Design method of information security attack and defense range software system

Abstract

The invention discloses a design method of an information security attack and defense range software system, and belongs to the technical field of network security. The method comprises the following specific steps: 1, defining a structure of a JSON format file; 2, compiling a parser, reading the configuration in the JSON format file through the parser, and converting the configuration into a task which can be actually executed; 3, creating a required attack and defense scene virtual environment by using a virtualization technology; 4, applying the analyzed configuration to the virtual environment by using a configuration management tool to ensure that the same environment can be reproduced when a new attack and defense scene is started each time; 5, operating the service logic of the security subject corresponding to the attack and defense scene to ensure the integrity of the whole process; and 6, testing the running security subject business logic. According to the method, the virtualization of the security subject business logic is used, the static shooting range scene display is carried out, the real and complex network environment and software ecological environment do not need to be simulated, and the experimental environment of the security attack and defense drill can be realized.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a design method for an information security attack and defense range software system. Background Art

[0002] Cybersecurity is a key technology field that protects computer systems, networks, and data from unauthorized access, attacks, and destruction. With the increasing complexity of threats such as malware, phishing, DDoS attacks, and AI-assisted attacks, cybersecurity protection has become particularly important. In response to the dilemma of not being able to conduct attack and defense experiments directly in a real environment, information security attack and defense ranges have emerged as an effective tool for cybersecurity research, training, and verification.

[0003] Existing range systems usually simulate directly from the real environment of network security attack and defense. Although they can reproduce attack scenarios more accurately, they often face the problems of high simulation difficulty, high cost and complex deployment, which limits their promotion and application. To solve these problems, a new type of network range system should be built with the design idea of ​​virtualizing the real security environment, simplifying the consumption of actual computing resources in the attack and defense process. This system simulates network protocols and devices through lightweight software, reduces dependence on hardware resources, and improves deployment convenience. It is particularly suitable for widespread application in education and research fields.

[0004] This case proposes a simulation range design pattern based on JSON files to describe the attack and defense status. JSON is a lightweight data exchange format with good readability and scalability. Through JSON files, the range can flexibly define parameters such as attack type, target system, and expected response, avoiding tedious code modifications. Users can select attack subjects in the graphical interface and fill in missing code snippets for defense configuration. The system automatically verifies the input through the memory copy function and gives score feedback.

[0005] This design pattern has the advantages of simplified configuration, virtualized interaction, and repeatable drills. It can quickly adapt to new threats and provide an efficient and scalable platform for network security education and attack and defense research. Summary of the invention

[0006] In view of the above problems existing in the prior art, the object of the present invention is to provide a design method for an information security attack and defense range software system.

[0007] The present invention provides the following technical solution: a design method for an information security attack and defense range software system, including building a system that can parse JSON file configuration and dynamically create and manage a virtual environment according to the configuration. The specific design steps are as follows: S1. Define the structure of the JSON format file to describe a complete attack and defense scenario; S2. Write a parser to read the configuration in the JSON format file and convert it into actual executable tasks; S3. Use virtualization technology to create the required attack and defense scenario virtual environment; S4. Use the configuration management tool to apply the configuration parsed by the parser to the virtual environment to ensure that the same environment can be reproduced every time a new attack and defense scenario is launched; S5. Run the business logic of the security subjects corresponding to the attack and defense scenarios to ensure the integrity of the entire process; S6. Test the running security subject business logic.

[0008] Furthermore, the structure of the JSON format file includes scene metadata, host configuration, initial state, task list and scoring rules.

[0009] Furthermore, the parser is used to parse the JSON file and extract the required information, configure each virtual host, and set tasks and scoring rules.

[0010] Furthermore, when running the business logic of the security subject corresponding to the attack and defense scenario, security measures are adopted to ensure the security of the entire process. The specific security measures are as follows: Sandbox execution: restricts the execution permissions of user code to prevent potential malicious behavior; Resource isolation: Allocate independent computing resources to each scenario to avoid mutual interference; Log audit: Record all activities for later analysis and tracking.

[0011] Furthermore, the working process of the designed software system is as follows: Step 1. The user selects the JSON file corresponding to the safety exercise subject to be trained; Step 2: Import and parse the JSON file and generate a graphical user interface: The system automatically reads and parses the selected JSON file to extract relevant information about the training environment; parses the extracted information and dynamically generates a graphical user interface based on the parsed data; Step 3: Configure the attack and defense parameters of the security subject; Step 4: Simulate attacks and provide feedback: Based on the configured attack and defense parameters, run the business logic of the security subject, provide immediate or delayed feedback on the running results, and display the number of hits of the simulated attack; Step 5. Dynamic update and expansion: The system sets up permission management, authorizing users with corresponding permissions to modify existing JSON files or add new files to dynamically adapt to new and security-threatening subject transactions in the future; and adopts a corresponding version control system to manage different versions of JSON configuration files to ensure that each change can be traced.

[0012] Furthermore, in step 4, the specific process of immediate or delayed feedback is as follows: For attacks that do not require calculation, the results are displayed in a timely manner; for attacks that require calculation, the system calls the corresponding third-party library to perform calculations and displays the results after the calculations are completed.

[0013] By adopting the above technology, compared with the prior art, the beneficial effects of the present invention are as follows: The present invention uses the virtualization of the business logic of security subjects to perform static target range scenario presentation, and can realize the experimental environment of security attack and defense drills without simulating the real complex network environment and software ecological environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a schematic diagram of the method flow of the present invention. DETAILED DESCRIPTION

[0015] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments of the specification. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0016] On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims. Further, in order to make the public have a better understanding of the present invention, some specific details are described in detail in the detailed description of the present invention below. Those skilled in the art can fully understand the present invention without the description of these details.

[0017] Example: In order to simulate attack and defense scenarios in the shooting range in the form of JSON files, it is necessary to build a system that can parse the configurations in the JSON files and dynamically create and manage virtual environments based on these configurations. Figure 1 , here are the detailed steps and technical details on how to achieve this goal.

[0018] S1. JSON file structure definition First, define the JSON file structure to describe the information security training subject of the password hash attack and defense scenario in detail. The structure includes five parts: scenario metadata, host configuration, initial state, task list, and scoring rules.

[0019] Scenario metadata is used to provide basic information about the subject, such as scenario name, description, and version number. Host configuration describes the virtual environment resource configuration used for the experiment, including the operating system type, number of processors, and memory size. Initial state specifies the initial conditions of the experiment, including the selected hash algorithm, whether salting is enabled, and the plaintext value of the protected password.

[0020] The task list describes the subtasks that need to be completed. Each task includes the task name, task description, success criteria and corresponding score. The scoring rules stipulate the full score, overtime deduction criteria and partial scoring strategy.

[0021] This example uses the password hash attack and defense drill as an example: 1. The specific introduction of the password hash attack and defense drill example subject is as follows: 1. Course Overview Name Password: Hash Attack and Defense Drill; Description: This article simulates the generation and cracking process of password hashes to demonstrate the security of different password hash algorithms and the corresponding attack and defense strategies.

[0022] 2. Participants Password hashing algorithms: Common password hashing algorithms, including MD5, SHA-1, SHA-256, bcrypt, and PBKDF2, simulating their actual applications in password storage.

[0023] 3. Attack Method Attacks on password hashes include the following three common methods: 1) Brute Force Description: Try all possible password combinations one by one until a matching hash value is found; Complexity: High Effectiveness: Efficient for short passwords, inefficient for long passwords; Corresponding defensive measures: Use long and complex passwords, set login rate limits, and account lockout policies.

[0024] 2) Dictionary Attack Description: Perform a match attempt based on a list of known common passwords; Complexity: Medium; Validity: Effective against weak passwords; Corresponding defensive measures: Use strong passwords, salting, and two-factor authentication.

[0025] 3) Rainbow Table Attack Description: Use the pre-computed hash table to match the target hash value; Complexity: Low Effectiveness: Very effective against unsalted hashes; Corresponding defensive measures: Salt the password and use a hash algorithm with a high number of iterations (such as bcrypt or PBKDF2).

[0026] 4. Defense Strategy 1) Salting Description: Add a unique random number (salt value) to each password and then perform hashing; Effectiveness: High Example: hash(password + salt).

[0027] 2) Key Stretching Description: Increase the cracking cost by iterating hashing multiple times; Effectiveness: High Example: PBKDF2 with 100,000 iterations.

[0028] 3) Rate Limiting Description: Limit the number of login attempts within a specific time window; Effectiveness: Moderate. Example: Maximum of 3 attempts every 10 minutes.

[0029] 5. Simulation process Enter password: the plain text password provided by the user; Hash function: User-selected hash algorithm (such as bcrypt); Whether to enable salting: Select whether to enable salt value for hashing; Number of attack attempts: the total number of simulated attacks; Attack success or failure: Determine whether the attack successfully cracked the password; Defense effectiveness evaluation: Evaluate the effectiveness of defense strategies based on attack results.

[0030] 2. The task list in the password hash attack and defense drill is as follows: The task list defines the experimental tasks that the contestants need to complete, guides the experimental process step by step, and gradually deepens the different links of the password hash attack and defense drill. There is a logical order relationship between the tasks, and the completion results of the previous tasks serve as the input of the subsequent tasks.

[0031] First, participants need to select a hash algorithm and complete the initial configuration, including MD5SHA-1, SHA-256, bcrypt or PBKDF2. The selected hash algorithm will determine the experimental content of subsequent tasks.

[0032] Next, the contestant needs to perform a hash calculation on the specified password to generate the corresponding hash value. If the experiment requires the use of salt defense, the contestant needs to randomly generate a salt value and participate in the hash calculation.

[0033] Afterwards, the contestants simulated different attack methods. The brute force task required the contestants to try password combinations one by one to find a password that matched the hash value. The dictionary attack task required matching with a list of common passwords. For the rainbow table attack task for unsalted hashes, the contestants needed to import a precomputed hash table and try to crack it.

[0034] In the defense strategy verification task, contestants need to improve the security of hash calculations by enabling salting, key stretching and other technologies, and record the impact of defense strategies on cracking time and success rate.

[0035] The final stage of the task list requires contestants to summarize the experimental results, write an experimental report, record the experimental process, result data and analysis of the defense effect.

[0036] 3. The scoring rules for the Password Hash Attack and Defense Drill are as follows: The scoring rules are based on the participants' task completion and experimental results. The scoring is mainly composed of four parts: task completion, attack and defense effect evaluation, defense strategy application and experimental report standardization.

[0037] The completion of the task is the basis for scoring. Participants need to complete the experimental tasks item by item according to the task list. Each task has a completion standard. If the task is not performed correctly, the corresponding score will not be included in the total score.

[0038] The attack and defense effect evaluation is quantitatively evaluated based on indicators such as cracking time and cracking success rate in the experimental results. For attack tasks, the shorter the cracking time and the higher the success rate, the higher the score. For defense strategy tasks, the more obvious the defense effect, the higher the score.

[0039] The defense strategy application score focuses on evaluating the correct implementation and effectiveness verification of salting, key stretching and other technologies. Participants are required to provide detailed experimental data to prove the impact of defense strategies on cracking difficulty.

[0040] The standardization score of the experimental report takes into account the completeness of the report content, format standardization and accuracy of the result analysis. A complete report should include experimental steps, data records, experimental result charts and analysis conclusions.

[0041] The final result of the scoring is a summary of the weighted proportions of each scoring item to generate the contestant's total score. The scoring rules ensure the fairness and scientificity of the evaluation results by examining the experimental process and results in multiple dimensions.

[0042] S2. JSON configuration file parsing: The software system reads the JSON file content through the built-in parser and maps the configuration parameters into the internal data structure. The parser extracts the virtual host configuration, the initial state of the experiment and the task details, and generates an executable task sequence based on the task list.

[0043] During the parsing process, the system verifies the legality of the JSON file format and performs integrity checks on key parameters, such as ensuring that the task list is complete and the scoring rules are consistent with the total task score. The details are as follows: Input content: The JSON file defines key information such as attacks, hash algorithms, and defense strategies.

[0044] Parsing process: 1) Read the JSON file; 2) Extract field information such as hash algorithm, attack method, defense strategy and initial password; 3) Map configuration parameters to internal variables of program execution.

[0045] 4) Output results: configuration item variable table, including password plaintext, hash algorithm, attack type and other information.

[0046] S3, virtual environment construction: The system uses virtualization technology to create an experimental virtual environment based on the host configuration described in the JSON file; the virtual environment is implemented using container or virtual machine technology to isolate the experimental process and prevent external interference. During the creation process, the system automatically allocates computing resources and initializes the experimental environment; the virtual environment loads basic software components, including the operating system kernel and necessary tool sets, to provide an execution platform for subsequent attack and defense simulations. The details are as follows: 1) Initialize the environment: select the required hash algorithm library (such as OpenSSL, bcrypt, Crypto++) according to the parsing results; select the corresponding attack method module according to the attack method.

[0047] 2) Runtime environment configuration: configure the password hash function interface; initialize attack dictionaries, rainbow tables and other data sets. Configure execution parameters (such as the maximum number of brute force cracking attempts, salt value length, etc.).

[0048] S4. Application of configuration management tools: The configuration management tool applies the initial state configuration to the virtual environment according to the task sequence output by the parser; the configuration process includes operations such as password generation, hash calculation, and defense strategy setting to ensure that the experimental environment meets the expected conditions; the configuration management tool supports repeated execution to ensure that the experimental environment is consistent in multiple experiments. The tool also records each configuration operation log for easy traceability afterwards.

[0049] S5. Security subject business logic execution: The system executes the experimental logic in the order of the task list to simulate the entire process of password hash attack and defense. First, the system generates a hash value for the password, using the specified hash algorithm and salting strategy. Then, it simulates attacks on the generated hash value, and executes dictionary attacks and other specified attack methods in turn. After each attack operation, the system determines whether the task is successful based on the attack results. During the defense strategy testing phase, the system enhances the password protection strength through salted hashing, multi-round hashing, and other means, and evaluates the defense effect. The details are as follows: 1) Attack method selection: According to the attack method specified in the JSON configuration file, the following attack tasks are launched: brute force cracking (trying password combinations one by one), dictionary attack (using a common password library), and rainbow table attack (targeting unsalted hashes).

[0050] 2) Attack execution: dynamically adjust the attack rate, record the number and time of attack attempts, and determine whether the hash value is successfully matched.

[0051] 3) Output results: success or failure status, cracking time, and number of attempts.

[0052] S6. Scoring and result display: The system calculates the experimental score according to the scoring rules. For attack tasks that do not require additional calculations, the system immediately feedbacks the experimental results and records the scores. For attack tasks involving a large amount of calculations, such as attacks based on high-round hashing, the system delays feedback of results after completing the calculations. After each experiment, the system generates an experimental report to show the task execution status, the total score of the experiment, and the deduction record.

[0053] In this embodiment: 1) The experimental environment adopts multi-layer security protection measures, as follows: Sandbox execution: Limit the execution permissions of experimental code through a virtual environment to prevent malicious code from damaging the host system; Resource isolation: Each experimental task is assigned an independent virtual environment to prevent resource competition and interference between different experimental tasks; Log audit: The system records all experimental operations and configuration changes for subsequent analysis and security audits.

[0054] 2) The immediate feedback and delayed feedback mechanisms are as follows: During the experiment, the system immediately displays the experimental results for tasks that do not require additional calculations. For tasks that involve a lot of calculations, such as attack tasks based on high-round hashing, the system delays feedback of results and prompts the user with the estimated waiting time during the waiting period.

[0055] 3) The dynamic update and expansion mechanism is as follows: The system supports dynamic expansion of experimental subjects. Authorized users can upload new JSON configuration files through the graphical interface or command line tools to create new experimental subjects. The system manages JSON configuration file versions through version control tools to ensure that changes are traceable.

[0056] 4) In order to verify the accuracy of the password hash attack and defense drill scoring system, this embodiment can be verified in many aspects through the following ways: 1. Verification of preset standard experimental cases First, a set of standard experimental cases are designed as a benchmark. These cases cover typical password hash attacks and defense strategies, such as using known weak passwords for hash calculations and restoring them through brute force or dictionary attacks. For each case, the expected cracking time, success rate, and defense effect are pre-calculated and recorded. The scoring results generated by the scoring system during the experiment need to be compared with the expected results. If the results are consistent, it means that the scoring logic is correct.

[0057] For example, a fixed weak password "password123" can be set with a hash value under the MD5 algorithm, and it is expected to be successfully cracked within 1 second through a dictionary attack. If the time record and scoring results of the scoring system for this task are consistent with expectations, it means that its accuracy has been verified in this case.

[0058] 2. Experimental verification of boundary conditions For different types of hash algorithms and attack methods, we build experimental tasks for extreme cases, including ultra-short passwords, ultra-long passwords, empty passwords, and random complex passwords. The system needs to correctly handle these boundary conditions and give reasonable scoring results.

[0059] For example, the hash value of an empty password should take the shortest time to crack, and the success rate should be close to 100%, while the brute force cracking of a randomly generated long password should take a very long time and have a very low success rate. The scoring system needs to reflect the expected scoring trend based on these boundary experiments.

[0060] 3. Multiple rounds of experimental consistency verification Repeat the same experimental task multiple times to check the stability of the scoring results. If the scoring results fluctuate very little in multiple experiments, it means that the system can stably reflect the experimental results.

[0061] For example, if 10 brute force cracking experiments are performed on the same password hash value and the average cracking time and success rate of the scoring results do not change by more than 5%, it proves that the scoring system has good consistency.

[0062] 4. Scoring Error Analysis Introduce human intervention factors during the experiment, such as changing computing resources (CPU frequency, memory size) or network conditions, and observe whether the scoring system can correctly reflect the changes in experimental conditions. If changes in experimental conditions can lead to fluctuations in expected scoring results, it means that the scoring system can accurately capture the impact of environmental factors on experimental results.

[0063] For example, the time it takes to crack the same task in a high-performance computing environment should be shorter than that in a low-performance environment, and the scoring system should make corresponding score adjustments to this change.

[0064] 5. Expert manual review and verification Experts in the field of cryptography are invited to conduct independent reviews of the experimental process and scoring results. Experts analyze experimental logs, code implementations, and scoring criteria to determine whether the scoring system is objective, fair, and accurate. Expert feedback is used to further improve the scoring rules and system logic.

[0065] 6. Iterative verification based on user feedback Through the initial experimental competition, we collect feedback from participants and analyze whether there are abnormal scores or unreasonable scoring results in the scoring system. We adjust the scoring criteria or scoring weights based on the feedback to ensure that the scoring system can truly reflect the technical level of the experimental results.

[0066] Through multiple approaches such as standard cases, boundary condition experiments, multiple rounds of experimental consistency verification, scoring error analysis, expert review and user feedback, the scoring system can be fully verified during the design, implementation and operation process to ensure its accuracy, fairness and repeatability.

[0067] When the software system designed in this embodiment is used for attack and defense simulation, the software platform needs to construct a basic architecture, and the basic architecture is as follows: 1) User interaction layer Interaction module: A graphical user interface (GUI) provided to users for selecting difficulty, viewing current status, completing tasks, etc.

[0068] API interface: allows third-party systems to interact with the shooting range programmatically.

[0069] 2) Application logic layer Scene management module: responsible for loading and saving JSON configuration files, generating corresponding GUI interfaces, and processing user selections and inputs.

[0070] Scoring system: Use the memory copy function to verify the answers submitted by the user and give corresponding scores based on their correctness.

[0071] Task management system: manage and schedule different attack and defense tasks, including code filling tasks and other interactive training tasks.

[0072] 3) Core service layer Virtualization and containerization services: used to create and manage virtual machines and container environments.

[0073] Security services: including IDS / IPS, anti-virus, vulnerability scanning and other functions to ensure the safety and reliability of the shooting range.

[0074] 4) Data management layer JSON configuration library: stores JSON configuration files for all attack and defense scenarios, supporting version control and history tracking.

[0075] Log and audit system: records log information of all activities for later analysis and auditing.

[0076] 5) Infrastructure layer Physical server: provides computing power and storage space.

[0077] When the system designed in this embodiment is working, a JSON file is pre-written, and the relevant configuration is defined in the JSON file structure; then the JSON file parser is run to select the JSON file corresponding to the password hash attack and defense drill to parse it, read the content of the JSON file, and map the read configuration parameters to the internal data structure. The system creates an experimental virtual environment according to the host configuration described in the JSON file and performs automatic configuration; then log in to the account, select the attack method (this embodiment uses "dictionary attack"), click the "attack" button to perform the attack and defense drill, and finally output the score (this embodiment displays the final drill score in numbers, such as 82).

[0078] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A design method for an information security attack and defense range software system, characterized in that: This includes building a system that can parse JSON file configurations and dynamically create and manage virtual environments based on the configurations. The specific design steps are as follows: S1. Define the structure of the JSON format file to describe a complete attack and defense scenario; S2. Write a parser to read the configuration in the JSON format file and convert it into actual executable tasks; S3. Use virtualization technology to create the required attack and defense scenario virtual environment; S4. Use the configuration management tool to apply the configuration parsed by the parser to the virtual environment to ensure that the same environment can be reproduced every time a new attack and defense scenario is launched; S5. Run the business logic of the security subjects corresponding to the attack and defense scenarios to ensure the integrity of the entire process; S6. Test the running security subject business logic.

2. The design method of an information security attack and defense range software system according to claim 1 is characterized in that: The structure of the JSON format file includes scene metadata, host configuration, initial state, task list and scoring rules.

3. The design method of an information security attack and defense range software system according to claim 2 is characterized in that: The parser is used to parse the JSON file and extract the required information, configure each virtual host, and set tasks and scoring rules.

4. The design method of an information security attack and defense range software system according to claim 3 is characterized in that: In S5, when the business logic of the security subject corresponding to the attack and defense scenario is run, security measures are adopted to ensure the security of the entire process. The specific security measures are as follows: Sandbox execution: restricts the execution permissions of user code to prevent potential malicious behavior; Resource isolation: Allocate independent computing resources to each scenario to avoid mutual interference; Audit log: records all activities.

5. The design method of an information security attack and defense range software system according to claim 4 is characterized in that: The working process of the designed software system is as follows: Step 1. The user selects the JSON file corresponding to the safety exercise subject to be trained; Step 2: Import and parse JSON file and generate graphical user interface: The system automatically reads and parses the selected JSON file to extract relevant information about the training environment; Parse the extracted information and dynamically generate a graphical user interface based on the parsed data; Step 3: Configure the attack and defense parameters of the security subject; Step 4: Simulate attacks and provide feedback: Based on the configured attack and defense parameters, run the business logic of the security subject, provide immediate or delayed feedback on the running results, and display the number of hits of the simulated attack; Step 5. Dynamic update and expansion: The system sets up permission management, authorizing users with corresponding permissions to modify existing JSON files or add new files to dynamically adapt to new and security-threatening subject transactions in the future; and adopts a corresponding version control system to manage different versions of JSON configuration files to ensure that each change can be traced.

6. The design method of an information security attack and defense range software system according to claim 5 is characterized in that: In step 4, the specific process of immediate or delayed feedback is as follows: For attacks that do not require calculation, the results are displayed in a timely manner; for attacks that require calculation, the system calls the corresponding third-party library to perform calculations and displays the results after the calculations are completed.

Images