Network security competition aided training model construction method and device and drilling system

Abstract

The invention discloses a network security competition auxiliary training model construction method and device and a drilling system, and the construction method comprises the steps: obtaining original data from a network security database and a historical attack and defense database, carrying out the preprocessing of the original data, and obtaining a label sample training set, the samples comprising positive samples and negative samples; performing secondary classification on the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; and training the model by using at least one group of subclass positive samples and subclass negative samples to obtain system vulnerability information of the two parties, and giving attack behaviors, defense behaviors and vulnerability grade scores for the system vulnerability information by using the trained auxiliary training model. By training the auxiliary training model, attack suggestions, automatic attacks, active defense, vulnerability scores and the like can be given according to system vulnerabilities of the opposite side or the own side, advanced network threats and strategy optimization can be simulated, and personalized training can be carried out for individuals, so that the actual combat level and the adaptive capacity of network security protection are greatly improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically to a method, device and training system for constructing a network security competition auxiliary training model. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly prominent. In order to make the network security attack and defense range closer to the real attack and defense scenario, and to more efficiently select and train attack and defense talents, the AWD competition system is used in the attack and defense training of security teams and important national network security competitions. The traditional method may be more focused on technical depth and suitable for in-depth exploration of specific skills, but it may lack comprehensive consideration of comprehensive capabilities, adaptability and teamwork. In contrast, although the AWD model has higher requirements in terms of resources and organization, it can more comprehensively train and evaluate the actual combat capabilities of the contestants and is closer to the actual needs of network security work.

[0003] The shortcomings of the prior art mainly include the following aspects: Lack of dynamism and challenge: Attack and defense exercises without AI participation may be relatively static, making it difficult to simulate the ever-changing strategies and techniques of attackers in the real world, reducing the practicality and challenge of training and competition. Due to the lack of AI-driven adaptive opponents, participating teams face relatively static and predictable threat models, which limits their ability to develop flexible and changeable strategies in real cyber warfare. Therefore, it is difficult for participants to hone their skills in high-intensity, high-interaction real confrontations, reducing the chances of discovering and fixing system security vulnerabilities, and affecting the understanding and prevention of modern attack methods such as advanced persistent threats (APTs). In addition, fixed challenge modes may also inhibit the development of innovative strategies and technologies, making competition education out of touch with actual combat, and reducing the overall skill improvement effect and contribution to industry progress.

[0004] Lack of adaptability: It is difficult for both the attacker and the defender to simulate the dynamically changing threats and defense requirements in a real network environment. Attack strategies are easy to predict, but defense measures may be rigid and insufficient to cope with complex and changing attack methods. This not only weakens the participants' ability to exercise in strategy planning, immediate response, and technological innovation, but may also lead to insufficient awareness of the latest security threats. In addition, the fixed attack and defense model limits the comprehensive evaluation of the comprehensive capabilities of the contestants and affects the efficiency of discovering and cultivating top security talents. Therefore, the lack of adaptability will limit the fairness, challenge, and practicality of the competition, and is not conducive to the innovation and optimization of the network security defense system.

[0005] Lack of simulation of complex cybersecurity challenges: limits its value as a practical exercise platform. This not only limits the participants' preparation for real-world challenges such as advanced persistent threats and zero-day attacks, but may also lead to the neglect of strategic depth, technological innovation and emergency response capabilities. The lack of complex scenario simulation makes the competition more like a shallow application of theoretical knowledge rather than a deep contest of skills and wisdom. In addition, it affects the real test of the resilience of the defense system and the flexibility of security strategies, and it is difficult to fully evaluate the effectiveness of defense solutions. Therefore, such a competition environment is not conducive to the cultivation of high-level professionals who can cope with future security threats, nor can it provide strong support for the iterative upgrade of network security protection strategies. Summary of the invention

[0006] In this embodiment, a method, system, electronic device and storage medium for constructing a network security competition auxiliary training model are provided to solve the problems in the related art of lack of dynamics and challenges, lack of adaptability and lack of simulation of complex network security challenges in simulated network security confrontation or competition.

[0007] In a first aspect, an embodiment of the present invention provides a method for constructing a network security competition-assisted training model, the method comprising: Obtaining raw data from a network security database and a historical attack and defense database, and preprocessing the raw data to obtain a labeled sample training set, wherein the samples include positive samples and negative samples; Performing secondary classification on the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; The model is trained using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules configured in the attack module of the model, and the subclass negative samples are used to train the corresponding submodels configured in the defense module of the model; Find the best parameter combination through the hyperparameter tuning algorithm, train and optimize the model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; The vulnerability information of both systems is obtained, and the trained auxiliary training model is used to give attack behavior, defense behavior and vulnerability level scores according to the system vulnerability information.

[0008] Optionally, raw data is obtained from a network security database and a historical attack and defense database, and the raw data is preprocessed to obtain a labeled sample training set, including: Obtaining raw data, including vulnerability sets, attack vectors, internal logs, service configurations, traffic monitoring, vulnerability data, historical cases, and defense strategies; Performing data cleaning on the raw data to obtain processed samples; The processed samples are classified and labeled to obtain positive samples and negative samples.

[0009] Optionally, the positive samples and the negative samples are classified twice to obtain at least one group of subclass positive samples and subclass negative samples, including: Obtain the sub-model information configured in the model attack module, model defense module, and scoring module, as well as the required training sample data; Secondarily classify the positive samples and negative samples according to the sub-model information and the required sample data to obtain at least one group of sub-class positive samples and sub-class negative samples; The sub-model configured by the model attack module, the scoring module and the model defense module is trained using the sub-class positive samples and the sub-class negative samples.

[0010] Optionally, the sub-models configured in the attack module include generative adversarial networks, classification models, reinforcement learning models and sequence models; the sub-models configured in the defense module include intrusion detection and prevention system models, deep learning models, rule engines combined with machine learning models and graph neural networks.

[0011] Optionally, obtaining vulnerability information of both systems and using the trained auxiliary training model to provide attack behaviors for the system vulnerability information include: Obtain vulnerability information and the level score of each vulnerability, and conduct in-depth analysis of each vulnerability to extract key features; Use the trained generative adversarial network to generate attack vectors based on the key features of the input vulnerability; The generated attack vector is used to generate attack behavior through a penetration testing tool.

[0012] Optionally, obtaining system vulnerability information of both parties, and using the trained auxiliary training model to provide a defensive behavior for the system vulnerability information, including: Obtain vulnerability information and a rating score for each vulnerability; Update the signature library and rule set of the intrusion detection and prevention system model based on the latest vulnerability information, and perform defense based on the vulnerability information.

[0013] Optionally, obtaining vulnerability information of both systems and using the trained auxiliary training model to give a vulnerability level score for the system vulnerability information includes: Use vulnerability scanning tools to obtain system vulnerabilities of the adversary, analyze the vulnerabilities, obtain the influencing factors of each vulnerability, and set basic weights for each of the influencing factors of each vulnerability; The importance index score of the vulnerability is obtained according to the calculation formula of each basic weight; The vulnerabilities are ranked according to their importance levels based on the importance index scores.

[0014] Compared with the prior art, the method for constructing a network security competition auxiliary training model of the present invention has the following beneficial effects: By training the attack module and defense module of the auxiliary training model, the model can learn relevant knowledge about network security and competition attack and defense, and give attack suggestions, automatic attacks, active defenses, and vulnerability scores based on the vulnerabilities of the opponent's or one's own system. By building an auxiliary training model, advanced network threats and strategy optimization can be simulated and personalized training can be performed for individuals. The auxiliary training model uses deep learning of past attack cases on the attack side to dynamically generate high-fidelity advanced threat scenarios according to training needs, testing the defender's immediate response and strategy deployment capabilities; the auxiliary training model analyzes competition data in real time on the defense side, provides instant feedback to participants, accurately identifies defense vulnerabilities, optimizes defense strategies, and realizes strategy customization. This personalized intensive training allows defenders to grow rapidly in an environment close to actual combat, learn to predict and effectively resist various types of network attacks that may be encountered in the future, thereby greatly improving the actual level and adaptability of network security protection.

[0015] In a second aspect, an embodiment of the present invention provides a network security competition auxiliary training model construction device, comprising: A preprocessing module, used to obtain raw data from a network security database and a historical attack and defense database, and preprocess the raw data to obtain a labeled sample training set, wherein the samples include positive samples and negative samples; A secondary classification module, used for secondary classification of the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; A group training module, used to train the model using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules configured in the attack module of the model, and the subclass negative samples are used to train the corresponding submodels configured in the defense module of the model; The hyperparameter tuning module is used to find the best parameter combination through the hyperparameter tuning algorithm, train the optimization model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; The application module is used to obtain the system vulnerability information of both parties, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level score for the system vulnerability information.

[0016] In a third aspect, an embodiment of the present invention provides a network security competition drill system, including an auxiliary training model constructed by the network security competition auxiliary training model construction method described in the first aspect.

[0017] In a fourth aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a communication interface, a memory and a bus, wherein the processor, the communication interface and the memory communicate with each other through the bus, and the processor can call logic instructions in the memory to execute the steps of the method provided in the first aspect.

[0018] In a fifth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for constructing a network security competition assisted training model as described in the first aspect.

[0019] Compared with the prior art, the beneficial effects of the network security competition auxiliary training model construction device, drill system, electronic device and storage medium of the present invention are the same as the network security competition auxiliary training model construction method described in the first aspect, so they will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0021] Figure 1 Schematic diagram of the auxiliary training model in an embodiment of the present invention; Figure 2 Flow chart of a method for constructing a network security competition auxiliary training model in an embodiment of the present invention; Figure 3 It is a structural block diagram of a device for constructing a network security competition auxiliary training model in an embodiment of the present invention; Figure 4 1 is a structural block diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to more clearly understand the purpose, technical solutions and advantages of the present application, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0023] Unless otherwise defined, the technical terms or scientific terms involved in this application shall have the general meaning understood by people with general skills in the technical field to which this application belongs. The words "one", "a", "the", "these" and the like in this application do not indicate a quantitative limitation, and they may be singular or plural. The terms "include", "comprise", "have" and any variants thereof involved in this application are intended to cover non-exclusive inclusions; for example, a process, method and system, product or device comprising a series of steps or modules (units) is not limited to the listed steps or modules (units), but may include unlisted steps or modules (units), or may include other steps or modules (units) inherent to these processes, methods, products or devices. The words "connect", "connected", "coupled" and the like involved in this application are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" may mean: A exists alone, A and B exist at the same time, and B exists alone. Generally, the character " / " indicates that the objects associated with each other are in an "or" relationship. The terms "first", "second", "third", etc. in this application are only used to distinguish similar objects and do not represent a specific ordering of the objects.

[0024] In an embodiment of the present invention, a method for constructing a network security competition auxiliary training model is provided. Figure 2 is a flow chart of the method for constructing a network security competition auxiliary training model of the present invention. Figure 1 and Figure 2 As shown, the process includes the following steps: S100, obtaining raw data from a network security database and a historical attack and defense database, and preprocessing the raw data to obtain a labeled sample training set, where the samples include positive samples and negative samples; The original data is the data required for training the model. It should be noted that the data type is described in detail below in the training process of each sub-model in the attack module and the defense module.

[0025] Specifically, in this embodiment, raw data is obtained from a network security database and a historical attack and defense database, and the raw data is preprocessed to obtain a labeled sample training set, including: Obtain raw data, including vulnerability sets, attack vectors, internal logs, service configurations, traffic monitoring, vulnerability data, historical cases, and defense strategies; Perform data cleaning on the original data to obtain processed samples; data cleaning removes invalid and erroneous data.

[0026] The processed samples are classified and labeled to obtain positive samples and negative samples.

[0027] The samples are classified and labeled so that the machine learning model can learn. It should be noted that in this embodiment, the positive samples are real attack behavior data from the original data, and the negative samples are normal network activity data. The specific training process will be described later.

[0028] S200, performing secondary classification on the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; Specifically, the positive samples and negative samples are classified twice to obtain at least one group of sub-class positive samples and sub-class negative samples, including: Obtain the sub-model information configured in the model attack module, model defense module, and scoring module, as well as the required training sample data; According to the sub-model information and the required sample data, the positive samples and the negative samples are secondary classified to obtain at least one group of sub-class positive samples and sub-class negative samples; The sub-models configured by the model attack module, scoring module and model defense module are trained using sub-class positive samples and sub-class negative samples.

[0029] S300, using at least one group of subclass positive samples and subclass negative samples to train the model, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules of the attack module configuration of the model, and the subclass negative samples are used to train the corresponding submodels of the defense module configuration of the model; It should be noted that, in this embodiment, since the attack module and the defense module are configured with multiple sub-models, a modular architecture design is adopted. Each sub-model is an independent module, and the advantages of multiple sub-models can be combined through advanced fusion technologies such as stacked generalization and weighted voting, so that the overall performance of the trained model is stronger.

[0030] In this embodiment, the attack module is configured with multiple models, and the sub-models configured by the attack module include a generative adversarial network, a classification model, a reinforcement learning model, and a sequence model.

[0031] Exemplarily, a generative adversarial network (GANs) includes a generator and a discriminator, wherein the generator is used to create data that simulates a real attack, and the discriminator is used to distinguish between true and false data. Adversarial training is performed, that is, the generator and the discriminator are trained alternately, the generator tries to deceive the discriminator so that it cannot correctly distinguish between the generated data and the real data; while the discriminator strives to improve its discrimination ability. When the data generated by the generator can be mistaken for real data with a sufficiently high probability, the training process can be stopped. It should be noted that for the training of GANs, real attack samples (subclass positive samples) are used as learning materials for the discriminator, and initial noise or randomly generated data are used as input for the generator.

[0032] The training process of the classification model includes: collecting and annotating a large amount of network traffic data, which contains normal traffic (negative samples) and known attack patterns (positive samples). Each sample includes a feature vector and a corresponding label. Select a classification algorithm such as SVM, random forest, or GBDT, and set the initial parameters based on prior knowledge or hyperparameter tuning, and divide the preprocessed data set into a training set and a validation set. Use the training set to train the model and adjust the model parameters by minimizing the loss function. Evaluation and optimization: Evaluate the model performance on the validation set and use cross-validation to avoid overfitting. Adjust the hyperparameters or model structure based on the evaluation results until satisfactory performance indicators are achieved.

[0033] The classification model training samples include positive samples and negative samples, where the positive samples are real attack behavior data from historical records and the negative samples are normal network activity data.

[0034] The training process of the sequence model includes: obtaining training samples, which are time series data, such as continuous network requests or system log entries, marked as normal or attack behavior. Extracting features from the time series data to form a time step sequence suitable for the RNN input format, using the back propagation through time (BPTT) algorithm to update the weights, predict future attack behaviors, and adjusting the model parameters through multiple iterations to ensure prediction accuracy.

[0035] The training process of the reinforcement learning model includes: obtaining training samples, which are interactive experiences in a simulated environment, that is, a series of state, action, and reward triplets. Specifically, a simulated environment is set, and the state space, action space, and reward mechanism are defined. The agent performs actions in the environment, obtains rewards or penalties based on environmental feedback, and then updates the strategy. As the number of training increases, the agent gradually learns more effective attack strategies.

[0036] In this embodiment, the sub-models configured in the defense module include an intrusion detection and prevention system model, a deep learning model, a rule engine combined with a machine learning model, and a graph neural network.

[0037] The training process of the intrusion detection and prevention system model (IDS model) includes: obtaining training samples, which are labeled network traffic data, including normal traffic and various types of attack traffic. Specifically, extracting features from the raw data, which can effectively distinguish normal behavior from attack behavior. For supervised IDS, labeled data is used for training; for unsupervised IDS, it may only rely on unlabeled data. Determine the alarm threshold so that an alarm is triggered when an anomaly is detected.

[0038] The training process of deep learning models includes: obtaining training samples, training sample network traffic data, and usually requiring a large number of samples to capture different types of threats. Specifically, network packets are converted into a form suitable for deep learning model input, such as graphical representation or feature matrix, and the weights of the neural network are adjusted using the back propagation algorithm so that the output is as close to the target value as possible.

[0039] The training process of the rule engine combined with the machine learning model includes: obtaining training samples, which include log entries that match the rules and abnormal events that do not match the rules but are manually confirmed. Specifically, establishing a rule base based on domain expert knowledge. Using the machine learning model to identify new threats that are not covered by the rules. Combining the results of the rule engine and the machine learning model to make the final judgment.

[0040] The training process of graph neural networks includes: obtaining training samples, which are data describing the network structure and its dynamic changes, as well as associated security event records. Creating a graph representing the network topology, where nodes represent hosts or services and edges represent connection relationships. Passing information on the network graph so that features are shared between adjacent nodes. Updating the embedding representation of the current node based on the information of neighboring nodes to better understand the global context.

[0041] S400, find the best parameter combination through the hyperparameter tuning algorithm, train the optimization model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; In this embodiment, AutoML tools such as Hyperopt and Optuna can be introduced to find hyperparameter combinations more quickly and easily integrated into existing workflows.

[0042] ; Where N is the number of samples, is the true label of the ith sample (0 or 1), is the probability that the model predicts that the i-th sample is a positive class.

[0043] As an alternative, use grid search to optimize the model, setting a total of four parameters max_depth (maximum depth of the tree), min_child_weight (minimum weight of leaf nodes), n_estimators (number of trees) and learning_rate (learning rate). The parameters are set to max_depth: [3, 5, 7], min_child_weight: [1, 3, 6], n_estimators: [100, 200, 300], and learning_rate: [0.01, 0.05, 0.1] respectively.

[0044] S500: Obtain vulnerability information of both systems, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level scores based on the system vulnerability information.

[0045] It should be noted that, in this embodiment, vulnerability scanning tools such as Nmap are used for network scanning, OpenVAS and Nessus are used for vulnerability scanning, and open ports and service version information are obtained, and search engines such as Shodan and Censys are used to find devices and services exposed to the external network. It should be further noted that the vulnerability can also be based on the vulnerability theme given by the competition, as well as the vulnerability information of the network security database and the historical attack and defense database.

[0046] Specifically, the vulnerability information of both systems is obtained, and the trained auxiliary training model is used to give a vulnerability level score for the system vulnerability information, including: Use vulnerability scanning tools to obtain the adversary's system vulnerabilities , analyze the vulnerabilities and obtain each vulnerability Factors affecting each vulnerability Set basic weights for each influencing factor; Specifically, according to the rules of the network security competition, the vulnerability influencing factors are pre-set. In this embodiment, the vulnerability influencing factors include the required permission PR, the attack vector AV, the attack complexity AC, the impact range S and the attack feasibility A. A basic weight is assigned to each influencing factor, where the weight of the required permission PR is , the weight of the attack vector AV is , the weight of attack complexity AC is , the weight of the influence range S is , the weight of attack feasibility A is It should be noted that the sum of the weights is 1, that is, .

[0047] The importance index score of the vulnerability is obtained according to the calculation formula of each basic weight; For each vulnerability The importance index scores are weighted and the formula is as follows: ; in, It's a loophole The rating of the permissions required, It's a loophole Scoring of attack vectors; It's a loophole Attack complexity rating; It's a loophole Scoring of impact area; It's a loophole A score for the feasibility of the attack; Based on importance index score Rank the vulnerabilities by importance.

[0048] In this embodiment, the importance index score of each vulnerability is The importance of the vulnerabilities is ranked from high to low for reference by contestants during simulation training.

[0049] Furthermore, the vulnerability information of both systems is obtained, and the trained auxiliary training model is used to give attack behaviors based on the system vulnerability information, including: Obtain vulnerability information and the level score of each vulnerability, and conduct in-depth analysis of each vulnerability to extract key features; Perform in-depth analysis on each vulnerability to extract its key features, such as the affected service or application version, exploitation method, required permissions, etc.

[0050] Use trained generative adversarial networks (GANs) to generate attack vectors based on the key features of the input vulnerability; Specifically, a trained classification model or generative adversarial network (GANs) is used to generate possible attack vectors based on the input vulnerability features. For example, if the vulnerability involves SQL injection, the corresponding SQL injection statement is generated; if it is a buffer overflow, a malicious data packet is constructed. For certain specific types of vulnerabilities, a set of rule sets can be pre-defined to guide how to construct effective attack payloads. The rule sets can be established based on historical data and expert knowledge.

[0051] Furthermore, for the formulation of attack strategies, graph neural networks (GNNs) are used to simulate and predict the most likely successful attack routes, which can consider factors such as the configuration of the target system and the network topology to determine the most suitable attack path. Reinforcement learning can optimize these decision-making processes and find the best strategy through continuous attempts.

[0052] The generated attack vector is used to generate attack behavior through penetration testing tools.

[0053] Specifically, the generated attack vectors are integrated into existing penetration testing tools, such as Metasploit and Nessus, to automate the attack process. Attack parameters are adjusted based on real-time feedback to maximize the attack effect while reducing the risk of being detected. For example, if a certain attack method is found to trigger an intrusion detection system (IDS), it is immediately switched to another low-noise method.

[0054] Obtain system vulnerability information of both parties, and use the trained auxiliary training model to provide defensive actions based on the system vulnerability information, including: Get vulnerability information and the rating of each vulnerability; When conducting defense training, vulnerability information and vulnerability level scores can also be obtained.

[0055] Update the signature library and rule set of the intrusion detection and prevention system model based on the latest vulnerability information, and perform defense based on the vulnerability information.

[0056] For example, based on the latest vulnerability information, the IDS model will update its internal attack feature signature library and rule set. For example, if a new SQL injection vulnerability is discovered, the IDS will add the attack pattern corresponding to the vulnerability to its detection rules so that it can identify and warn of such attacks. IDS continuously monitors network traffic and uses machine learning algorithms to analyze whether data packets conform to known attack patterns or abnormal behaviors. Once an activity that may exploit a specific vulnerability is detected, it triggers an alarm and records a detailed event log.

[0057] Deep learning models can automatically extract features from large amounts of historical data and learn the difference between normal and malicious traffic. When new vulnerabilities emerge, they can quickly adapt to new threat situations through transfer learning or fine-tuning pre-trained models. Deep learning models can be used to predict possible future attacks and deploy defensive measures in advance. For example, the model can predict which types of attacks are more likely to occur based on changes in the current network environment and strengthen protection accordingly. The rule engine inspects traffic based on preset security policies, while the machine learning part is responsible for identifying new types of threats that are not covered by existing rules. The combination of the two can provide more comprehensive protection. As more information about vulnerabilities is obtained, the rule engine can dynamically adjust its rule set, and the machine learning model can be retrained to improve accuracy. Graph neural networks are good at processing complex relational data, such as network topology graphs. It can help understand the nodes (hosts, services, etc.) in the entire network architecture and how they are connected, so as to better assess the potential impact of a vulnerability in the entire system. Based on the understanding of the network structure, GNN can simulate the best path that attackers may take and recommend the best location to deploy additional security control points, such as firewall rules, intranet isolation, etc., to prevent attackers from exploiting vulnerabilities to penetrate the network deeply.

[0058] The embodiment of the present invention also provides a network security competition auxiliary training model construction device, which is used to implement the above method embodiment, which has been described and will not be repeated. The terms "module", "unit", "subunit", etc. used below can implement a combination of software and / or hardware for predetermined functions. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware or a combination of software and hardware is also possible and conceivable.

[0059] like Figure 3 As shown, Figure 3 The present invention is a structural block diagram of a network security competition auxiliary training model construction device, which includes: A preprocessing module 101 is used to obtain raw data from a network security database and a historical attack and defense database, and preprocess the raw data to obtain a labeled sample training set, where the samples include positive samples and negative samples; A secondary classification module 102 is used for secondary classification of positive samples and negative samples to obtain at least one group of sub-class positive samples and sub-class negative samples; A group training module 103 is used to train the model using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules configured in the attack module of the model, and the subclass negative samples are used to train the corresponding submodels configured in the defense module of the model; A hyperparameter tuning module 104 is used to find the best parameter combination through a hyperparameter tuning algorithm, train the optimization model through a cross entropy loss function, and use the model after training iteration as an auxiliary training model; The drill module 105 is used to obtain the system vulnerability information of both parties, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level score according to the system vulnerability information.

[0060] An embodiment of the present invention further provides a network security competition training system, comprising an auxiliary training model constructed by the network security competition auxiliary training model construction method of the first aspect.

[0061] In this embodiment, the auxiliary training models are respectively configured on the attack end and the defense end. The attack end uses the auxiliary training model to simulate threats, and the defense end uses the auxiliary training model to adjust the defense strategy according to the simulated threats.

[0062] Specifically, the trained auxiliary training model is deployed to the competition environment. It should be noted that it is necessary to ensure that the auxiliary training model can receive and analyze network data in real time, and configure the necessary hardware and software resources to ensure the operating efficiency and stability of the auxiliary training model.

[0063] In the network security competition and exercise system of this embodiment, the auxiliary training model is configured on the attack end and the defense end respectively. The attack end uses the auxiliary training model to simulate threats including: Identify the target system and obtain the basic data of the target system, including network structure, system configuration and security vulnerabilities; the auxiliary training model will use big data analysis, machine learning and other technologies to intelligently identify the target system, analyze its network structure, system configuration, security vulnerabilities and other information, and provide basic data for subsequent attacks.

[0064] Based on the basic data of the target system, the auxiliary training model automatically adjusts the attack parameters and simulates advanced attack sequences. For example, based on the defense capabilities and reaction speed of the target system, the auxiliary training model dynamically adjusts the attack intensity to avoid exposing itself too early or triggering the alarm of the defense system. For example, low-intensity scanning is used in the detection phase to avoid triggering the alarm of the IDS (intrusion detection system), and the attack intensity is gradually increased in the attack phase to quickly break through the defense.

[0065] The auxiliary training model will also intelligently select the optimal attack path based on the network topology, firewall rules and other information of the target system to bypass the monitoring and interception of the defense system; It should be noted that initial intelligence collection will be conducted before simulating advanced attack sequences: the auxiliary training model will collect intelligence, including scanning the target system's IP address, domain name, open ports and other information, in preparation for subsequent attacks. After the preparation is completed, it can simulate complex attack sequences including social engineering attacks and zero-day vulnerability exploits to challenge the defense system of the participating teams.

[0066] Furthermore, the attack side uses the auxiliary training model to simulate threats including: Based on the obtained security vulnerability information, obtain low permissions of the target system by exploiting the vulnerability; By obtaining security vulnerability information during the scanning process, the auxiliary training model will try to exploit the vulnerability, such as obtaining database permissions through SQL injection, uploading malicious files through file inclusion vulnerabilities, etc.

[0067] Perform privilege escalation operations based on the low privileges of the target system to obtain high privileges of the target system; When the low permissions of the target system are successfully obtained, the auxiliary training model will try to escalate permissions to obtain higher permissions of the target system.

[0068] After obtaining high permissions of the target system, the internal network of the target system is controlled through intranet penetration.

[0069] After obtaining system permissions, the auxiliary training model will attempt to penetrate the internal network and further control the internal network of the target system through lateral movement, password cracking, etc. Furthermore, in order to maintain continuous control over the target system, the auxiliary training model will attempt to deploy malware such as backdoor programs and Trojans so that it can launch attacks at any time when needed.

[0070] The defense uses auxiliary training models to adjust defense strategies based on simulated threats, including: Obtain current attack and defense dynamics, including attack type, attack intensity, attack frequency, potential threats, and the behavior patterns and characteristics of the attacker; Provide current defense strategies through auxiliary training models based on current attack and defense dynamics.

[0071] Specifically, the auxiliary training model is used to monitor the offensive and defensive dynamics in the competition, analyze the actions of both sides, and provide immediate strategic suggestions to the defense, such as adjusting firewall rules, deploying honeypots, etc., to minimize losses and counterattack. In addition, the auxiliary training model set up on the defense side monitors the security status of its own system in real time, promptly detects and responds to potential security threats; according to the attacker's behavior patterns and characteristics, the defense strategy is dynamically adjusted, such as enhancing firewall rules, updating security patches, etc.

[0072] It also includes effect evaluation: the auxiliary training model evaluates the attack on the offensive side and the defense on the defensive side to obtain scores and losses.

[0073] Furthermore, during the competition, the auxiliary training model can analyze the strengths and weaknesses of each team, customize attack scenarios of different difficulty and types, and encourage participating teams to improve their own shortcomings in a targeted manner. At the same time, it also conducts actual combat simulation training by simulating the attack modes of their specific opponents.

[0074] Figure 4 A structural block diagram of an electronic device provided by an embodiment of the present invention, such as Figure 4 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630 and a communication bus 640, wherein the processor 610, the communication interface 620 and the memory 630 communicate with each other through the communication bus 640. The processor 610 may call the logic instructions in the memory 630 to execute the following method: Obtain raw data from the network security database and the historical attack and defense database, and pre-process the raw data to obtain a labeled sample training set, which includes positive samples and negative samples; Perform secondary classification on positive samples and negative samples to obtain at least one group of sub-class positive samples and sub-class negative samples; The model is trained using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules of the attack module configuration of the model, and the subclass negative samples are used to train the corresponding submodels of the defense module configuration of the model; Find the best parameter combination through the hyperparameter tuning algorithm, train and optimize the model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; Obtain the system vulnerability information of both parties, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level scores based on the system vulnerability information.

[0075] In addition, the logic instructions in the above-mentioned memory 630 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0076] An embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method provided in each of the above embodiments is implemented, for example, including: Obtain raw data from the network security database and the historical attack and defense database, and pre-process the raw data to obtain a labeled sample training set, which includes positive samples and negative samples; Perform secondary classification on positive samples and negative samples to obtain at least one group of sub-class positive samples and sub-class negative samples; The model is trained using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules of the attack module configuration of the model, and the subclass negative samples are used to train the corresponding submodels of the defense module configuration of the model; Find the best parameter combination through the hyperparameter tuning algorithm, train and optimize the model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; Obtain the system vulnerability information of both parties, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level scores based on the system vulnerability information.

[0077] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for constructing a network security competition-assisted training model, characterized in that: The construction method comprises: Obtaining raw data from a network security database and a historical attack and defense database, and preprocessing the raw data to obtain a labeled sample training set, wherein the samples include positive samples and negative samples; Performing secondary classification on the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; The model is trained using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules configured in the attack module of the model, and the subclass negative samples are used to train the corresponding submodels configured in the defense module of the model; Find the best parameter combination through the hyperparameter tuning algorithm, train and optimize the model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; The vulnerability information of both systems is obtained, and the trained auxiliary training model is used to give attack behavior, defense behavior and vulnerability level scores according to the system vulnerability information.

2. The method for constructing a network security competition auxiliary training model according to claim 1, characterized in that: The original data is obtained from the network security database and the historical attack and defense database, and the original data is preprocessed to obtain a labeled sample training set, including: Obtaining raw data, including vulnerability sets, attack vectors, internal logs, service configurations, traffic monitoring, vulnerability data, historical cases, and defense strategies; Performing data cleaning on the raw data to obtain processed samples; The processed samples are classified and labeled to obtain positive samples and negative samples.

3. The method for constructing a network security competition auxiliary training model according to claim 1, characterized in that: The positive samples and the negative samples are classified twice to obtain at least one group of subclass positive samples and subclass negative samples, including: Obtain the sub-model information configured in the model attack module, model defense module, and scoring module, as well as the required training sample data; Secondarily classify the positive samples and negative samples according to the sub-model information and the required sample data to obtain at least one group of sub-class positive samples and sub-class negative samples; The sub-model configured by the model attack module, the scoring module and the model defense module is trained using the sub-class positive samples and the sub-class negative samples.

4. The method for constructing a network security competition auxiliary training model according to claim 1, characterized in that: The sub-models configured in the attack module include generative adversarial networks, classification models, reinforcement learning models, and sequence models; the sub-models configured in the defense module include intrusion detection and prevention system models, deep learning models, rule engines combined with machine learning models, and graph neural networks.

5. The method for constructing a network security competition auxiliary training model according to claim 4, characterized in that: Obtain the vulnerability information of both systems, and use the trained auxiliary training model to give attack behaviors based on the system vulnerability information, including: Obtain vulnerability information and the level score of each vulnerability, and conduct in-depth analysis of each vulnerability to extract key features; Use the trained generative adversarial network to generate attack vectors based on the key features of the input vulnerability; The generated attack vector is used to generate attack behavior through a penetration testing tool.

6. The method for constructing a network security competition auxiliary training model according to claim 4, characterized in that: Obtain the vulnerability information of both systems, and use the trained auxiliary training model to provide defensive actions based on the system vulnerability information, including: Obtain vulnerability information and a rating score for each vulnerability; Update the signature library and rule set of the intrusion detection and prevention system model based on the latest vulnerability information, and perform defense based on the vulnerability information.

7. The method for constructing a network security competition auxiliary training model according to claim 1, characterized in that: Obtain vulnerability information of both systems, and use the trained auxiliary training model to give vulnerability level scores for the system vulnerability information, including: Use vulnerability scanning tools to obtain system vulnerabilities of the adversary, analyze the vulnerabilities, obtain the influencing factors of each vulnerability, and set basic weights for each of the influencing factors of each vulnerability; The importance index score of the vulnerability is obtained according to the calculation formula of each basic weight; The vulnerabilities are ranked according to their importance levels based on the importance index scores.

8. A network security competition auxiliary training model construction device, characterized in that: include: A preprocessing module, used to obtain raw data from a network security database and a historical attack and defense database, and preprocess the raw data to obtain a labeled sample training set, wherein the samples include positive samples and negative samples; A secondary classification module, used for secondary classification of the positive samples and the negative samples to obtain at least one group of subclass positive samples and subclass negative samples; A group training module, used to train the model using at least one group of subclass positive samples and subclass negative samples, wherein the subclass positive samples are used to train the corresponding submodels and scoring modules configured in the attack module of the model, and the subclass negative samples are used to train the corresponding submodels configured in the defense module of the model; The hyperparameter tuning module is used to find the best parameter combination through the hyperparameter tuning algorithm, train the optimization model through the cross entropy loss function, and use the model after training iteration as the auxiliary training model; The application module is used to obtain the system vulnerability information of both parties, and use the trained auxiliary training model to give attack behavior, defense behavior and vulnerability level score for the system vulnerability information.

9. A network security competition training system, characterized in that: An auxiliary training model constructed by the method for constructing an auxiliary training model for a network security competition as described in any one of claims 1 to 7.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the method for constructing a network security competition assisted training model as described in any one of claims 1 to 7.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for constructing a network security competition-assisted training model as described in any one of claims 1 to 7 are implemented.

Images