Network security assessment method based on attack and defense drill

Abstract

The invention discloses a network security assessment method based on attack and defense drilling, and relates to the field of network security. According to the method, the network attack type is acquired, the attack team system is constructed, the network defense mode corresponding to the network attack type is acquired, the defense capability is acquired, the defense team system is constructed, the target network information system and the simulation channel are set, and the network attack and defense exercise model is constructed according to the simulation channel; carrying out attack and defense simulation on the network attack type based on the network attack and defense drill model, obtaining a corresponding initial defense result, analyzing the initial defense result, obtaining an abnormal network defense mode data set, analyzing the abnormal network defense mode data set, and obtaining a brand new defense mode data set; performing loop attack simulation on the attack type according to the brand new defense mode data set to obtain a newest defense result, and analyzing and evaluating the newest defense result to obtain a correction report; and obtaining an evaluation period according to the correction report, and obtaining an optimal defense mode data set according to the evaluation period.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a network security assessment method based on attack and defense drills. Background Art

[0002] Attack and defense drills are scenarios that simulate real attacks and defenses. They are used to evaluate the information security defense capabilities of an enterprise or organization through attack tests and security drills. This type of drill is designed to identify potential security risks and flaws, and to improve the organization's ability to respond to security threats. Attack and defense drills are generally divided into two roles: attacker and defender. The attacker simulates an external attacker trying to invade the target system, network, or application, while the defender is the enterprise defender who takes measures to protect the operating environment of the enterprise system. Through this simulation, an enterprise or organization can better understand its security, identify and correct possible problems, in order to improve its security and reduce risks. At the same time, attack and defense drills also help strengthen the blue team's security awareness and practical training, test the effectiveness of its security defense strategies and measures, and ensure that its network and data are protected to the greatest extent possible.

[0003] Currently, network security faces many challenges, such as network attacks, vulnerability exploits, and data leaks, which lead to the leakage of users' personal information and sensitive data, causing serious privacy issues and the theft, tampering, or sale of data, causing individuals or organizations to face legal liability, reputation damage, and harassment. To solve the above problems, the present invention provides a network security assessment method based on attack and defense drills. Summary of the invention

[0004] In order to solve the above technical problems, the present invention provides a network security assessment method based on attack and defense drills;

[0005] The purpose of the present invention can be achieved by the following technical solution: a network security assessment method based on attack and defense drills, the method comprising the following steps:

[0006] Step S1: Obtain the network attack type, build an attack team system, obtain the network defense method corresponding to the network attack type, and obtain the defense capability, build a defense team system, set the target network information system and simulation channel, and build a network attack and defense exercise model according to the simulation channel;

[0007] Step S2: Based on the network attack and defense drill model, perform attack and defense simulation on the network attack type, obtain the corresponding initial defense result, analyze the initial defense result, obtain an abnormal network defense method data set, analyze the abnormal network defense method data set, and obtain a new defense method data set;

[0008] Step S3: Perform cyclic attack simulation on the attack type according to the new defense method data set, obtain the latest defense results, analyze and evaluate the latest defense results, and obtain a correction report;

[0009] Step S4: Obtain an evaluation period according to the correction report, and obtain an optimal defense method data set according to the evaluation period.

[0010] Furthermore, the construction process of the attack team system includes:

[0011] Based on the Internet, several information systems are obtained, and non-repetitive system codes are performed on the information systems, and the system codes are recorded as [system X], where X = {1, 2, ..., i}, and i is a positive integer; then, an information network architecture corresponding to the information system is obtained, and the attack type corresponding to the information system is obtained according to the information network architecture, and the attack type is integrated to obtain the network attack type, and the network attack type is non-repetitively encoded, and the type code is recorded as [type L], where L = {1, 2, ..., n}, and n is a positive integer;

[0012] Obtain the multi-source risk value corresponding to the information system according to the network attack type, make a risk prediction for the network attack type according to the multi-source risk value, and obtain the network attack risk value;

[0013] The calculation formula of the network attack risk value is:

[0014]

[0015] Among them, η [类型L] It is represented by the network attack risk value corresponding to [type L]; w represents the number of multi-source risk values ​​obtained by system X], and w is a positive integer; a Xw It is expressed as [system X] to obtain the corresponding multi-source risk value; λ L It is expressed as the risk weight corresponding to [Type L];

[0016] Arrange the network attack risk values ​​in order from large to small and connect them according to the order of arrangement, and connect the network attack risk values ​​with the corresponding network risk types to generate an attack team system.

[0017] Furthermore, the construction process of the defense team system includes:

[0018] According to the network attack type, the corresponding network defense method is obtained, the network defense method is numbered, and the defense capability corresponding to the network defense method is obtained, which is recorded as Where m is a number, which is a positive integer, and is a natural number greater than 0;

[0019] The network defense methods corresponding to the same network attack type are merged to generate a corresponding network defense method data set; then the network defense method data set is connected with the corresponding network attack type to generate a defense team system.

[0020] Furthermore, the construction process of the network attack and defense drill model includes:

[0021] Wirelessly connect the target network information system to the information system, and set a system code input port in the target network information system to obtain the information system corresponding to the system code; send the corresponding information system to the target network information system, and then obtain the network attack simulation system;

[0022] The attack team system, target network information system and defense team system are systematically connected through the simulation channel to build a network attack and defense drill model.

[0023] Furthermore, the process of obtaining the initial defense result includes:

[0024] The system code corresponding to the information system is stored, a system code database is generated, and the system code database is sent to the system code input port of the target network system starting from the first system code in the information system database according to the arrangement order of the system codes, the corresponding information system is obtained and sent to the target network information system to generate a network attack simulation system for attack simulation;

[0025] According to the sorting order of the network attack risk values ​​in the attack team system, the corresponding network risk types are sent to the target network information system through the simulation channel in sequence for attack simulation. At the same time, the network defense method data sets corresponding to the network risk types in the defense team system are dispatched in sequence and transmitted to the target network information system through the simulation channel for defense simulation. Then, the initial defense results corresponding to the network defense method data sets are obtained in sequence, and the preliminary attack and defense simulation of a network attack simulation system is completed.

[0026] At the same time, the next system code in the system code database is sent to obtain the network attack simulation system and complete the preliminary attack and defense simulation. Similarly, all the corresponding network attack simulation systems in the system code database complete the preliminary attack and defense simulation.

[0027] The formula for obtaining the preliminary defense result is:

[0028]

[0029] in, Represented as the initial defense result; φ [类型L] It is represented by the weight corresponding to the network attack risk value of the network attack type through the simulation channel; μ 1 , μ 2, ..., μ m It is represented by the weight corresponding to the defense capability through the simulation channel, and its value is a natural number greater than 0.

[0030] Furthermore, the process of acquiring the abnormal network defense mode data set includes:

[0031] According to the network attack simulation system and the corresponding network attack type, the corresponding preliminary defense result threshold is set, which is recorded as The value is a natural number greater than or equal to 0; and compared with the preliminary defense results, the abnormal network defense method data set is obtained:

[0032] like The corresponding network defense method dataset is marked as an abnormal network defense method dataset; otherwise, it is marked as a normal network defense method dataset.

[0033] Furthermore, the process of acquiring the new defense method dataset includes:

[0034] Obtain the network defense method corresponding to the abnormal network defense method data set, and obtain the defense capability corresponding to the network defense method, compare the defense capability with the corresponding initial defense result, and obtain the defense capability comparison value, which is recorded as

[0035] Set the threshold range for obtaining the defense capability comparison value, denoted as [F 1 , F 2 ] and compare it with the defensive capability comparison value:

[0036] If F∈[F 1 , F 2 ], the corresponding network defense method will be modified to obtain the updated defense method;

[0037] If F <F 1 , then the corresponding network defense method will be added with defense functions to obtain updated defense methods;

[0038] If F>F 2 , no processing is done;

[0039] The abnormal network defense method dataset is updated according to the updated defense method to generate a new defense method dataset.

[0040] Furthermore, the process of obtaining the correction report includes:

[0041] According to the new defense method data set, the network attack simulation system corresponding to the abnormal network defense method data set and the corresponding network attack type are simulated cyclically to obtain preliminary defense results, which are recorded as the latest defense results;

[0042] If the new defense method dataset is judged to be an abnormal network defense method dataset according to the latest defense result, the loop simulation is continued until the normal network defense method dataset is obtained and marked as the latest defense method dataset, and the number of loops is obtained; otherwise, the loop simulation is stopped;

[0043] Obtain the correction report corresponding to the network attack simulation system based on the normal network defense mode data set;

[0044] The correction report includes the system code, type code, number of cycles, preliminary defense results corresponding to the number of cycles, and the latest defense results;

[0045] Furthermore, the process of obtaining the optimal defense mode data set includes:

[0046] The evaluation cycle corresponding to the network attack simulation system is set according to the number of cycles in the correction report, and then the network attack simulation system is simulated periodically according to the correction report to obtain the optimal defense method data set.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] 1. The information network architecture can be used to obtain the connection mode, network equipment and communication rules of the information system, and can comprehensively obtain the data information of the information system; then obtain the attack type, integrate the attack type, obtain the network attack type, and then obtain the corresponding network attack risk value through calculation, make a preliminary assessment of the network attack risk value, and better simulate the network attack type purposefully, saving simulation time and improving simulation accuracy;

[0049] 2. In the above-mentioned setting system code input port, the corresponding information system is obtained and sent to the target network information system to generate a network attack simulation system for attack and defense drill simulation, thereby improving the uniqueness and targeting of the attack and defense drill simulation environment;

[0050] 3. Compare the defense capabilities of the network defense methods corresponding to the abnormal network defense method data set with the corresponding preliminary defense results to better determine which network defense methods need to be changed to add defense functions; improve the defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0052] Figure 1It is a flow chart of the present invention.

[0053] Figure 2 It is the simulation process of the network attack and defense exercise model of the present invention; DETAILED DESCRIPTION

[0054] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0055] like Figure 1 As shown, a network security assessment method based on attack and defense drills comprises the following steps:

[0056] Step S1: Obtain the network attack type, build an attack team system, obtain the network defense method corresponding to the network attack type, obtain the defense capability, build a defense team system, set the target network information system and simulation channel, and build a network attack and defense exercise model according to the simulation channel;

[0057] Step S2: Based on the network attack and defense drill model, perform attack and defense simulation on the network attack type, obtain the corresponding initial defense result, analyze the initial defense result, obtain an abnormal network defense method data set, analyze the abnormal network defense method data set, and obtain a new defense method data set;

[0058] Step S3: Perform cyclic attack simulation on the attack type according to the new defense method data set, obtain the latest defense results, analyze and evaluate the latest defense results, and obtain a correction report;

[0059] Step S4: Obtain an evaluation period according to the correction report, and obtain an optimal defense method data set according to the evaluation period.

[0060] With respect to step S1, the construction process of the attack team system includes:

[0061] Based on the Internet, several information systems are obtained, and non-repetitive system codes are performed on the information systems, and the system codes are recorded as [system X], where X = {1, 2, ..., i}, and i is a positive integer; then, an information network architecture corresponding to the information system is obtained, and the attack type corresponding to the information system is obtained according to the information network architecture, and the attack type is integrated to obtain the network attack type, and the network attack type is non-repetitively encoded, and the type code is recorded as [type L], where L = {1, 2, ..., n}, and n is a positive integer;

[0062] Obtain the multi-source risk value corresponding to the information system according to the network attack type, make a risk prediction for the network attack type according to the multi-source risk value, and obtain the network attack risk value;

[0063] The calculation formula of the network attack risk value is:

[0064]

[0065] Among them, η [类型L] It is represented by the network attack risk value corresponding to [type L]; w is represented by the number of multi-source risk values ​​obtained by [system X], and w is a positive integer; a Xw It is expressed as [system X] to obtain the corresponding multi-source risk value; λ L It is expressed as the risk weight corresponding to [Type L];

[0066] Arrange the network attack risk values ​​in order from large to small and connect them according to the order of arrangement, and connect the network attack risk values ​​with the corresponding network risk types to generate an attack team system;

[0067] The above-mentioned information system needs further explanation, and the information system includes but is not limited to enterprise information system, school information system, organization information system and campus information system, etc.; in one embodiment, the information network architecture is used to connect resources and network structures in the information system, including network topology structure, network hierarchy structure and network protocol structure; the information network architecture can be used to obtain the connection mode, network equipment and communication criteria of the information system, and the data information of the information system can be fully obtained; then the attack type is obtained, the attack type is integrated, the network attack type is obtained, and then the corresponding network attack risk value is obtained by calculation, and the network attack risk value is preliminarily evaluated, so as to better simulate the network attack type purposefully, save simulation time and improve simulation accuracy;

[0068] With respect to step S1, the construction process of the defense team system includes:

[0069] According to the network attack type, the corresponding network defense method is obtained, the network defense method is numbered, and the defense capability corresponding to the network defense method is obtained, which is recorded as Where m is a number, which is a positive integer, and is a natural number greater than 0;

[0070] Merge the network defense methods corresponding to the same network attack type to generate a corresponding network defense method data set; then connect the network defense method data set with the corresponding network attack type to generate a defense team system;

[0071] With respect to step S1, the process of constructing the network attack and defense exercise model includes:

[0072] Wirelessly connect the target network information system to the information system, and set a system code input port in the target network information system to obtain the information system corresponding to the system code; send the corresponding information system to the target network information system, and then obtain the network attack simulation system;

[0073] The attack team system, target network information system and defense team system are systematically connected through the simulation channel to build a network attack and defense exercise model;

[0074] In one embodiment, it is further explained that in the above-mentioned setting of the system code input port, the corresponding information system is obtained, and the network attack simulation system is generated and sent to the target network information system for attack and defense drill simulation, thereby improving the uniqueness and targeting of the attack and defense drill simulation environment;

[0075] like Figure 2 As shown, for step S2, the process of obtaining the initial defense result includes:

[0076] The system code corresponding to the information system is stored, a system code database is generated, and the system code database is sent to the system code input port of the target network system starting from the first system code in the information system database according to the arrangement order of the system codes, the corresponding information system is obtained and sent to the target network information system to generate a network attack simulation system for attack simulation;

[0077] According to the sorting order of the network attack risk values ​​in the attack team system, the corresponding network risk types are sent to the target network information system through the simulation channel in sequence for attack simulation. At the same time, the network defense method data sets corresponding to the network risk types in the defense team system are dispatched in sequence and transmitted to the target network information system through the simulation channel for defense simulation. Then, the initial defense results corresponding to the network defense method data sets are obtained in sequence, and the preliminary attack and defense simulation of a network attack simulation system is completed.

[0078] At the same time, the next system code in the system code database is sent to obtain the network attack simulation system and complete the preliminary attack and defense simulation. Similarly, all the corresponding network attack simulation systems in the system code database complete the preliminary attack and defense simulation.

[0079] Furthermore, the formula for obtaining the preliminary defense result is:

[0080]

[0081] in, Represented as the initial defense result; φ [类型L] It is represented by the weight corresponding to the network attack risk value of the network attack type through the simulation channel; μ 1, μ 2 , ..., μ m It is represented by the weight corresponding to the defense capability through the simulation channel, and its value is a natural number greater than 0;

[0082] like Figure 2 As shown, for step S2, the process of acquiring the abnormal network defense mode data set includes:

[0083] According to the network attack simulation system and the corresponding network attack type, the corresponding preliminary defense result threshold is set, which is recorded as The value is a natural number greater than or equal to 0; and compared with the preliminary defense results, the abnormal network defense method data set is obtained:

[0084] like The corresponding network defense method dataset is marked as an abnormal network defense method dataset; otherwise, it is marked as a normal network defense method dataset;

[0085] Regarding the setting of the above-mentioned preliminary defense result threshold, it needs to be further explained that in the present invention, the corresponding threshold is set according to the network attack simulation system and the corresponding network attack type. In one embodiment, for the same network attack simulation system, different defense effects are required for different network attack types. Therefore, by setting the corresponding threshold according to the network attack simulation system and the corresponding network attack type, the network defense method data set can be better analyzed to obtain more accurate analysis results;

[0086] like Figure 2 As shown, for step S2, the process of acquiring the new defense method data set includes:

[0087] Obtain the abnormal network defense method data set, and obtain the corresponding defense capability of the corresponding network defense method, compare the defense capability with the corresponding initial defense result, and obtain the defense capability comparison value, which is recorded as

[0088] Set the threshold range for obtaining the defense capability comparison value, denoted as [F 1 , F 2 ] and compare it with the defensive capability comparison value:

[0089] If F∈[F 1 , F 2 ], the corresponding network defense method will be modified to obtain the updated defense method;

[0090] If F <F 1 , then the corresponding network defense method will be added with defense functions to obtain updated defense methods;

[0091] If F>F 2, no processing is done;

[0092] Update the abnormal network defense method dataset according to the updated defense method to generate a new defense method dataset;

[0093] In one embodiment, it should be further explained that the preliminary defense result is affected by the defense capability corresponding to the network defense method, so the defense capability corresponding to the network defense method corresponding to the abnormal network defense method data set is compared with the corresponding preliminary defense result to better determine which network defense methods need to be changed to add defense functions; improve the defense capability;

[0094] like Figure 2 As shown, for step S3, the process of obtaining the correction report includes:

[0095] Obtain the network attack simulation system and the corresponding network attack type corresponding to the abnormal network defense method data set, and then perform a cyclic attack and defense simulation on the network attack type according to the new defense method data set to obtain the preliminary defense result, and record it as the latest defense result;

[0096] If the new defense method dataset is determined to be an abnormal network defense method dataset based on the latest defense result, the loop simulation is continued until a normal network defense method dataset is obtained and marked as the latest defense method dataset, thereby obtaining the number of loops;

[0097] Obtain the correction report corresponding to the network attack simulation system based on the normal network defense mode data set;

[0098] The correction report includes the system code, type code, number of cycles, preliminary defense results corresponding to the number of cycles, and the latest defense results;

[0099] like Figure 2 As shown, for step S4: the process of obtaining the optimal defense mode data set includes:

[0100] Set the evaluation cycle corresponding to the network attack simulation system according to the number of cycles in the correction report, and then perform periodic attack and defense simulation on the network attack simulation system according to the correction report to obtain the optimal defense method data set;

[0101] The features and exemplary embodiments of various aspects of the present application are described in detail above. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail in combination with the drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application rather than to limit the present application. For those skilled in the art, the present application can be implemented without some of these specific details. The above description of the embodiments is merely to provide a better understanding of the present application by showing examples of the present application.

[0102] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A network security assessment method based on attack and defense drills, characterized in that: The method comprises the following steps: Step S1: Obtain the network attack type, build an attack team system, obtain the network defense method corresponding to the network attack type, and obtain the defense capability, build a defense team system, set the target network information system and simulation channel, and build a network attack and defense exercise model according to the simulation channel; Step S2: Based on the network attack and defense drill model, perform attack and defense simulation on the network attack type, obtain the corresponding initial defense result, analyze the initial defense result, obtain an abnormal network defense method data set, analyze the abnormal network defense method data set, and obtain a new defense method data set; Step S3: Perform cyclic attack simulation on the attack type according to the new defense method data set, obtain the latest defense results, analyze and evaluate the latest defense results, and obtain a correction report; Step S4: Obtain an evaluation period according to the correction report, and obtain an optimal defense method data set according to the evaluation period.

2. A network security assessment method based on attack and defense drills according to claim 1, characterized in that: The construction process of the attack team system includes: Based on the Internet, several information systems are obtained, and non-repetitive system codes are performed on the information systems, and the system codes are recorded as [system X], where X = {1, 2, ..., i}, and i is a positive integer; then, an information network architecture corresponding to the information system is obtained, and the attack type corresponding to the information system is obtained according to the information network architecture, and the attack type is integrated to obtain the network attack type, and the network attack type is non-repetitively encoded, and the type code is recorded as [type L], where L = {1, 2, ..., n}, and n is a positive integer; Obtain the multi-source risk value corresponding to the information system according to the network attack type, make a risk prediction for the network attack type according to the multi-source risk value, and obtain the network attack risk value; The calculation formula of the network attack risk value is: Among them, η [类型L] Expressed as [ Type L ] The corresponding network attack risk value; w represents the system X ] The number of multi-source risk values ​​obtained, where w is a positive integer; a Xw Expressed as [ System X ] Get the corresponding multi-source risk value; L Expressed as [ Type L ] The corresponding risk weights; Arrange the network attack risk values ​​in order from large to small and connect them according to the order of arrangement, and connect the network attack risk values ​​with the corresponding network risk types to generate an attack team system.

3. A network security assessment method based on attack and defense drills according to claim 2, characterized in that: The construction process of the defense team system includes: According to the network attack type, the corresponding network defense method is obtained, the network defense method is numbered, and the defense capability corresponding to the network defense method is obtained, which is recorded as Where m is a number, which is a positive integer, and is a natural number greater than 0; The network defense methods corresponding to the same network attack type are merged to generate a corresponding network defense method data set; then the network defense method data set is connected with the corresponding network attack type to generate a defense team system.

4. A network security assessment method based on attack and defense drills according to claim 3, characterized in that: The construction process of the network attack and defense exercise model includes: Wirelessly connect the target network information system to the information system, and set a system code input port in the target network information system to obtain the information system corresponding to the system code; send the corresponding information system to the target network information system, and then obtain the network attack simulation system; The attack team system, target network information system and defense team system are systematically connected through the simulation channel to build a network attack and defense drill model.

5. A network security assessment method based on attack and defense drills according to claim 4, characterized in that: The process of obtaining the initial defense result includes: Store the system code corresponding to the information system to generate a system code database, and start sending from the first system code in the information system database to the system code input port of the target network system according to the arrangement order of the system codes, obtain the corresponding information system and send it to the target network information system to generate a network attack simulation system for attack simulation; According to the sorting order of the network attack risk values in the attack team system, send the corresponding network risk types to the target network information system for attack simulation through the simulation channel in turn. At the same time, schedule the network defense method data sets corresponding to the network risk types in the defense team system in turn, and transmit them to the target network information system through the simulation channel for defense simulation. Then, obtain the initial defense results corresponding to the network defense method data sets in turn, and complete the preliminary attack and defense simulation of a network attack simulation system; At the same time, send the next system code in the system code database, obtain the network attack simulation system and complete the preliminary attack and defense simulation. By analogy, complete the preliminary attack and defense simulation of all the corresponding network attack simulation systems in the system code database; The formula for obtaining the preliminary defense result is: in, Represented as the initial defense result; φ [类型L] It is represented by the weight corresponding to the network attack risk value of the network attack type through the simulation channel; μ1, μ2, ..., μ m It is represented by the weight corresponding to the defense capability through the simulation channel, and its value is a natural number greater than 0.

6. A network security assessment method based on attack and defense drills according to claim 5, characterized in that: The process of obtaining the abnormal network defense method data set includes: According to the network attack simulation system and the corresponding network attack type, the corresponding preliminary defense result threshold is set, which is recorded as The value is a natural number greater than or equal to 0; and compared with the preliminary defense results, the abnormal network defense method data set is obtained: like The corresponding network defense method dataset is marked as an abnormal network defense method dataset; otherwise, it is marked as a normal network defense method dataset.

7. A network security assessment method based on attack and defense drills according to claim 6, characterized in that: The process of obtaining the new defense method data set includes; Obtain the network defense method corresponding to the abnormal network defense method data set, and obtain the defense capability corresponding to the network defense method, compare the defense capability with the corresponding initial defense result, and obtain the defense capability comparison value, which is recorded as Set the threshold range for obtaining the defense capability comparison value, denoted as [ F1, F 2] , and compare it with the defensive capability comparison value: If F∈ [ F1, F 2] , then the corresponding network defense method will be modified to obtain the updated defense method; If F < F1, add defense functions to the corresponding network defense method to obtain an updated defense method; If F > F2, do nothing; Update the abnormal network defense method data set according to the updated defense method to generate a new defense method data set.

8. A network security assessment method based on attack and defense drills according to claim 7, characterized in that: The process of obtaining the correction report includes: Perform cyclic attack and defense simulation on the network attack simulation system and the corresponding network attack type corresponding to the abnormal network defense method data set according to the new defense method data set, obtain the preliminary defense result, and record it as the latest defense result; If it is determined according to the latest defense result that the new defense method data set is an abnormal network defense method data set, continue the cyclic simulation until a normal network defense method data set is obtained, mark it as the latest defense method data set, and then obtain the number of cycles; otherwise, stop the cyclic simulation; Obtain the correction report corresponding to the network attack simulation system according to the normal network defense method data set; The correction report includes the system code, type code, number of cycles, the preliminary defense result corresponding to the number of cycles, and the latest defense result.

9. A network security assessment method based on attack and defense drills according to claim 8, characterized in that: The process of obtaining the optimal defense method data set includes: Set the evaluation period corresponding to the network attack simulation system according to the number of cycles in the correction report, and then perform periodic attack and defense simulation on the network attack simulation system according to the correction report to obtain the optimal defense method data set.

Images