following parameter list can be set:

[0073] Parameter name: username, type: str, content: -u@arg;

[0074] Parameter name: password, type: str, content: -P@arg;

[0075] Parameter name: module, type: str, content: -M@arg;

[0076] Parameter name: ip, type: str, content: -h@arg;

[0077] Parameter name: port, type: str, content: -n@arg;

[0078] Here, `@arg` indicates target information that may need to be manually entered when calling the template. When calling the template, you don't need to manually enter Medusa's tool parameters; you only need to enter the target's relevant information, making it convenient to use.

[0079] Additionally, regular expressions can be configured for the results of this template:

[0080] ACCOUNT FOUND.*User:(?P <username>\w+).*Password:(?P <password>\w+).*\[SUCCESS\]

[0081] The result regular expression returns a list of regular expressions for "username" and "password," representing the tool's brute-force password results. By using regular expressions, valid information can be extracted from the tool's returned results, simplifying its use.

[0082] It should be understood that those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.< / password> < / username>

Claims

1. A network attack and defense tool management system, characterized in that, include: The tool entry module is used to perform standardized testing on newly added network attack and defense tools, and add network attack and defense tools that meet the standards to the tool library; The standardized testing includes testing the attributes of network attack and defense tools, including: the input, output, operating efficiency, and operating environment of the network attack and defense tools; The network attack and defense tool identification and filtering module is used to provide users with a quick location function for network attack and defense tools through feature tags including the tool's classification and function, the environment on which the tool depends, and a certain syntax of the tool; Network attack and defense tool attack templates are used to provide users with guidance on calling a specific function of the tool and to receive the target information required for the tool to run. The template configuration for network attack and defense tools is as follows: For each specific function of a network attack and defense tool, define an attack process and required parameters, encapsulate the attack function into a template, hide the specific usage process of the parameters, and present it as a tool template that can achieve the function, thus obtaining the tool template; The attack template data transmission module is used for direct data transmission between network attack and defense templates. The transmitted data includes valid information from the execution results returned by the tool when executing the specific functions instructed by the template, including the result of whether the attack was successful or failed, and the network address and port number information of the attack.

2. The network attack and defense tool management system according to claim 1, characterized in that, In the tool import module, standardized testing includes the following normative standards: 1) Normative Standards: Network attack and defense tools that have been verified and entered into the database must be used only through command lines. They must not be invoked in any other form or in combination with other forms. That is, during the execution of the tool and when the tool returns, the interaction must be limited to the input and output of commands. 2) Functional Standards: For network attack and defense tools that have been verified and included in the database, they should be able to implement at least one network attack and defense function, including vulnerability disclosure, cryptographic algorithms, and identity authentication or authorization mechanisms; 3) Performance Standards: The performance indicators of network attack and defense tools that are included in the database must meet the set standards. The performance indicators include response time, system resource consumption, and throughput. 4) Compatibility Standards: Network attack and defense tools included in the database must be compatible with the latest mainstream operating systems; 5) Compliance standards: Network attack and defense tools that are inspected and included in the database must comply with relevant laws and technical specifications.

3. The network attack and defense tool management system according to claim 1, characterized in that, The feature labels are set from the following perspectives: From the perspective of attack target classification, the targets of network attack and defense tools are divided into the following categories: terminal workstations, data storage services, server clusters, network devices, software applications, domestic platforms, and Internet of Things devices, and feature tags are established. From a functional perspective, the feature tags can be categorized as follows: information gathering, vulnerability analysis, web attacks, database attacks, password attacks, penetration attacks, reverse engineering, endpoint attacks, network attacks, and server cluster attacks.

4. The network attack and defense tool management system according to claim 1, characterized in that, In the attack template data transmission module, the transmitted data is obtained from the output of the network attack tool through result regularization.

5. The network attack and defense tool management system according to claim 4, characterized in that, In the attack template data transmission module, the result regular expression is applied to the output result returned by the network attack tool after the template is executed. The result regular expression captures and outputs the content matched by the regular expression and stores it in the form of variables. The result of attack success or failure is used as a branch judgment condition to select the next template. The network address and port number information of the attack are used as the input of the next template.

Images