Network topology scene generation and simulation attack system based on AI

Abstract

The invention discloses a network topology generation and simulation attack system based on AI. The system comprises an AI topology generation module, a topology visualization module, a simulation attack module and a data storage module. The AI topology generation module calls a DeepSeek API, and generates a topology description containing equipment, IP and other information and a machine readable table according to user input; the topology visualization module extracts table data and draws a topological graph by using AI; the simulation attack module generates a new page and a database, and safe simulation attack can be carried out in the new page. According to the system, topology generation automation is realized, network security testing and teaching are facilitated, and efficiency and intuition are improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an AI-based network topology scene generation and simulated attack system. Background Technology

[0002] In network security testing, teaching, and related research, constructing network topologies and conducting attack simulations are crucial steps. Currently, traditional network topology construction methods largely rely on manual design, requiring staff to possess extensive network knowledge and experience to manually plan device types, IP addresses, subnetting, and inter-device connections. This process is tedious, time-consuming, and inefficient. Furthermore, manually constructed topologies may contain omissions, affecting the accuracy of subsequent attack simulations.

[0003] In terms of attack simulation, existing simulation tools have relatively limited functionality, mostly only capable of simulating specific types of attacks, and lack effective integration with network topology, making it impossible to intuitively conduct attack testing and vulnerability detection in specific topology environments. For example, some XSS attack simulation tools can only detect simple inputs and cannot be associated with specific network devices and topologies; SQL injection simulation tools also have similar problems, making it difficult to meet the security testing needs in complex network scenarios.

[0004] Furthermore, in existing technical solutions, network topology generation and attack simulation are often two independent steps, lacking a unified platform for integration. This requires staff to switch between different tools, increasing operational complexity and potentially leading to data inconsistencies, impacting work progress and testing results. Currently, there is no technology capable of automatically generating network topologies based on AI and then combining the generated topologies on a single platform to simulate various common network attacks and perform vulnerability detection. This fails to adequately meet the cybersecurity field's demand for efficient, convenient, and integrated tools. Summary of the Invention

[0005] This invention aims to address the technical problems in existing technologies, such as network topology construction relying on manual labor and low efficiency, attack simulation tools having limited functionality and poor integration with topology, and the separation of topology generation and attack simulation, which leads to complex operations. It provides an AI-based network topology generation and attack simulation system that enables automated generation and visualization of network topologies. Furthermore, it combines the generated topologies on the same platform to perform attack simulations and vulnerability detection, such as XSS and SQL injection, thereby improving the efficiency and convenience of network security testing, teaching, and research.

[0006] The AI-based network topology generation and simulated attack system of the present invention mainly includes an AI topology generation module, a topology visualization module, a simulated attack module, and a data storage module. These modules work together to achieve integrated network topology generation and simulated attack functionality. The specific technical solution is as follows:

[0007] 1. AI Topology Generation Module: This module is based on the Flask framework and automatically generates network topology by calling the DeepSeek API. First, the module includes a built-in system prompt, explicitly requiring the AI, acting as a network topology expert, to generate a textual description of the network topology based on the user's input. This description includes information such as devices, IP addresses, subnets, roles, connectivity relationships, and security policies. A machine-readable table in a specific format is appended at the end of the text, containing fields for device name, IP address, role / function, and subnet.

[0008] When a user inputs network topology-related requirements on the front-end page (e.g., "Generate an enterprise intranet topology including a web server, database server, and firewall"), the module uses the user input as a prompt and constructs a request message together with the system prompt. Next, the module sets the request header, including Authorization information (based on the DeepSeek API key) and Content-Type as application / json. Simultaneously, it constructs the request payload, specifying the AI ​​model used as "deepseek-chat," setting the temperature parameter to 0.2 to ensure the stability of the generated results, setting the maximum number of tokens to 1024, and disabling streaming output. Subsequently, the module sends a POST request to the DeepSeek API. If the request succeeds (status code 200), it retrieves the network topology description text returned by the API; if the request fails, it returns an error message, including the status code and error details.

[0009] 2. Topology Visualization Module

[0010] This module extracts device information from the topology description text obtained by the AI ​​topology generation module and draws a visualized network topology diagram. First, the module uses regular expressions to search for the "[BEGIN_TABLE]" and "[END_TABLE]" tags in the topology description text, extracting the intermediate table data. If no table data is found, default device information is used (e.g., Web Server, IP 192.168.1.10, role: Web Server, subnet 192.168.1.0 / 24).

[0011] 3. For the extracted table data, the module skips the header row and processes the remaining rows. Using regular expressions with two or more spaces or tabs as delimiters, it splits each row into four parts: device name, IP address, role / function, and subnet, constructing a device information list. Next, the module generates connection relationships between devices based on the device information list, by default establishing a connection between the first device and all other devices.

[0012] Then, the module uses the networkx library to build an undirected graph, adding each device as a node in the graph and the generated connections as edges.

[0013] 4. Simulated Attack Module

[0014] This module will generate a new page and a temporary database based on the topology scenario. Users can simulate attacks on the temporary database in the new page and save the attack process in the form of logs in a file for later analysis.

[0015] Beneficial effects

[0016] 1. Automated topology generation: This invention uses an AI topology generation module to call the DeepSeek API and automatically generate network topology descriptions and device table data based on user input. This eliminates the need for manual design, greatly reducing the workload of staff, improving topology generation efficiency, avoiding omissions that may occur during manual operation, and ensuring the accuracy of topology information.

[0017] 2. Intuitive topology visualization: The topology visualization module transforms the extracted device information into a visual network topology diagram, clearly displaying device names, IP addresses, roles, subnets, and connections between devices. Staff can intuitively understand the network topology, facilitating subsequent attack simulation planning and network security analysis. Especially in network security teaching, it can help students better understand network architecture.

[0018] 3. Comprehensive and topology-aligned attack simulation capabilities: It provides attackers with a secure target environment for attack and research, and the attack simulation is highly integrated with the topology, which can more realistically simulate attack scenarios in the actual network environment and improve the effectiveness of security testing.

[0019] 4. Enhanced Convenience Through an Integrated Platform: This invention integrates AI topology generation, topology visualization, simulated attacks, and data storage into a single system. Staff do not need to switch between multiple tools; they can complete topology generation, viewing, and attack simulation operations through a unified front-end interface. This reduces operational complexity and improves work convenience. At the same time, the data storage module ensures the persistence of topology information, facilitating subsequent retrieval and analysis. Attached Figure Description

[0020] Figure 1 This is a diagram illustrating the architecture of an AI-based network topology generation and attack simulation system according to an embodiment of the present invention.

[0021] Figure 2 This is a general flowchart of the system flow relationships in an embodiment of the present invention;

[0022] Figure 3 This is a flowchart illustrating the workflow of the AI ​​topology generation module in an embodiment of the present invention.

[0023] Figure 4 This is a flowchart illustrating the workflow of the topology visualization module in an embodiment of the present invention.

[0024] Figure 5 This is a flowchart illustrating the workflow of the simulated attack module. Detailed Implementation

[0025] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings.

[0026] like Figure 1 This presentation showcases the overall architecture and core components of an AI-based network topology generation and attack simulation teaching system. The system utilizes the Flask framework to build a web application and integrates the DeepSeek AI API to achieve intelligent network topology generation. The system comprises four core parts: a topology generation module, an attack simulation engine, a visualization component, and a database management module. The topology generation module uses natural language processing to process user-input network scenario descriptions, calls the DeepSeek API to generate structured network topology data containing device names, IP addresses, roles, and subnet information, and automatically draws a visualized topology diagram. The attack simulation engine provides simulation capabilities for two main attack types: Cross-Site Scripting (XSS) attacks and SQL injection attacks. It includes a vulnerability detection rule base and an attack execution simulator, capable of real-time analysis of attack payloads and identification of various attack characteristic patterns. The visualization component uses NetworkX and Matplotlib to render topology graphics, supports detailed device annotations and connection relationship display, and provides real-time viewing of attack logs and visualization of database content. The database management module uses SQLite to store device information, attack logs, and simulation data tables, supporting automatic generation of topology-related data and persistent storage of attack records. The modules communicate with each other through a unified data interface, forming a complete closed loop for network attack and defense teaching demonstrations, providing an intuitive and interactive platform for network security education.

[0027] like Figure 2This system adopts a modular design, with five core functional modules tightly integrated through data flow. After receiving user input, the AI ​​topology generation module calls the DeepSeek API to generate a network topology description and extract device information; the topology visualization module converts structured data into network graphs and renders them as visual images; the simulated attack module performs XSS and SQL injection security checks and records attack logs in real time; and the data storage module serves as the system's data hub, uniformly managing device information, attack records, and business data. All modules communicate efficiently through standardized interfaces, forming a complete workflow from network planning to security testing, providing users with an integrated network topology generation and attack / defense simulation solution.

[0028] like Figure 3 The topology visualization module receives structured device data from the AI ​​topology generation module. First, it constructs a network graph model using the NetworkX library, treating devices as nodes and connections as edges. Then, it uses Matplotlib for graphical rendering, creating detailed labels for each node that include device name, IP address, role / function, and subnet information. Finally, it converts the generated topology graph into Base64 encoded image data and returns it to the front-end interface for display, automatically adjusting the layout to ensure a clear and aesthetically pleasing visualization, providing an intuitive network structure reference for subsequent attack simulations.

[0029] like Figure 4 After receiving the attack request and parameters from the front-end interface, the simulated attack module first activates the corresponding detection engine based on the attack type (XSS or SQL injection): For XSS attacks, the module scans the input content for malicious script patterns, including... <script>标签、事件处理器和JavaScript危险函数；对于SQL注入攻击，则检测查询语句中的UNION SELECT、DROP、DELETE等危险操作符和系统表访问行为。检测到漏洞后，模块会在受控环境中执行相应的攻击模拟，同时将攻击详情、时间戳和结果记录到数据存储模块的日志系统中，最后将包含漏洞信息和执行结果的完整报告返回给前端界面展示，为安全分析提供实时反馈。

[0030] 如图5，模拟攻击模块从前端界面接收攻击请求和参数后，首先根据攻击类型(XSS或SQL注入)启动相应的检测引擎：对于XSS攻击，模块扫描输入内容中的恶意脚本模式，包括<script>标签、事件处理器和JavaScript危险函数；对于SQL注入攻击，则检测查询语句中的UNION SELECT、DROP、DELETE等危险操作符和系统表访问行为。检测到漏洞后，模块会在受控环境中执行相应的攻击模拟，同时将攻击详情、时间戳和结果记录到数据存储模块的日志系统中，最后将包含漏洞信息和执行结果的完整报告返回给前端界面展示，为安全分析提供实时反馈。

[0031] 以下进一步说明。

[0032] 1、Flask Web应用框架模块

[0033] 功能职责：提供统一的Web用户界面，处理HTTP请求和路由分发，协调各模块间的数据流转，渲染前端模板页面。包含组件：主页面路由( / )：处理拓扑生成请求，攻击页面路由( / attack)：提供攻击模拟界面，设备页面路由( / device / :id)：展示特定设备攻击页面，XSS攻击接口( / simulate_xss)：处理XSS攻击模拟，SQL注入接口( / simulate_sql_injection)：处理SQL注入攻击模拟，日志查看路由( / attack_logs)：显示攻击日志，数据库视图路由( / database_view)：展示数据库内容。

[0034] 2、AI拓扑生成模块

[0035] AI拓扑生成模块承担着调用DeepSeek API实现智能拓扑生成的核心职责。该模块主要负责构建系统提示词和处理用户请求，通过精心设计的提示词工程确保生成内容符合技术要求。在功能实现上，模块需要处理完整的API交互流程，包括请求发送、响应接收和数据解析等关键环节。

[0036] 该模块的核心函数包括generate_topology()主生成函数，该函数统筹整个拓扑生成过程。系统提示词构建函数专门负责定义AI角色和输出格式要求，确保生成的拓扑描述符合标准化规范。API请求构建函数负责设置请求头和payload参数，为API调用提供完整的技术支持。响应处理函数则专注于提取和清理拓扑描述文本，从API返回结果中提炼出可用的拓扑信息。

[0037] 在技术特性方面，该模块采用temperature＝0.2的参数设置来保证生成内容的稳定性和一致性，避免输出结果的随机性。系统支持最大1024令牌的输出长度，确保能够生成足够详细和完整的拓扑描述。此外，模块具备自动提取机器可读表格数据的能力，能够从生成的文本中智能识别并解析出结构化的设备信息表，为后续的可视化处理提供数据基础。整个模块通过精心设计的算法流程，实现了从自然语言描述到结构化网络拓扑的高效转换。

[0038] 3、拓扑可视化模块

[0039] 拓扑可视化模块承担着从AI响应中提取设备信息、生成设备间连接关系以及创建可视化网络拓扑图的重要职责。该模块通过extract_devices_with_info()函数实现设备信息的精准提取，利用extract_connections()函数自动生成设备间的逻辑连接关系，并借助draw_topology_with_details()函数完成拓扑图形的最终绘制。在技术实现层面，模块采用正则表达式解析技术从原始响应文本中提取结构化的表格数据，基于NetworkX图论库构建完整的网络图形数据结构，结合Matplotlib可视化库生成高质量的拓扑示意图，最后通过Base64编码技术将生成的图像数据转换为可在前端直接展示的格式，实现了从数据解析到图形展示的完整可视化流程

[0040] 4、模拟攻击模块

[0041] 攻击模拟模块承担着执行XSS攻击检测和模拟、执行SQL注入攻击检测和模拟以及分析攻击结果和漏洞影响的重要职责。该模块在XSS攻击检测方面具备全面的检测能力，包括对<script>标签的精准识别、对onerror和onload等事件处理器的检测、对JavaScript协议的识别，以及对Cookie和Location访问行为的监控。在SQL注入检测方面，模块能够有效识别UNION SELECT语句、检测语句闭合特征、发现DROP和DELETE等危险操作、识别各种注释符的使用，并对系统表访问行为进行监控，从而构建起多层次、全方位的安全防护检测体系。

[0042] 5、数据存储模块

[0043] 数据管理模块承担着管理系统运行数据的核心职责，具体包括管理SQLite数据库、存储拓扑配置信息、维护攻击日志记录以及生成模拟测试数据等重要功能。该模块通过设备信息的持久化存储确保系统数据的长期保存，采用JSON格式进行拓扑数据缓存以提升访问效率，支持临时数据库表的动态生成满足各类测试需求，并完整记录攻击结果数据用于后续分析和审计。整个模块构建了完善的数据管理体系，为系统的稳定运行和数据分析提供了可靠的数据支撑。

[0044] 6、日志管理模块

[0045] 日志管理模块负责全面记录攻击模拟的全过程，并有效管理日志文件的存储、查询和清理操作。该模块采用结构化的攻击日志记录方式，确保每条日志都包含精确的时间戳和详细的上下文信息。通过同时采用文件系统和数据库进行双重存储，既保证了日志数据的安全性，又提供了灵活的访问方式。模块还支持实时日志查看功能，方便用户即时监控系统运行状态和攻击模拟结果，同时提供了完善的日志清理机制，确保系统能够长期稳定运行。< / script>

Claims

1. An AI-based network topology scenario generation and simulated attack system, characterized in that, It includes an AI topology generation module, a topology visualization module, a simulated attack module, and a data storage module. These modules work together to achieve integrated network topology generation and simulated attack functions. The AI ​​topology generation module is based on the Flask framework and automatically generates network topology by calling the DeepSeek API. The topology visualization module is used to extract device information from the topology description text obtained by the AI ​​topology generation module and draw a visualized network topology map.

2. The system as described in claim 1, characterized in that, The AI ​​topology generation module works as follows: First, the module has a built-in system prompt message that clearly requires the AI, as a network topology expert, to generate a text description of the network topology based on the user's input, including devices, IP addresses, subnets, roles, connection relationships, and security policies. At the end of the text, a machine-readable table in a specific format is appended, which includes device name, IP address, role / function, and subnet fields. When a user inputs their network topology requirements on the front-end page, such as "Generate an enterprise intranet topology including a web server, database server, and firewall," the module uses the user input as a prompt and constructs a request message along with the system prompt. Next, the module sets the request header, including Authorization information based on the DeepSeek API key and Content-Type as application / json. Simultaneously, it constructs the request payload, specifying the AI ​​model used as "deepseek-chat," setting the temperature parameter to 0.2 to ensure the stability of the generated results, setting the maximum number of tokens to 1024, and disabling streaming output. The module then sends a POST request to the DeepSeek API. If the request succeeds (status code 200), it retrieves the network topology description text returned by the API. If the request fails, an error message is returned, including the status code and error details.

3. The system as described in claim 1, characterized in that, The topology visualization module works as follows: First, the module uses regular expressions to search for the "[BEGIN_TABLE]" and "[END_TABLE]" tags in the topology description text and extracts the table data in between. If no table data is found, the default device information is used: Web Server, IP is 192.168.1.10, role is Web Server, and subnet is 192.168.1.0 / 24.

4. The system as described in claim 1, characterized in that, For the extracted table data, the data storage module skips the header row and processes the remaining rows. Using regular expressions with two or more spaces or tabs as delimiters, it splits each row into four parts: device name, IP address, role / function, and subnet, constructing a device information list. Next, the module generates connections between devices based on the device information list, establishing a connection between the first device and all other devices by default. The module uses the networkx library to construct an undirected graph, adding each device as a node and the generated connections as edges.

5. The system as described in claim 1, characterized in that, The simulated attack module will generate a new page and a temporary database based on the topology scenario. Users will simulate attacks on the temporary database on the new page, and the attack process will be saved in a file in the form of logs for subsequent analysis.

Images