Software-defined target range-oriented target network construction method and related device

Abstract

The target network construction method and related equipment for the software-defined target range provided in the embodiments of the present application comprise the following steps: obtaining target range data of a network target range, and determining all nodes, point-edge relationships and target attack paths from the target range data; determining an attack end node and a target node according to the target attack paths; starting the node traversal process in parallel from the attack end node and the target node, obtaining a first node in the node traversal process, determining a second node according to the point-edge relationship of the first node, constructing topological structured data according to the first node, the second node and the point-edge relationship, performing a deduplication operation on the topological structured data, taking the second node as the first node for the next node, and repeating the process until the traversal is completed, wherein the initial value of the first node is the attack end node and the target node; and generating a target network target range corresponding to the network target range based on all the topological structured data, thereby effectively improving the construction efficiency and the reproduction rate of the network target range.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method and related equipment for constructing target networks for software-defined ranges. Background Technology

[0002] As the simulation scale and capabilities of network test ranges continue to expand, the demand for the construction and generation of network test ranges is also increasing. Currently, the generation of the test range topology still relies on manual drawing and configuration by the user, resulting in low efficiency and low reproducibility in network test range construction. Summary of the Invention

[0003] This application provides a method and related equipment for constructing target networks in software-defined ranges, which can improve the construction efficiency and reproducibility in network ranges.

[0004] To achieve the above objectives, a first aspect of this application proposes a method for constructing target networks for software-defined ranges, comprising:

[0005] Acquire target range data from the network target range, and determine all nodes, point-edge relationships, and target attack paths from the target range data;

[0006] The attacking node and the target node are determined based on the target attack path;

[0007] The node traversal process is executed in parallel starting from the attack node and the target node. During the node traversal, a first node is obtained, and a second node is determined based on the point-edge relationship of the first node. Topological structured data is constructed based on the first node, the second node, and the point-edge relationship, and the topological structured data is deduplicated. The second node is used as the first node for the next node traversal until the traversal is completed. The initial values ​​of the first node are the attack node and the target node. During all the node traversals, the number of traversals for each point-edge relationship is no more than two.

[0008] The target network range is generated based on all the topology-structured data.

[0009] In some embodiments, constructing topologically structured data based on the first node, the second node, and the point-edge relationship includes:

[0010] The hash relationship between the first node and the second node is determined based on the point-edge relationship between the first node and the second node;

[0011] Based on the hash relationship, the first node, and the second node, generate the node-edge hash value between the first node and the second node;

[0012] Based on the point-edge hash value, the topological structured data between the first node and the second node is obtained.

[0013] In some embodiments, generating the edge hash value between the first node and the second node based on the hash relationship, the first node, and the second node includes:

[0014] When the hash relationship represents a one-way connection between the first node and the second node, the node name of the first node is used as the first hash parameter, the node name of the second node is used as the second hash parameter, and a first sequential hashing process is performed on the first hash parameter and the second hash parameter to obtain a first point-edge hash value, and the first point-edge hash value is used as the point-edge hash value between the first node and the second node.

[0015] When the hash relationship represents that the second node is unidirectionally connected to the first node, the second hash parameter and the first hash parameter are subjected to a second sequential hashing process to obtain a second point-edge hash value, and the second point-edge hash value is used as the point-edge hash value between the first node and the second node.

[0016] When the hash relationship indicates that there is a bidirectional connection between the first node and the second node, the hash value of the first node edge and the hash value of the second node edge are used as the hash value of the node edge between the first node and the second node.

[0017] In some embodiments, the deduplication operation on the topology-structured data includes:

[0018] The topology-structured data is queried and detected against multiple hash data in the Bloom filter to obtain the query detection results;

[0019] When the query detection result indicates that the Bloom filter contains hash data that is consistent with the topology structured data, the topology structured data is discarded.

[0020] When the query detection result indicates that the Bloom filter does not contain hash data that is consistent with the topology-structured data, the topology-structured data is saved and added to the Bloom filter as new hash data.

[0021] In some embodiments, acquiring network target range data includes:

[0022] Get the network topology code input by the user;

[0023] Data analysis is performed on the network topology code to obtain the target range data.

[0024] In some embodiments, the step of performing data analysis on the network topology code to obtain the target range data includes:

[0025] Based on the target range generation code in the network topology code, generate initial target range data;

[0026] Based on the vertex subset code in the network topology code, multiple target range vertices in the initial target range data are generated;

[0027] Based on the vertex filtering code in the network topology code, multiple target range vertices are filtered to obtain filtered target range vertices, and the initial target range data is updated based on the filtered target range vertices.

[0028] The target range data is obtained based on the updated initial target range data.

[0029] In some embodiments, filtering multiple target range vertices based on vertex filtering code in the network topology code to obtain filtered target range vertices includes:

[0030] Based on the filtering conditions in the network topology code, a first filtering function and a second filtering function are generated.

[0031] Based on the mapping conditions in the network topology code, a mapping function is generated;

[0032] Based on the first filtering function, a first filtering is performed on multiple target range vertices to obtain first filtered target range vertices. Based on the mapping function, the first filtered target range vertices are mapped to obtain mapped filtered target range vertices. Then, based on the second filtering function, the mapped filtered target range vertices are filtered a second time to obtain second filtered target range vertices.

[0033] The second filter target field vertex is processed by data transformation to obtain the filter target field vertex.

[0034] To achieve the above objectives, a second aspect of this application proposes a target network construction system for software-defined ranges. This system is used to execute the target network construction method for software-defined ranges as described in the first aspect. The system includes:

[0035] The northbound interface, control layer, southbound interface, and construction layer are connected in sequence.

[0036] The northbound interface is used to obtain the network topology code input by the user and transmit the network topology code to the control layer;

[0037] The control layer is used to acquire target range data of the network target range, and determine all nodes, point-edge relationships and target attack paths from the target range data;

[0038] The control layer is also used to determine the attacking node and the target node based on the target attack path;

[0039] The control layer is also used to execute a node traversal process in parallel, starting from the attack node and the target node. During the node traversal process, a first node is obtained, a second node is determined based on the point-edge relationship of the first node, topological structured data is constructed based on the first node, the second node and the point-edge relationship, and the topological structured data is deduplicated. The second node is used as the first node for the next node traversal, until the traversal ends. The initial values ​​of the first node are the attack node and the target node. During all the node traversals, the number of traversals of each point-edge relationship is no more than two.

[0040] The control layer is also used to transmit all the topology structured data to the construction layer through the southbound interface;

[0041] The construction layer is used to generate the target network range corresponding to the network range based on all the topology structured data.

[0042] To achieve the above objectives, a third aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the target network construction method for software-defined ranges as described in the first aspect.

[0043] To achieve the above objectives, a fourth aspect of this application provides a storage medium, which is a computer-readable storage medium storing a computer program that, when executed by a processor, implements the target network construction method for software-defined ranges described in the first aspect.

[0044] The target network construction method and related equipment for software-defined ranges proposed in this application include: First, acquiring range data of the network range and determining all nodes, point-edge relationships, and target attack paths from the range data; then, determining attack nodes and target nodes based on the target attack paths; next, performing a node traversal process in parallel, starting from the attack nodes and target nodes. During the node traversal, a first node is acquired, a second node is determined based on the point-edge relationships of the first node, topology structured data is constructed based on the first node, the second node, and the point-edge relationships, and deduplication is performed on the topology structured data. The second node is used as the first node for the next node traversal until the traversal is completed. The initial values ​​of the first node are the attack nodes and target nodes. During all node traversals, the number of traversals for each point-edge relationship is no more than two; finally, generating the target network range corresponding to the network range based on all the topology structured data. This application embodiment starts by obtaining the target attack path determined in the target range data describing the network range constructed for the target, identifies specific attack endpoint nodes and target nodes, and further performs parallel traversal starting from the attack endpoint nodes and target nodes. It eliminates the need for inefficient full graph traversal or reliance on manual construction by the user in traditional technologies, greatly improving the construction efficiency of large-scale and complex network ranges. Furthermore, during the traversal process, complex point-edge relationships are fragmented and atomized into standard topological structured data. Combined with real-time deduplication operations, it ensures that each valid network connection is processed only once. This not only fundamentally solves the problem of low reproducibility caused by manual configuration or heterogeneous data sources, ensuring the determinism and consistency of each transformation result, but also makes the atomized topological structured data highly reusable, effectively improving the construction efficiency and reproducibility of the network range. This lays a solid foundation for the rapid combination and dynamic adjustment of future ranges, thereby effectively meeting the ever-expanding needs of network range simulation scale and capabilities.

[0045] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description, claims and drawings. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the structure of a target network construction system for software-defined ranges provided in an embodiment of this application.

[0047] Figure 2 This is a flowchart of a target network construction method for a software-defined range, provided in another embodiment of this application.

[0048] Figure 3 yes Figure 2 The flowchart for step 201.

[0049] Figure 4 yes Figure 3 The flowchart for step 302.

[0050] Figure 5 yes Figure 4 The flowchart for step 403.

[0051] Figure 6 yes Figure 2 The flowchart for step 203.

[0052] Figure 7 yes Figure 6 The flowchart for step 602.

[0053] Figure 8 yes Figure 2 Another flowchart for step 203.

[0054] Figure 9 This is a schematic diagram of the hardware structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0056] It should be noted that although functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0058] As the simulation scale and capabilities of network ranges continue to expand, the demand for the construction and generation of network ranges is also increasing. Currently, the generation of range topologies still relies on manual drawing and configuration by the user, resulting in low efficiency and low reproducibility in network range construction.

[0059] The following first describes a target network construction system for software-defined ranges provided by an embodiment of this application. (Refer to...) Figure 1This is a schematic diagram of a target network construction system for software-defined ranges provided in an embodiment of this application. Figure 1 As shown, the target network construction system for software-defined test ranges includes a northbound interface, a control layer, a southbound interface, and a construction layer connected in sequence. Through the northbound interface, the system receives data from user applications (such as...). Figure 1 The “CR APP 1” shown in the diagram obtains the network topology code used to define the target range topology and transmits it to the control layer. In the control layer, the code generator first parses the code to include all nodes (such as...). Figure 1 The diagram shows the initial network topology (nodes 1, 2, 3, 4) and their point-edge relationships. Subsequently, the core processing module of the control layer determines node 1 as the attack node and node 4 as the target node based on the preset target attack path, and performs a parallel node traversal process for both the attack and target nodes. During the traversal, each working unit discovers new connections based on point-edge relationships, constructs topology structured data from these connections, and immediately submits it to a shared task deduplication module for deduplication. After this deduplication, the resulting non-redundant topology structured data is collected. Finally, the control layer sends all collected topology structured data to the construction layer via the southbound interface. The construction layer receives these parameters and calls the interface of the infrastructure virtualization resource pool to automatically generate and deploy the final target network range.

[0060] Based on the target network construction system for software-defined test ranges described above, the target network construction method and related equipment for software-defined test ranges provided in the embodiments of this application will be further described below. First, the target network construction method for software-defined test ranges will be described. (Refer to...) Figure 2 This is an optional flowchart of a target network construction method for software-defined ranges provided in the embodiments of this application. Figure 2 The method may include, but is not limited to, steps 201 to 204. It is also understood that this embodiment... Figure 2 The order of steps 201 to 204 is not specifically limited; the order of steps can be adjusted or certain steps can be added or removed according to actual needs. The target network construction method for software-defined ranges provided in this embodiment can be applied to the target network construction system for software-defined ranges.

[0061] Step 201: Obtain the target range data of the network target range, and determine all nodes, point-edge relationships and target attack paths from the target range data.

[0062] Step 201 is described in detail below.

[0063] In some embodiments, upon responding to a user's request to build a network range, the target range data corresponding to the network range to be built by the user is first obtained. That is, the target range data is a raw, high-level definition used to describe the network range topology that the user expects to build, which can come from various input forms such as code, configuration files or graphical interfaces.

[0064] After acquiring the target range data, it is analyzed to identify and extract all the basic elements constituting the network topology. Specifically, this includes all nodes (i.e., physical devices in the network, such as servers and routers), the point-edge relationships between nodes (i.e., the connection methods between nodes, including attributes such as direction and protocol), and the target attack path. This target attack path is an attack chain with clear business significance pre-defined by the user according to the simulation task requirements. It defines the core attack and defense scenario of this target range simulation and includes the attacking nodes initiating the attack across multiple nodes, as well as the target nodes receiving the attack.

[0065] The following section will further describe how to obtain the target range data corresponding to the network target range that the user wants to build.

[0066] Reference Figure 3 To obtain target range data from the network target range, the steps 301 to 302 are as follows.

[0067] Step 301: Obtain the network topology code input by the user.

[0068] Step 302: Perform data analysis on the network topology code to obtain target range data.

[0069] Steps 301 to 302 are described in detail below.

[0070] In some embodiments, the system first obtains the network topology code input by the user through a northbound interface. This network topology code is not a simple graph or configuration form, but a structured, programmable domain-specific language (DSL) or script, which is also the code for constructing the network topology. By writing this code, the user can accurately and flexibly describe the required network range topology, node attributes, and behavioral logic in a manner similar to software development. This code-based input method provides the foundation for achieving a high degree of automation and accurate reproduction of network range construction. The system receives this source code, provided by the user and containing the complete range construction intent, through a specific northbound interface (such as an API or file upload).

[0071] Then, the system's control layer interprets and executes the received source code, that is, performs data analysis on the network topology code to generate a machine-readable structured dataset, i.e., the target range data. During the data analysis process, the system's control layer parses and executes the instructions and logic defined in the network topology code, such as creating nodes according to generation rules, filtering nodes according to filtering conditions, or modifying node attributes according to mapping relationships.

[0072] In this embodiment, referring to the existing interface, a new interface code has been redefined in the northbound interface, which mainly includes the following code operations.

[0073] VRun: Generates a realistic network topology for experimentation on the target area according to the graph structure, i.e., size_tVRun(VertexSubset U). This function takes a pointer U to a subset of the target area vertices (VertexSubset) as input. Its core function is to trigger the instantiation or startup process of all nodes in the vertex subset, i.e., to create the corresponding virtual machines or containers in the build layer. The function returns a pointer to type size_t, whose value represents the number of nodes successfully started. This provides a programmatic interface for users to perform batch startup operations in the network topology code and obtain the execution results.

[0074] VDestroy: Deletes the network topology corresponding to the graph in the target network, but does not delete the graph itself, i.e., size_tVDestroy(VertexSubset U). This function, as the corresponding operation of the VRun function, is used to trigger the destruction or shutdown of all nodes in the specified subset U of vertexes in the target network. This function can be called when the user needs to dynamically remove a portion of simulation resources from the target network target network. Its return value also indicates the number of nodes successfully destroyed, thus, together with the VRun function, forming a complete lifecycle management capability for fine-grained and programmatic creation and destruction of target network resources.

[0075] VSize: Returns the size of a specified subset of vertices, i.e., size_t VSize(VertexSubset U). This function takes a subset U of vertices from the target range as input and returns the total number of nodes contained in that subset. This function provides users with the necessary query capabilities when writing network topology code, enabling them to perform conditional judgments and logical branches based on the number of nodes, such as "configure a load balancer for a web server cluster larger than 10", thereby achieving more complex and intelligent automated definition of the target range.

[0076] VertexSet: Unlike complex network topologies, target-oriented network topologies typically use a directed graph with potential starting points (attack endpoints) and ending points (targets). Therefore, a filtering function F can be used to select vertices that meet certain conditions, and then a mapping function M can be applied to these vertices. Specifically, if updating vertex data is not required, the M function can be omitted, thus performing only the filtering operation. The corresponding code instruction is VertexSubset VertexSet(VertexSubset U, F(Vertex v)->bool, M(Vertex v)->vertex). This function takes a subset U of target vertices as input and returns the total number of nodes contained in that subset. This function provides users with the necessary query capabilities when writing network topology code, enabling them to perform conditional judgments and logical branches based on the number of nodes, such as "configure a load balancer for a web server cluster larger than 10", thereby achieving more complex and intelligent automated definition of the target environment.

[0077] EdgeMap: For a graph G(V, E), the EdgeMap operation processes edges whose source vertex is in a subset of vertices U and belongs to edge set H. Users can dynamically define edge set H, or even use algorithm-generated virtual edges, expanding the communication range. Edges that meet the filtering conditions update their endpoint values ​​through the mapping function M, and the function R summarizes and updates the final result, adding the updated vertices to the result set. The corresponding code instruction is VertexSubset EdgeMap(VertexSubset U, EdgeSet H, F(Vertex s, Vertexd)->bool, M(Vertex s, Vertex d)->Vertex, C(Vertex v)->bool, R(Vertex t, Vertex d)->Vertex). This function aims to automatically create connections between different target field vertices based on user-defined complex logic. It accepts one or more target field vertex subsets and multiple functions as parameters, which define the connection filtering conditions (such as connecting only specific types of nodes), mapping rules (such as modifying connection attributes), and aggregation logic, respectively. By calling this function, users can declaratively describe complex network connection topologies in the network topology code, such as "connect all class A nodes to class B nodes that meet specific conditions". The system will automatically parse the call and generate the corresponding node-edge relationships, thereby achieving a high degree of automation and intelligence in network topology construction.

[0078] Following this data analysis process, the output is the target range data corresponding to the network target range that the user wants to build. This target range data is a pre-processed, structured list of network elements, clearly listing all valid network components and their relationships in a unified format (such as node lists and edge lists). This target range data has transformed the user's high-level programming intent into concrete basic data that can be directly processed by subsequent core algorithms.

[0079] Reference Figure 4 The network topology code is analyzed to obtain target range data, including the following steps 401 to 404.

[0080] Step 401: Generate initial target range data based on the target range generation code in the network topology code.

[0081] Step 402: Generate multiple target range vertices from the initial target range data based on the vertex subset code in the network topology code.

[0082] Step 403: Based on the vertex filtering code in the network topology code, filter multiple target range vertices to obtain filtered target range vertices, and update the initial target range data based on the filtered target range vertices.

[0083] Steps 401 to 403 are described in detail below.

[0084] In some embodiments, when performing data analysis on network topology code, the execution basis is the target range generation code within the network topology code. The system interprets and executes this code, such as the VRun operation mentioned above, for example, based on instructions like "create 100 web servers" or "build a standard three-layer network architecture," generating a broad, unfiltered set containing all potentially used nodes and connections. This set constitutes the initial target range data, serving as a data superset or raw material library for subsequent refined filtering operations.

[0085] Furthermore, based on the vertex subset code in the network topology code, multiple target range vertices are generated from the initial target range data. Here, the vertex subset code refers to the instructions in the script used to logically classify or name the generated large set of nodes, such as the VSize operation mentioned above. The system executes this code, for example, grouping all nodes of type "database" into the "DB_Group" subset, and all nodes located in the "DMZ" region into the "DMZ_Group" subset. This step does not create new nodes; instead, it identifies and marks multiple groups of nodes with common characteristics from the initial target range data, and refers to these identified nodes as target range vertices, providing clear targets for the next step of precise filtering.

[0086] Next, based on the vertex filtering code in the network topology code, multiple target range vertices are filtered to obtain filtered target range vertices, and the initial target range data is updated based on these filtered vertices. The vertex filtering code here is a script containing instructions with specific business logic and conditional judgments. Its purpose is to filter out the nodes truly needed for this task from the target range vertex group determined in the previous step, which is the EdgeMap or VertexSet operation mentioned above. For example, it might perform a filtering operation on "DB_Group" to "filter out nodes with a specific version of MySQL installed". The final set of nodes that meets all conditions after this filtering operation is the filtered target range vertex. Subsequently, the system updates the initial target range data in reverse based on the filtered target range vertices, that is, removing all unselected nodes and their related connections from the original dataset, thus obtaining a concise and accurate dataset.

[0087] The following section will further describe how to filter multiple target vertices when performing an EdgeMap operation.

[0088] Reference Figure 5 Based on the vertex filtering code in the network topology code, multiple target field vertices are filtered to obtain filtered target field vertices, including the following steps 501 to 504.

[0089] Step 501: Generate the first filtering function and the second filtering function based on the filtering conditions in the network topology code.

[0090] Step 502: Generate a mapping function based on the mapping conditions in the network topology code.

[0091] Step 503: Perform a first filter on multiple target range vertices based on the first filter function to obtain the first filtered target range vertices. Perform a mapping process on the first filtered target range vertices based on the mapping function to obtain the mapped filtered target range vertices. Then perform a second filter on the mapped filtered target range vertices based on the second filter function to obtain the second filtered target range vertices.

[0092] Step 504: Perform data transformation processing on the second filter target field vertex to obtain the filter target field vertex.

[0093] Steps 501 to 504 are described in detail below.

[0094] In some embodiments, when performing filtering operations based on EdgeMap operations, a dynamic generation phase of the filtering logic is first executed. In this phase, a first filtering function and a second filtering function are generated based on the filtering conditions in the network topology code. These filtering conditions are logical rules defined by the user in text form in the target code for filtering nodes, such as "the node's operating system is Linux" or "the node's open ports include 22". The system parses these textual filtering conditions and compiles or interprets them into two independent, executable program units: the first filtering function and the second filtering function. These two functions respectively carry the filtering logic at different stages, providing callable functional entities for subsequent chained processing.

[0095] Simultaneously, a mapping function is generated based on the mapping conditions in the network topology code. Unlike filtering conditions, mapping conditions are user-defined rules used to modify or transform node attributes, such as "add '-prod' to the end of all node names" or "add a 'critical' label to a specific node." The system also parses these mapping conditions and generates an executable mapping function. This function does not filter, but rather applies the transformation rules to each input node without changing the number of nodes, and outputs the transformed new node, making it possible to insert data transformation operations into the filtering process.

[0096] Next, a chain-like data processing flow consisting of filtering and mapping is executed. This flow strictly follows a predetermined order: First, the system performs a first filtering on multiple target vertices based on a first filtering function, removing nodes that do not meet the initial conditions, resulting in a pre-selected set, i.e., the first filtered target vertices. Next, the system performs mapping processing on the first filtered target vertices based on a mapping function, applying attribute transformation rules to all remaining nodes in the set, resulting in a set of nodes with modified attributes, i.e., the mapped filtered target vertices. Finally, the system performs a second filtering on the mapped filtered target vertices based on a second filtering function, performing a second, potentially more refined, filtering on the nodes that have already undergone mapping processing, ultimately obtaining the second filtered target vertices.

[0097] Finally, the results of the chained processing are formatted and confirmed, specifically by performing data transformation on the vertices of the second filtering target field to obtain the final filtering target field vertices. This data transformation is primarily a final normalization and shaping operation, removing temporary markers generated during processing or standardizing the data structure to the format required for subsequent steps. After this step, the final, clean set of nodes is officially confirmed as the filtering target field vertices, marking the end of the entire fine-grained filtering process.

[0098] Through steps 501 to 504 above, by introducing and dynamically generating the first filtering function, the mapping function, and the second filtering function, a complex filtering task is decomposed into a refined and programmatic chain operation of "filtering-mapping-re-filtering," which brings extremely high flexibility and expressiveness. Users can combine extremely complex filtering logic, such as "first select all web servers, then uniformly modify their hostnames, and finally select those with more than 4 CPU cores from the modified results." This is difficult to achieve with traditional single filtering methods, making the filtering logic itself modular and reusable, and greatly improving the automation level and construction efficiency of the target range definition.

[0099] Step 404: Obtain the target range data based on the updated initial target range data.

[0100] Step 404 will be described in detail below.

[0101] In some embodiments, after vertex data filtering is completed, target range data is finally obtained based on the updated initial target range data. The updated initial target range data here refers to the final clean data set obtained after a series of operations such as generation, grouping, filtering, and pruning following vertex data filtering.

[0102] Through steps 401 to 404 above, the definition process of the network range is transformed from a single, rigid process into a modular and procedural "generate-filter-confirm" process. This allows users to first define a reusable, general-purpose network template with multiple possibilities through range generation code, and then precisely and dynamically sculpt the required topology subset from the template according to specific task requirements through highly flexible vertex filtering code. This greatly improves the flexibility and automation of range definition, making the modularization and reuse of range components possible. Thus, while ensuring a high reproducibility rate of the construction results, it significantly improves the construction efficiency when facing changing simulation requirements.

[0103] Through steps 301 to 302, by introducing network topology code as the input source, the network definition is elevated from traditional manual drawing and static configuration to a precise and programmable software engineering practice. This solves the problem of low reproducibility caused by the uncertainty of manual operation, because the same code will inevitably generate the same topology, ensuring the determinism and consistency of the target range construction. When facing large-scale and complex network target ranges, the construction efficiency of programmatic generation and definition through code far exceeds that of manual configuration, greatly shortening the target range preparation cycle. The code-based definition method gives the target range construction unprecedented flexibility and reusability. Users can easily modularize and parameterize the target range definition and incorporate it into version control, thereby achieving efficient iteration, sharing and reuse.

[0104] Step 202: Determine the attacking node and the target node based on the target attack path.

[0105] Step 202 will be described in detail below.

[0106] In some embodiments, after determining the target attack path from the range data, the system further focuses on and identifies the attack node and target node corresponding to the starting point of the traversal process. Specifically, the system identifies two key endpoints of the target attack path: the initiation point of the attack (attack node) and the final target point of the attack (target node). In this way, the method transforms the subsequent traversal task from a blind and disordered full-map scan into a focused exploration with a clear direction and purpose, radiating outward from key business nodes, laying the foundation for subsequent efficient parallel processing.

[0107] In addition, the target attack path may have multiple attack nodes, meaning there is a possibility that multiple nodes may launch an attack together; conversely, there may also be multiple target nodes, meaning there is a possibility that multiple nodes may be attacked together.

[0108] Step 203: Start the node traversal process in parallel from the attack node and the target node. During the node traversal, obtain the first node, determine the second node based on the point-edge relationship of the first node, construct topological structured data based on the first node, the second node and the point-edge relationship, and perform deduplication on the topological structured data. Use the second node as the first node for the next node traversal until the traversal is completed.

[0109] Step 203 will be described in detail below.

[0110] In some embodiments, after determining the attacking and target nodes, the system begins the process of generating variables for topology data. In this process, each attacking and target node is initially designated as a first node, and corresponding worker processes are created. These worker processes, starting with the initial first node for each attacking and target node, perform parallel and independent node traversal processes. In each traversal iteration, the system first determines the second node connected to the current first node based on its edge relationships. Subsequently, based on these two nodes and their connections, a standardized, atomic topology-structured data is constructed. This topology-structured data is a minimized data unit used to uniquely represent a directed connection.

[0111] After generating each piece of topologically structured data, the system immediately performs a deduplication operation. This involves querying a globally shared record to determine if the connection has been processed by other parallel tasks or previous steps of the current task. If processed, it is discarded; otherwise, it is retained and recorded. This deduplication mechanism directly ensures that the cumulative traversal count of each node-edge relationship is no more than twice (i.e., one round trip for the interconnection relationship) during all parallel traversals, effectively avoiding redundant computation and infinite loops. Finally, the valid second node is used as the first node for the next iteration, and the process is recursively repeated until the entire reachable network is traversed.

[0112] Reference Figure 1 The example shown illustrates the node traversal process in the control layer of a target network construction system for a software-defined range. The system starts two work units, Worker#1 and Worker#2, in parallel, using target node 1 (the attacking node) and target node 4 (the target node) as the starting points for traversal, respectively. In the initial execution of Worker#1, it obtains the first node (initially target node 1) and queries its edge relationships, identifying the connected second nodes as nodes 2 and 3. Subsequently, Worker#1 constructs topology-structured data based on node 1, node 2, and their edge relationships (the product of this process is abstracted in the diagram as arrows pointing to the "task deduplication" module), and submits it to a shared "task deduplication" module. Since this parameter appears for the first time, it is retained after the deduplication operation, generating P1 in the final result set. Similarly, Worker#1 continues to process the connection between nodes 1 and 3, constructing new topology-structured data, which is also retained, generating P2. Meanwhile, Worker#2, using target node 4 as its initial first node, independently and in parallel performs the same operation, constructing and preserving topology-structured data representing connections 4->2 and 4->3, generating P4 and P5. In the next iteration, Worker#1 uses the previously determined second node (e.g., node 2) as the first node for the next traversal, and may find a connection between it and node 3, thus constructing new topology-structured data and successfully preserving it, generating P3. When Worker#2 also explores a connection from node 2 to node 3 in its subsequent traversal, it will construct an identical topology-structured data. However, the query detection result of the "task deduplication" module will indicate that the parameter already exists, so the duplicate topology-structured data generated by Worker#2 will be directly discarded, and no new output will be generated. This process continues until the traversal ends, that is, all non-duplicate connections reachable from the attacking node and the target node are converted into topology-structured data (as shown in the final set of P1 to P6 in the figure), thus efficiently completing the network expansion and significantly improving the processing efficiency for large-scale, complex network topologies.

[0113] The following section will further describe how to generate the topologically structured data between the first and second nodes.

[0114] Reference Figure 6 The topological structured data is constructed based on the first node, the second node, and the point-edge relationship, including the following steps 601 to 603.

[0115] Step 601: Determine the hash relationship between the first node and the second node based on the point-edge relationship between the first node and the second node.

[0116] Step 602: Based on the hash relationship, the first node, and the second node, generate the edge hash value between the first node and the second node.

[0117] Steps 601 to 602 are described in detail below.

[0118] In some embodiments, when generating topologically structured data between the first and second nodes, the hash relationship between the first and second nodes is first determined based on the point-edge relationship between them. Here, the point-edge relationship refers to the relatively rich information in the original data describing how the two nodes are connected, including directionality, protocol type, etc. The hash relationship is a standardized classification label obtained after normalizing and abstracting this point-edge relationship, used to guide subsequent hash calculations, such as "one-way connection," "two-way connection," or "reverse connection." The system analyzes the inherent attributes of the point-edge relationship and assigns it a specific hash relationship label, thus preparing for the next step of precise calculation.

[0119] Next, based on the hash relationship between the first node and the second node, a deterministic hash algorithm (such as SHA-256) is applied to generate the edge hash value between the first node and the second node. This edge hash value is a fixed-length, highly unique digital fingerprint that uniquely represents this specific directed connection in an extremely compact way.

[0120] The following section will further describe how to generate the edge hash value between the first node and the second node based on the hash relationship between the first node and the second node.

[0121] Reference Figure 7 Based on the hash relationship, the first node, and the second node, the point edge hash value between the first node and the second node is generated, including the following steps 701 to 703.

[0122] Step 701: When the hash relationship represents a one-way connection between the first node and the second node, the node name of the first node is used as the first hash parameter, the node name of the second node is used as the second hash parameter, and the first hash parameter and the second hash parameter are subjected to a first sequential hashing process to obtain the first point-edge hash value, and the first point-edge hash value is used as the point-edge hash value between the first node and the second node.

[0123] Step 702: When the hash relationship represents a one-way connection between the second node and the first node, perform a second sequential hashing process on the second hash parameter and the first hash parameter to obtain the second point-edge hash value, and use the second point-edge hash value as the point-edge hash value between the first node and the second node.

[0124] Step 703: When the hash relationship indicates that there is a bidirectional connection between the first node and the second node, the hash value of the first node edge and the hash value of the second node edge are used as the hash value of the node edge between the first node and the second node.

[0125] Steps 701 to 703 are described in detail below.

[0126] In some embodiments, when the hash relationship represents a one-way connection between the first node and the second node (i.e., first node A → second node B), the system uses the unique identifier of the nodes, i.e., the node name of the first node, as the first hash parameter and the node name of the second node as the second hash parameter. Subsequently, the system performs a first-order hashing process on the first and second hash parameters. This first-order hashing process is a deterministic, directional hash operation, namely Hash(A, B), which combines parameters in a fixed order from the "source node" to the "target node" and then calculates to generate a first edge hash value that uniquely represents the specific directed connection. Finally, the system uses this first edge hash value as the edge hash value between the first node and the second node, completing the unique encoding of the one-way connection from A to B.

[0127] In some embodiments, when the hash relationship represents a one-way connection between the second node and the first node, i.e., second node B → first node A, the system uses the same first and second hash parameters, but performs a second-order hashing process on the second and first hash parameters, namely, Hash(B, A). This second-order hashing process corresponds to the first order; it performs hash calculations by combining parameters in reverse order from the "source node" (in this case, the second node) to the "target node" (in this case, the first node), thereby generating a second edge hash value that is distinct from the first edge hash value. This second edge hash value is then used as the edge hash value between the first and second nodes to uniquely identify the connection from the second node to the first node.

[0128] In some embodiments, when the hash relationship represents a bidirectional connection between the first node and the second node, the system does not perform a new hash calculation. Instead, it combines the hash results representing two unidirectional connections in opposite directions, i.e., the hash values ​​of the first and second nodes are used as the node-edge hash values ​​between the first and second nodes, namely Hash(A, B) and Hash(B, A). This means that the unique identifier of a bidirectional connection is composed of the hash values ​​representing its two constituent directions, such as an ordered tuple or set containing these two hash values, thus making it completely different from the identifier of any unidirectional connection.

[0129] Through steps 701 to 703 above, three situations that are easily confused in traditional methods can be fundamentally distinguished: "Node A is unidirectionally connected to Node B", "Node B is unidirectionally connected to Node A", and "Node A and Node B are interconnected". By generating unique and different point-edge hash values ​​for each situation, it is ensured that no misjudgment will occur in the subsequent deduplication operation, which greatly improves the accuracy and fidelity of the final generated topology and ensures that the target network range can accurately reproduce the user-defined network attack and defense scenarios with complex directional requirements.

[0130] Step 603: Based on the node-edge hash value, obtain the topological structured data between the first node and the second node.

[0131] Step 603 will be described in detail below.

[0132] In step 603 of some embodiments, after obtaining the topologically structured data between the first node and the second node, the topologically structured data between the first node and the second node is obtained based on the node name of the first node, the node name of the second node, and the corresponding node-edge hash value. This topologically structured data refers to the standardized, minimized data processing unit used in the traversal and deduplication stages. This signifies that a complex, descriptive node-edge relationship has been successfully transformed and "atomicned" into a simple, unique, and directly usable standardized parameter for efficient comparison and recording.

[0133] Through steps 601 to 603 above, a "classification-calculation-encapsulation" process is used to deterministically transform diverse and complex point-edge relationships into a unified, concise, and unique topological structured data (whose core is the point-edge hash value). This solves the inconsistency problem caused by heterogeneous data sources and provides a solid and reliable data foundation for subsequent deduplication operations. Due to the determinism of hash calculation, it is guaranteed that the same connection will always obtain the same parameters, thereby ensuring a high reproducibility rate in the target range construction. At the same time, using compact hash values ​​for comparison greatly improves the execution efficiency of subsequent deduplication algorithms compared to comparing complex object structures.

[0134] The following section will further describe how to perform deduplication on the generated topologically structured data.

[0135] Reference Figure 8 The process of deduplicating topologically structured data includes the following steps 801 to 803.

[0136] Step 801: Perform query detection on the topology structured data and multiple hash data in the Bloom filter to obtain the query detection results.

[0137] Step 802: When the query detection results indicate that the Bloom filter contains hash data that is consistent with the topology-structured data, the topology-structured data is discarded.

[0138] Step 803: When the query detection result indicates that the Bloom filter does not contain hash data consistent with the topology structured data, the topology structured data is saved and added to the Bloom filter as new hash data.

[0139] Steps 801 to 803 are described in detail below.

[0140] In some embodiments, after generating the topology-structured data between the first and second nodes, this topology-structured data is query-checked against multiple hash data stored in a Bloom filter to obtain the corresponding query check result. The Bloom filter is an efficient, probabilistic data structure that uses a compact bit array and multiple hash functions to quickly determine whether an element belongs to a set, making it particularly suitable for real-time deduplication scenarios involving massive amounts of data. The hash data refers to the topology-structured data previously added to the Bloom filter, representing valid connections. The query check involves mapping the current topology-structured data to its bit array using the multiple hash functions of the Bloom filter and checking whether the corresponding bits are all 1, ultimately obtaining the query check result. This result indicates whether the current topology-structured data "might exist" in the record.

[0141] When the query results indicate that the Bloom filter contains hash data consistent with the topology-structured data, it means that, according to the Bloom filter's judgment, the current network connection has already been processed. Therefore, the system will discard the topology-structured data, meaning it will not be included in the final generated network topology set, thus directly avoiding redundant connections and ensuring the minimization and simplicity of the topology.

[0142] When the query results indicate that the Bloom filter does not contain hash data consistent with the topology-structured data, it means that the current network connection is a brand new, valid connection that has not yet been recorded. In this case, the system first saves the topology-structured data, confirming its validity and adding it to the final result set; then, it adds it as new hash data to the Bloom filter to update the filter's state. This ensures that when other parallel traversal processes encounter the same connection again, it can be correctly identified and discarded in subsequent deduplication operations.

[0143] Through steps 801 to 803 above, by introducing a Bloom filter as the core deduplication tool, its extremely low time complexity (constant time) and extremely high space efficiency enable the existence judgment of topologically structured data to be completed almost instantaneously. This is crucial for handling the real-time deduplication requirements of large-scale network testbeds with millions of connections. It allows multiple concurrently executing traversal threads to safely and efficiently share the same Bloom filter instance for deduplication without the need for complex locking mechanisms that would severely impact performance. This not only ensures extremely high construction efficiency and extremely low resource consumption at the algorithm level, but also ensures high concurrency and scalability of the solution at the system architecture level. It is a key technical guarantee for realizing the rapid and automated construction of complex network testbeds.

[0144] Step 204: Generate the target network range corresponding to the network range based on all topology structured data.

[0145] Step 204 is described in detail below.

[0146] In some embodiments, the final target network range is generated and constructed. After all parallel node traversal processes are completed, the system has collected a topology-structured data set that has undergone real-time deduplication and contains all necessary and redundant connections. At this point, the system generates node simulation tasks based on all nodes and edge relationship simulation tasks between nodes based on all topology-structured data. These two tasks are sent to the construction layer via the southbound interface. In the construction layer, the underlying virtualization platform interface (such as the API of the IaaS platform) is called to automatically complete a series of operations such as virtual machine creation, virtual network configuration, security policy distribution, and the establishment of links between nodes. This generates and deploys a target network range that is completely consistent with the user's original intent and has an optimal structure, which can be directly used for attack and defense exercises.

[0147] The target network construction method and related devices for software-defined ranges proposed in this application include: First, obtaining network topology code input by the user; generating initial range data based on range generation code in the network topology code; generating multiple range vertices in the initial range data based on vertex subset code in the network topology code; generating a first filtering function and a second filtering function based on filtering conditions in the network topology code; generating a mapping function based on mapping conditions in the network topology code; performing a first filtering on the multiple range vertices based on the first filtering function to obtain first filtered range vertices; performing mapping processing on the first filtered range vertices based on the mapping function to obtain mapped filtered range vertices; performing a second filtering on the mapped filtered range vertices based on the second filtering function to obtain second filtered range vertices; performing data transformation processing on the second filtered range vertices to obtain filtered range vertices; updating the initial range data based on the filtered range vertices; obtaining range data based on the updated initial range data; and determining all nodes, point-edge relationships, and target attack paths from the range data; then, determining the attacking node and target node based on the target attack path.Next, the node traversal process is executed in parallel, starting from the attacking node and the target node. During the node traversal, the first node is obtained, and the second node is determined based on the node-edge relationship of the first node. The hash relationship between the first and second nodes is then determined based on the node-edge relationship. When the hash relationship indicates that the first node is unidirectionally connected to the second node, the node name of the first node is used as the first hash parameter, and the node name of the second node is used as the second hash parameter. A first sequential hashing process is then performed on the first and second hash parameters to obtain the first node-edge hash value, which is used as the node-edge hash value between the first and second nodes. When the hash relationship indicates that the second node is unidirectionally connected to the first node, a second sequential hashing process is performed on the second and first hash parameters to obtain the second node-edge hash value, which is used as the node-edge hash value between the first and second nodes. When the hash relationship indicates that the first node is unidirectionally connected to the first node, a second sequential hashing process is performed on the second and first hash parameters to obtain the second node-edge hash value, which is used as the node-edge hash value between the first and second nodes. In bidirectional connections, the hash values ​​of the first and second nodes are used as the hash values ​​of the edges between the first and second nodes. Based on these hash values, topological structured data between the first and second nodes is obtained. This topological structured data is then compared with multiple hash values ​​in the Bloom filter to obtain query results. If the query results indicate that the Bloom filter contains hash data consistent with the topological structured data, the topological structured data is discarded. If the query results indicate that the Bloom filter does not contain hash data consistent with the topological structured data, the topological structured data is saved and added to the Bloom filter as new hash data. The second node is then used as the first node for the next node traversal until the traversal is complete. The initial values ​​of the first node are the attack node and the target node. During all node traversals, each edge relationship is traversed no more than twice. Finally, the target network range corresponding to the network range is generated based on all the topological structured data.

[0148] This application embodiment starts by obtaining the target attack path determined in the target network range description data, identifies the attack node and target node, and further performs parallel traversal from the attack node and target node. This eliminates the need for inefficient full graph traversal or reliance on manual user construction in traditional techniques, significantly improving the construction efficiency of large-scale, complex network ranges. Furthermore, during the traversal process, complex point-edge relationships are fragmented and atomized into standard topological structured data, and combined with real-time deduplication, ensuring that each valid network connection is processed only once. This fundamentally solves the problem of low reproducibility caused by manual configuration or heterogeneous data sources, guaranteeing consistent conversion results. This approach ensures determinism and consistency, and also makes the atomic topology-structured data highly reusable, effectively improving the construction efficiency and reproducibility of network ranges. This lays a solid foundation for the rapid combination and dynamic adjustment of future ranges, thus effectively addressing the ever-expanding demands of network range simulation scale and capabilities. Furthermore, by introducing network topology code as an input source and elevating network definition from traditional manual drawing and static configuration to a precise, programmable software engineering practice, it solves the problem of low reproducibility caused by the uncertainty of manual operations. Because the same code will inevitably generate the same topology, it guarantees the determinism and consistency of range construction, especially when facing large-scale and complex network ranges. Programmatic generation and definition via code far surpasses manual configuration in terms of construction efficiency, significantly shortening the target range preparation cycle. The code-based definition approach grants unprecedented flexibility and reusability to target range construction. Users can easily modularize and parameterize target range definitions and incorporate them into version control, enabling efficient iteration, sharing, and reuse. Furthermore, it fundamentally distinguishes three easily confused scenarios in traditional methods: "node A unidirectionally connects to node B," "node B unidirectionally connects to node A," and "node A and node B are interconnected." By generating unique and distinct edge hash values ​​for each scenario, it ensures no misjudgments occur during subsequent deduplication operations, greatly improving the accuracy and fidelity of the final generated topology. This ensures that the target network range can accurately reproduce user-defined network attack and defense scenarios with complex directional requirements. Furthermore, through a "classification-computation-encapsulation" process, diverse and complex point-edge relationships are deterministically transformed into a unified, concise, and unique topological structured data (whose core is the point-edge hash value). This solves the inconsistency problem caused by heterogeneous data sources and provides a solid and reliable data foundation for subsequent deduplication operations. Due to the determinism of hash calculation, the same connection always yields the same parameters, thus ensuring a high reproducibility rate in the range construction. At the same time, using compact hash values ​​for comparison greatly improves the execution efficiency of subsequent deduplication algorithms compared to comparing complex object structures.Furthermore, by introducing a Bloom filter as the core deduplication tool, its extremely low time complexity (constant time) and extremely high space efficiency enable the existence determination of topologically structured data to be completed almost instantaneously. This is crucial for handling the real-time deduplication requirements of large-scale network testbeds with millions of connections. It allows multiple concurrently executing traversal threads to safely and efficiently share the same Bloom filter instance for deduplication without the need for complex locking mechanisms that severely impact performance. This not only ensures extremely high construction efficiency and extremely low resource consumption at the algorithm level but also guarantees high concurrency and scalability at the system architecture level. It is a key technological guarantee for achieving rapid and automated construction of complex network testbeds.

[0149] This application also provides an electronic device, including:

[0150] At least one memory;

[0151] At least one processor;

[0152] At least one program;

[0153] The program is stored in a memory, and the processor executes the at least one program to implement the target network construction method for software-defined ranges described above. The electronic device can be any smart terminal, including mobile phones, tablets, personal digital assistants (PDAs), and in-vehicle computers.

[0154] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0155] The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0156] The memory 902 can be implemented in the form of ROM (Read-Only Memory), static storage device, dynamic storage device, or RAM (Random Access Memory). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the target network construction method for software-defined ranges in the embodiments of this application.

[0157] The input / output interface 903 is used to implement information input and output;

[0158] The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0159] Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904);

[0160] The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0161] This application embodiment also provides a storage medium, which is a computer-readable storage medium, storing a computer program that, when executed by a processor, implements the above-described target network construction method for software-defined ranges.

[0162] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0163] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0164] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0165] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0166] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0167] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0168] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0169] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. The coupling or direct coupling or communication connection between the shown or discussed units may be through some interfaces, or indirect coupling or communication connection between the apparatus or units, and may be electrical, mechanical, or other forms.

[0170] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0171] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0172] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0173] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for constructing target networks for software-defined ranges, characterized in that, include: Acquire target range data from the network target range, and determine all nodes, point-edge relationships, and target attack paths from the target range data; The attack node and target node are determined based on the target attack path; The node traversal process is executed in parallel starting from the attack node and the target node. During the node traversal, a first node is obtained, and a second node is determined based on the point-edge relationship of the first node. Topological structured data is constructed based on the first node, the second node, and the point-edge relationship, and the topological structured data is deduplicated. The second node is used as the first node for the next node traversal until the traversal is completed. The initial values ​​of the first node are the attack node and the target node. During all the node traversals, the number of traversals of each point-edge relationship is no more than two. Generate the target network range corresponding to the network range based on all the aforementioned topology-structured data; The process of constructing topologically structured data based on the first node, the second node, and the point-edge relationships includes: The hash relationship between the first node and the second node is determined based on the point-edge relationship between the first node and the second node; Based on the hash relationship, the first node, and the second node, generate the node-edge hash value between the first node and the second node; Based on the point-edge hash value, the topological structured data between the first node and the second node is obtained.

2. The target network construction method for software-defined ranges according to claim 1, characterized in that, The step of generating the edge hash value between the first node and the second node based on the hash relationship, the first node, and the second node includes: When the hash relationship represents a one-way connection between the first node and the second node, the node name of the first node is used as the first hash parameter, the node name of the second node is used as the second hash parameter, and a first sequential hashing process is performed on the first hash parameter and the second hash parameter to obtain a first point-edge hash value, and the first point-edge hash value is used as the point-edge hash value between the first node and the second node. When the hash relationship indicates that the second node is unidirectionally connected to the first node, the second hash parameter and the first hash parameter are subjected to a second sequential hashing process to obtain a second point-edge hash value, and the second point-edge hash value is used as the point-edge hash value between the first node and the second node. When the hash relationship indicates that there is a bidirectional connection between the first node and the second node, the hash value of the first node edge and the hash value of the second node edge are used as the hash value of the node edge between the first node and the second node.

3. The target network construction method for software-defined ranges according to claim 1, characterized in that, The deduplication operation on the topologically structured data includes: The topology-structured data is queried and detected against multiple hash data in the Bloom filter to obtain the query detection results; When the query detection result indicates that the Bloom filter contains hash data that is consistent with the topology structured data, the topology structured data is discarded. When the query detection result indicates that the Bloom filter does not contain hash data that is consistent with the topology-structured data, the topology-structured data is saved and added to the Bloom filter as new hash data.

4. The target network construction method for software-defined ranges according to claim 1, characterized in that, The acquisition of network target range data includes: Get the network topology code input by the user; Data analysis is performed on the network topology code to obtain the target range data.

5. The target network construction method for software-defined ranges according to claim 4, characterized in that, The process of performing data analysis on the network topology code to obtain the target range data includes: Based on the target range generation code in the network topology code, generate initial target range data; Based on the vertex subset code in the network topology code, multiple target range vertices in the initial target range data are generated; Based on the vertex filtering code in the network topology code, multiple target range vertices are filtered to obtain filtered target range vertices, and the initial target range data is updated based on the filtered target range vertices. The target range data is obtained based on the updated initial target range data.

6. The target network construction method for software-defined ranges according to claim 5, characterized in that, The vertex filtering code based on the network topology code filters multiple target range vertices to obtain filtered target range vertices, including: Based on the filtering conditions in the network topology code, a first filtering function and a second filtering function are generated. Based on the mapping conditions in the network topology code, a mapping function is generated; Based on the first filtering function, a first filtering is performed on multiple target range vertices to obtain first filtered target range vertices. Based on the mapping function, the first filtered target range vertices are mapped to obtain mapped filtered target range vertices. Then, based on the second filtering function, the mapped filtered target range vertices are filtered a second time to obtain second filtered target range vertices. The second filter target field vertex is processed by data transformation to obtain the filter target field vertex.

7. A target network construction system for software-defined ranges, characterized in that, The target network construction system for software-defined ranges is used to execute the target network construction method for software-defined ranges as described in claim 1, the system comprising: The northbound interface, control layer, southbound interface, and construction layer are connected in sequence. The northbound interface is used to obtain the network topology code input by the user and transmit the network topology code to the control layer; The control layer is used to acquire target range data of the network target range, and determine all nodes, point-edge relationships and target attack paths from the target range data; The control layer is also used to determine the attacking node and the target node based on the target attack path; The control layer is also used to execute a node traversal process in parallel, starting from the attack node and the target node. During the node traversal process, a first node is obtained, a second node is determined based on the point-edge relationship of the first node, topological structured data is constructed based on the first node, the second node and the point-edge relationship, and the topological structured data is deduplicated. The second node is used as the first node for the next node traversal, until the traversal ends. The initial values ​​of the first node are the attack node and the target node. During all the node traversals, the number of traversals of each point-edge relationship is no more than two. The control layer is also used to transmit all the topology structured data to the construction layer through the southbound interface; The construction layer is used to generate the target network range corresponding to the network range based on all the topology-structured data; The process of constructing topologically structured data based on the first node, the second node, and the point-edge relationships includes: The hash relationship between the first node and the second node is determined based on the point-edge relationship between the first node and the second node; Based on the hash relationship, the first node, and the second node, generate the node-edge hash value between the first node and the second node; Based on the point-edge hash value, the topological structured data between the first node and the second node is obtained.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the target network construction method for software-defined ranges as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the target network construction method for software-defined ranges as described in any one of claims 1 to 6.

Images