Harmless network attack validity testing method and system

Abstract

The embodiment of the invention provides a harmless network attack validity testing method and system, and relates to the technical field of network information security. The method comprises the following steps: instantiating a session identifier for a drill target device, and embedding a preset uniform resource locator and the session identifier in a self-defined data section area of a section table; after executing the standard client load, the drill target device may extract a session identifier and generate a full-screen graphic overlay. And the external equipment sends a network request to the analysis server by scanning a feedback identification code in the full-screen graphic coverage layer, so that the analysis server aggregates the terminal event data and generates an evaluation report. The method does not depend on the network capability of the drilling target device any more, the two-dimensional code is used as an information carrier, the data return action is transferred to the external device, an information channel which is not limited by the network environment of the drilling target device is constructed, and the accuracy of the network security drilling result is improved.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a method and system for testing the effectiveness of harmless network attacks. Background Technology

[0002] Cyberattacks refer to attacks that use methods such as ransomware and phishing emails to implant malicious programs into terminal devices or servers, thereby threatening information security. With the increasing diversification and complexity of cyberattack methods, ransomware and phishing emails have become major risks to enterprise information security. To improve security awareness and the ability to identify malicious software, regular cybersecurity drills can be organized.

[0003] Cybersecurity drills simulate cyberattacks to statistically analyze the cyberattacks suffered by terminal devices or servers, obtaining quantitative data, and then generating an evaluation report through data analysis. For example, simulating phishing email attacks involves sending emails with malicious links or executable program attachments to participating devices. The effectiveness of the drill is then assessed by counting the number of clicks on the links or the reporting behavior of the attached program actively connecting to a remote control server after execution.

[0004] However, the aforementioned cybersecurity drills are highly dependent on the network environment, requiring participating devices to have internet access so that user information can be transmitted back to the statistics server after a user clicks a link or runs a program. In institutions that highly value security, such as those in the financial and energy sectors, terminal devices are often located in strictly isolated internal network environments, unable to access the external network. This makes it impossible to deploy the drill methods in such isolated environments, or to obtain accurate and valid data, thus reducing the accuracy of the drill results. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method and system for testing the effectiveness of harmless network attacks, in order to solve the problem of low accuracy of network security exercise results.

[0006] According to a first aspect of this application, a method for testing the effectiveness of harmless network attacks is provided, applied to an analysis server, the method comprising: To instantiate a session identifier for the target device in the exercise, the session identifier is a globally unique identifier; The binary structure of the standard client payload is programmatically reconstructed to inject custom data sections into the section table of the standard client payload; The key metadata of the preset Uniform Resource Locator and the session identifier are embedded in the custom data section so that after the standard client payload is executed by the target device of the exercise, a full-screen graphical overlay is generated based on the session identifier; the full-screen graphical overlay includes a feedback identification code generated based on the preset Uniform Resource Locator. Receive network requests sent by external devices, wherein the external device is a terminal device connected to a public network; the network request is a request generated by the external device by scanning the feedback identification code; The system aggregates terminal event data from the target device in the exercise based on the network request, and generates an evaluation report based on the terminal event data.

[0007] In some embodiments, the binary structure of the standard client payload is programmatically reconstructed to inject custom data sections into the section table of the standard client payload, including: Obtain a portable executable PE file with standard client payload; Read the section table of the PE file; The injection location is found in the section table, where the injection location is a data section in the section table whose data space is greater than or equal to a preset space threshold; the preset space threshold is set according to the session identifier and the preset Uniform Resource Locator. Add a new section entry to the section table according to the injection location to inject the custom data section into the section table.

[0008] In some embodiments, embedding key metadata of a preset Uniform Resource Locator (URL) and the session identifier into the custom data section includes: Obtain the network address of the analysis server in the public network; Generate a Uniform Resource Locator (URL) based on the network address to obtain a preset URL; Extract key metadata from the session identifier; A traceable digital watermark is generated based on the preset Uniform Resource Locator and the key metadata. The traceable digital watermark is embedded in the custom data section to form a standard client payload with the traceable digital watermark embedded.

[0009] In some embodiments, aggregating terminal event data of the target device in the exercise based on the network request includes: Read the session identifier from the network request; Verify the validity of the session identifier; If the session identifier is verified to be valid, a service unlock key is obtained, which is an unlock key deterministically derived from the session identifier. The service unlock key is sent to the external device. The service unlock key is used to enable the target device to perform key comparison verification locally and release the full-screen graphics overlay by executing a preset cleanup routine.

[0010] In some embodiments, aggregating terminal event data of the target device in the exercise based on the network request includes: Invoke the execution state machine model; The execution state machine model is used to track key events throughout the entire lifecycle of the standard terminal payload. These key events include payload execution success events, data return success events, unlock success events, terminal interception events, and session timeout events. The key events of multiple target devices in the exercise are aggregated to generate the terminal event data.

[0011] In some embodiments, generating an evaluation report based on the terminal event data includes: Get the assessment report template; Read the event statistics dimensions from the assessment report template; According to the aforementioned event statistics dimensions, the key events in the terminal event data are statistically analyzed to generate event statistics results; the event statistics results include one or more combinations of initial vector success rate, average threat response time, comprehensive technical protection effectiveness, and security awareness level; A precise data profile is generated based on the event statistics. This precise data profile is used to characterize the comprehensive anti-attack capability of the target device in the exercise across multiple dimensions.

[0012] According to a second aspect of this application, a method for testing the effectiveness of harmless network attacks is provided, applied to a target device in a training exercise, the method comprising: The standard client payload is executed, and the section table of the standard client payload is programmatically reconstructed through a binary structure and injected into a custom data section. The custom data section embeds key metadata such as preset Uniform Resource Locators and session identifiers. The session identifier is a globally unique identifier instantiated by the analysis server for the target device in the exercise. Perform introspection using the standard client payload to extract key metadata of the session identifier from the standard client payload; A full-screen graphical overlay is generated based on the session identifier, and the full-screen graphical overlay includes a feedback identification code generated based on the preset Uniform Resource Locator. By calling the underlying graphics device interface, the full-screen graphics overlay is displayed with the highest priority, so that external devices can send network requests to the analysis server by scanning the feedback identification code; the external devices are terminal devices connected to public networks; the analysis server is configured to aggregate terminal event data of the target device in the exercise based on the network request, and generate an evaluation report based on the terminal event data.

[0013] In some embodiments, the method further includes: The device unlock key is deterministically derived based on the session identifier; Obtain the service unlock key input by the user based on the full-screen graphics overlay. The service unlock key is an unlock key derived by the analysis server based on the session identifier after verifying the validity of the session identifier read from the network request. The device unlock key is used to verify the service unlock key in order to generate an unlock verification result; Execute a preset cleanup routine based on the unlock verification result.

[0014] In some embodiments, a preset cleanup routine is executed based on the unlock verification result, including: Read the unlock verification result; If the unlock verification result is that the key matches, the preset cleanup routine is executed to release the graphics resources and system hooks corresponding to the full-screen graphics overlay layer; Terminate the execution process of the standard client payload to restore the terminal environment to its initial state.

[0015] According to a third aspect of this application, a harmless network attack effectiveness testing system is provided, the system comprising: an analysis server, a target device for the exercise, and external devices, wherein the external devices and the analysis server are connected to a public network; The analysis server is configured to: instantiate a session identifier for the target device of the exercise, wherein the session identifier is a globally unique identifier; programmatically reconstruct the binary structure of the standard client payload to inject a custom data section into the section table of the standard client payload; and embed the key metadata of the preset Uniform Resource Locator and the session identifier into the custom data section. The target device for the exercise is configured to: execute the standard client payload; perform introspection through the standard client payload to extract key metadata of the session identifier from the standard client payload; generate a full-screen graphical overlay based on the session identifier, the full-screen graphical overlay including a feedback identification code generated according to the preset Uniform Resource Locator; and display the full-screen graphical overlay with the highest priority by calling the underlying graphics device interface. The external device is configured to: generate a network request by scanning the feedback identification code; and send the network request to the analysis server. The analysis server is also configured to: receive network requests sent by external devices; aggregate terminal event data of the target device in the exercise based on the network requests; and generate an evaluation report based on the terminal event data.

[0016] According to a fourth aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described method for testing the effectiveness of harmless network attacks.

[0017] According to a fifth aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described method for testing the effectiveness of harmless network attacks.

[0018] By employing the above technical solutions, embodiments of this application provide a method and system for testing the effectiveness of harmless network attacks. The method instantiates a globally unique session identifier for the target device through an analysis server and programmatically reconstructs the binary structure of the standard client payload, embedding a preset Uniform Resource Locator (URL) and session identifier into a custom data section of the section table. After executing the standard client payload, the target device can extract the session identifier from it. A full-screen graphical overlay is then generated based on the session identifier and displayed with the highest priority. An external device then sends a network request to the analysis server by scanning the feedback identification code in the full-screen graphical overlay, enabling the analysis server to aggregate terminal event data and generate an evaluation report. This method no longer relies on the network capabilities of the target device but utilizes QR codes as information carriers to transfer data feedback to external devices, constructing an information channel unrestricted by the target device's network environment and improving the accuracy of network security exercise results.

[0019] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A schematic diagram of the network security drill equipment provided in this application embodiment; Figure 2 A schematic flowchart of the method for testing the effectiveness of harmless network attacks on the analysis server side, provided in an embodiment of this application. Figure 3 This is a schematic diagram of the key distribution process provided in an embodiment of this application; Figure 4 A schematic flowchart of the method for testing the effectiveness of harmless network attacks on the target device side in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a harmless network attack effectiveness testing system provided in an embodiment of this application. Detailed Implementation

[0021] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0022] In this embodiment, the method for testing the effectiveness of harmless network attacks can be used to conduct network security drills. Network security drills can simulate network attacks against electronic devices such as terminal devices and servers, and analyze the response results of different electronic devices to these attacks to determine the overall resistance capability of electronic devices to network attacks.

[0023] The aforementioned cyberattacks refer to attacks that use methods such as ransomware and phishing emails to implant malicious programs into electronic devices such as terminal devices and servers, thereby threatening the information security of electronic devices. Since cyberattacks can include methods such as ransomware and phishing emails, during cybersecurity drills, harmless ransomware or phishing emails can be created to implant simulated malicious programs into electronic devices.

[0024] In some embodiments, such as Figure 1 As shown, cybersecurity drills can simulate cyberattacks to statistically analyze the cyberattacks suffered by terminal devices or servers, obtain quantitative data, and then generate an evaluation report by analyzing the quantitative data. During the execution of cybersecurity drills, electronic devices implanted with simulated attack programs are the targets of the drills and can be referred to as drill target devices. For example, the drill target devices may include, but are not limited to, computers, servers, mobile terminals, smart wearable devices, and industrial control machines.

[0025] Electronic devices that generate and maintain simulated attack programs can act as servers to analyze quantitative data on network attacks, and are therefore referred to as analysis servers. For example, analysis servers can include, but are not limited to, servers, industrial control computers, and server clusters.

[0026] In some embodiments, other electronic devices may be used for auxiliary operations during cybersecurity drills. These auxiliary electronic devices are external to the target device and can therefore be referred to as external devices. For example, external devices may include, but are not limited to, mobile terminals and wearable devices.

[0027] During cybersecurity drills, all or some of the electronic devices used can establish communication connections. For example, the target device can establish a communication connection with an analysis server via the internet. Similarly, external devices can also establish communication connections with the analysis server.

[0028] Taking a simulated phishing email attack as an example, during a cybersecurity exercise simulating a phishing email attack, the analysis server can send emails with malicious links or executable program attachments to the participating devices via the Internet of Things. The server then counts the number of clicks on the links or the reporting behavior of the attached program actively connecting to the remote analysis server after execution to evaluate the effectiveness of the exercise.

[0029] However, the aforementioned cybersecurity drills are highly dependent on the network environment of the target devices, requiring them to have internet access so that user information can be transmitted back to the analysis server after a user clicks a link or runs a program. In institutions that highly value security, such as those in the financial and energy sectors, target devices are located in strictly isolated internal network environments and cannot access public networks. This makes it impossible to deploy the drill methods in isolated internal network environments, or to obtain accurate and valid data, thus reducing the accuracy of the drill results.

[0030] To address the issue of low accuracy in network security drill results, some embodiments of this application provide a method for testing the effectiveness of harmless network attacks. This method can simulate attack scenarios with high fidelity without relying on the network environment of the target device, and can accurately evaluate the drill effect, thus achieving precise drills for network attacks.

[0031] The method can be applied to an analysis server. For ease of description, the analysis server is used as the execution subject of the method in this embodiment. It should be understood that the method can also be applied to other types of execution subjects, which will not be shown one by one in this embodiment. Figure 2 As shown, the method includes: S101, Instantiate a session identifier for the target device in the exercise.

[0032] During the exercise initialization phase, the analysis server can instantiate a globally unique Session Identifier (SID) for each exercise target device. This SID, as a globally unique identifier, can be used to personalize and inject watermarks into standard client payloads.

[0033] In some embodiments, to instantiate a session identifier, the analysis server can perform authentication, specifically authentication of the user using the target device in the exercise. To do this, the analysis server can first obtain the device information of the target device reported by the user, extract the user's identity information from the device information, and then interact with the authentication server to verify the user's identity information, ensuring that only legitimate users can obtain the session identifier.

[0034] After authentication, the analysis server can generate a session identifier based on the device information. During the generation process, algorithms such as secure random number generation can be used to produce a unique and secure session identifier. The generated session identifier can be stored on the analysis server's storage medium and associated with the target device for use in subsequent exercises.

[0035] S102. Programmatically reconstruct the binary structure of the standard client payload to inject custom data sections into the section table of the standard client payload.

[0036] After generating the session identifier, the analysis server can programmatically reconstruct the binary structure of the standard client payload to inject custom data sections into the standard client payload's section table. The standard client payload refers to the application used to simulate a network attack, and it can have different application formats depending on the operating environment. For example, when the target device is a computer, the standard client payload is an EXE file; while when the target device is a mobile terminal such as a smartphone, the standard client payload is an APK file.

[0037] In some embodiments, the standard client payload can be a standalone application. For example, the standard client payload is a standalone application used to simulate ransomware. When the standard client payload is run on a target device such as a computer, an application simulating ransomware can be implanted into the target device to perform network attack exercises.

[0038] In some embodiments, the standard client payload can also be obtained by modifying other applications. For example, the standard client payload may appear to be a multimedia playback application, but a plug-in capable of simulating ransomware is embedded within it. When the target device runs the multimedia playback application, the ransomware-simulating plug-in also runs synchronously, performing a network attack exercise.

[0039] To programmatically reconstruct the binary structure of the standard client payload, the analysis server can inject a custom data section into the section table of the standard client payload using Portable Executable (PE) file format parsing technology. The PE file format is an executable file format used in the Windows operating system. The PE file format contains a section table, which is a key part describing the code sections, data sections, and other sections in the file. Each section has its own attributes, such as size, offset, and access permissions.

[0040] Therefore, in some embodiments, when performing a programmatic reconstruction of the binary structure of the standard client payload to inject custom data sections into the section table of the standard client payload, the portable executable PE file of the standard client payload can be obtained first, and the section table of the PE file can be read. Custom data sections are injected into the section table by finding the injection location in the section table and adding section entries according to the injection location. The injection location is a data section in the section table whose data space is greater than or equal to a preset space threshold, and the preset space threshold can be set according to the session identifier and a preset Uniform Resource Locator (URL) identifier.

[0041] For example, during programmatic refactoring, PE file viewing and editing tools such as PE-Tools, OllyDbg, PE Explorer, and custom tools can be used to analyze the PE file of the standard client payload to determine the file structure, including the contents of the section table and information such as the offset, size, and permissions of each section. Then, a preset space threshold is set based on the session identifier (or key metadata of the session identifier) ​​and the data space required by the preset Uniform Resource Locator. Finally, based on the preset space threshold, data sections in the section table with data space greater than or equal to the preset space threshold are searched and used as injection locations.

[0042] When the data space of all data sections in the section table is less than the preset space threshold, a new section can be added at the end of the file as the injection location. Obviously, the data space corresponding to the new section needs to be greater than or equal to the preset space threshold in order to accommodate the session identifier (and the preset Uniform Resource Locator).

[0043] Once the injection location is determined, the analysis server can inject custom data sections by modifying the section table. Specifically, the analysis server can increase the number of sections by modifying the "Number of Sections" field in the PE file header, adding a new section entry to the section table. Furthermore, appropriate attributes can be set for the new section, including section name, virtual address, size (Misc.Virtual Size), and file offset (Pointer To Raw Data), to ensure these attributes are compatible with the target file structure.

[0044] By modifying the section table, the analysis server can also allocate storage space for the newly added sections, that is, allocate sufficient space for the new sections in the PE file. If you choose to add new sections at the end of the PE file, you can directly append data to the end of the file to form custom data sections.

[0045] S103. Embed the key metadata of the preset Uniform Resource Locator and Session Identifier into a custom data section.

[0046] After injecting custom data sections into the section table of the standard client payload, the analysis server can embed key metadata of preset Uniform Resource Locators (URIs) and session identifiers into the custom data sections to form a standard client with embedded session identifiers and URIs.

[0047] In some embodiments, when the analysis server performs the process of embedding key metadata of a preset Uniform Resource Locator (URI) and a session identifier into a custom data section, it can obtain the network address of the analysis server in the public network and generate a URI based on the network address to obtain the preset URI.

[0048] For example, after injecting a custom data section into the analysis server, the IP address of the network interface on the public network can be obtained using command-line tools such as `ifconfig` or `ip addr`. After determining the port number and path, the complete URL information can be constructed. For instance, for a server with IP address 192.168.×.×××, running an HTTP service on the default port 80, and containing an `index.html` file in its root directory, the generated Uniform Resource Locator (URL) URL could be `http: / / 192.168.×.××× / index.html`, thus obtaining the default URL.

[0049] After obtaining the preset Uniform Resource Locator (URI), the analysis server can extract key metadata from the session identifier. This key metadata refers to metadata within the session identifier related to the network attack exercise process; for example, it may include the session identifier itself, creation time, user information, session state, and security information. A traceable digital watermark is then generated based on the preset URI and the key metadata. This traceable digital watermark is then embedded into a custom data section, forming a standard client payload with an embedded traceable digital watermark.

[0050] For example, after obtaining key metadata such as a preset URL and session identifier, a hash algorithm can be applied to hash the URL and key metadata to obtain a hash value. This hash value is then encrypted to obtain an encrypted hash value, which is combined with traceability information such as user ID and timestamp to form a digital watermark. By encrypting the digital watermark, a traceable digital watermark can be obtained. This traceable digital watermark is then embedded into a custom data section, embedding key metadata containing a preset Uniform Resource Locator (Uniform Resource Locator) and the SID into the custom data section. Each client payload produced ultimately has the same function but embeds a unique traceable digital watermark, providing a foundation for subsequent individual behavior attribution analysis.

[0051] A standard client payload with an embedded traceable digital watermark can be transmitted to the target device in the exercise via email or other offline means. The target device can then execute the standard client payload in response to user interaction. After execution by the target device, the standard client payload generates a full-screen graphical overlay based on the session identifier. This full-screen graphical overlay includes a feedback identification code generated based on a preset Uniform Resource Locator (URL).

[0052] For example, when the target user executes the standard client payload, the standard client payload can enter an active state. By performing introspection, the standard client payload extracts pre-defined URLs, SID key metadata, and other content from its own PE file structure, and deterministically derives a session unlock key based on the SID. At this point, the standard client payload can instantiate a full-screen graphics overlay with top-most privileges by calling the underlying graphics device interface (GDI / GDI+), thereby shielding the target device's user desktop environment and all other application windows, thus constructing a high-fidelity coercive interaction scenario.

[0053] To establish a cross-domain data channel, the standard client payload can also encode and render a feedback identification code, such as a QR code, in real time based on the extracted URL and SID. The rendered QR code is then displayed in a designated area of ​​the full-screen graphics overlay. Essentially, the QR code is a parameterized Uniform Resource Locator (URL), which can form a one-way, cross-domain data channel connecting physically isolated training target devices (internal network terminals) with a public network analysis server, thus overcoming network limitations.

[0054] S104. Receive network requests sent by external devices.

[0055] After the target device displays a full-screen graphical overlay using a standard client payload, users can operate external devices to scan the feedback identification code within the overlay. These external devices are terminal devices connected to a public network, meaning they possess network access capabilities. By scanning the feedback identification code, the external device generates a network request and sends it to the analysis server via the public network, enabling the analysis server to receive the network request.

[0056] For example, during cybersecurity drills, user-mediated data return and key distribution can be employed. Users on the target device can use an external device with network access, such as a mobile terminal, to optically scan a QR code within a full-screen graphic overlay. During the optical scan, the mobile terminal can decode the URL and trigger a network request. This request uses the SID as a key parameter and is submitted via the public network to a data statistics platform on an analytics server, thus enabling precise recording of a single drill interaction event.

[0057] S105. Aggregate terminal event data of the target device based on network requests, and generate an evaluation report based on the terminal event data.

[0058] Upon receiving a network request from an external device, the analysis server can aggregate terminal event data from the target devices in the exercise based on the network request. Terminal event data refers to a set of data obtained by statistically analyzing the feedback network requests, reflecting the execution status of one or more target devices on the standard client payload.

[0059] To aggregate terminal event data, in some embodiments, the analysis server may invoke an execution state machine model when performing network request-based aggregation of terminal event data from target devices. An execution state machine model is a model used to describe system behavior and state transitions. It can be used to define system states, events, actions, and transitions between states. A state refers to a specific condition or situation of the system at a given moment. An event is an external or internal signal that triggers a state transition. An action is an operation performed during a state transition. A transition identifies the move from one state to another.

[0060] After invoking the execution state machine model, the analysis server can use it to track key events throughout the entire lifecycle of a standard terminal payload and generate terminal event data by aggregating key events from multiple target devices in the exercise. These key events include payload execution success, data return success, unlock success, terminal interception, and session timeout.

[0061] For example, to achieve refined exercise evaluation, the analysis server can employ an execution state machine model to define and track key events in the payload lifecycle. Payload execution success events are used to evaluate the effectiveness of email delivery, attachment avoidance, and social engineering rhetoric. Data return success events measure user behavior choices under duress and are a core indicator for assessing security awareness. Successful unlocking records events indicating that the user has completed the full response process. Endpoint interception events indicate that the endpoint protection system (EDR / AV) has successfully identified and blocked simulated attacks and are a direct indicator of technical protection capabilities. Session timeout events are system events that occur when a program automatically terminates after a preset time (e.g., 15 minutes). Session timeout events can be attributed to the user remaining highly vigilant and not interacting with the threat.

[0062] After aggregating terminal event data, the analysis server can generate an evaluation report based on the terminal event data. In other words, in order to achieve quantitative measurement and analysis of exercise effectiveness, the analysis server can aggregate terminal event data of all exercise objectives after the exercise is completed, perform multi-dimensional quantitative analysis, and generate an evaluation report.

[0063] In some embodiments, when the analysis server generates an assessment report based on terminal event data, it can first obtain an assessment report template and read the event statistical dimensions from the template. Then, according to the event statistical dimensions, it statistically analyzes the key events in the terminal event data to generate event statistical results. These event statistical results include one or more combinations of initial vector success rate, average threat response time, overall technical protection effectiveness, and security awareness level.

[0064] After generating event statistics, a precise data profile is generated based on the event statistics. This precise data profile is then used as the final output of the cybersecurity exercise. Therefore, the precise data profile can be used to characterize the comprehensive anti-attack capabilities of the target device in the exercise from multiple dimensions.

[0065] For example, the analytics server can calculate the initial vector success rate based on endpoint event data, that is, the percentage of Execution Success events out of the total number of events. It can also calculate the average threat response time, that is, the average time from an Execution Success event to an Unlock Success event, and determine the effectiveness of comprehensive technical protection based on Intercepted events, and determine the level of personnel security awareness based on Data Return Success and Timeout Exit events, providing enterprises with a precise data profile of their comprehensive anti-ransomware capabilities.

[0066] By applying the technical solutions of the above embodiments, the harmless network attack effectiveness testing method described in the above embodiments can provide a cross-domain, offline, user-mediated data return method. This method no longer relies on the network capabilities of the target device, but instead uses feedback identification codes such as QR codes as information carriers to transfer the data return action to the user's external device, constructing an information channel unrestricted by the network environment of the target device. This method can shift from a passive perspective dependent on the target device to an active perspective utilizing social engineering to encourage users to proactively transmit information, thus solving the fundamental problem of the inability to quantify the effectiveness of intranet environment drills.

[0067] The method can also achieve end-to-end automated drill processes using a standard client payload, a lightweight client program, and standardized web services. From generating personalized client payloads to locking the screen, guiding the user, collecting data, and issuing passwords, the entire process requires no manual intervention, significantly reducing the organizational costs and technical barriers to drills and improving evaluation efficiency.

[0068] In some embodiments, as a refinement and extension of the specific implementation of the above embodiments, and to fully illustrate the specific implementation process of this embodiment, some embodiments of this application also provide a method for testing the effectiveness of harmless network attacks. The difference between this method and the above embodiments lies in that, when aggregating terminal event data of the target device based on network requests, key distribution can be performed on the basis of user-mediated data feedback, thereby achieving session termination and environment restoration. For example... Figure 3 As shown, the method includes: S201. Read the session identifier from the network request; S202. Verify the validity of the session identifier; S203. If the session identifier is verified as valid, obtain the service unlock key; S204. Send the service unlock key to the external device.

[0069] To perform key distribution, upon receiving a network request, the analysis server can read the session identifier from the request and verify its validity. If the session identifier is confirmed to be valid, the service unlock key can be obtained. This service unlock key is a deterministically derived unlock key by the analysis server based on the session identifier.

[0070] For example, the analytics server can verify a SID based on whether the session time in the SID's key metadata falls within a preset time range. If the SID's session time is within the preset time range, the SID is considered valid. After verifying the SID's validity, it executes a key derivation algorithm consistent with the target device in the exercise to generate an unlocking key. Since this unlocking key is generated by the analytics server, it can be referred to as the service unlocking key for easy distinction. The service unlocking key is then distributed to the user's external device via an HTTP response.

[0071] The service unlock key can be used to enable the target device in the exercise to perform key comparison verification locally and release the full-screen graphics overlay by executing a preset cleanup routine. Correspondingly, after running the standard client payload and obtaining the session identifier, the target device can deterministically derive the unlock key based on the session identifier. Since this unlock key is generated by the target device, it can be referred to as the device unlock key for ease of distinction.

[0072] After obtaining the service unlock key generated by the analysis server through an external device, the user can input the service unlock key into the target device for the exercise based on the display content of the full-screen graphics overlay. Therefore, the target device for the exercise obtains the service unlock key input by the user based on the full-screen graphics overlay. The service unlock key is derived by the analysis server from the session identifier after verifying its validity from the network request.

[0073] The device unlock key is then used to verify the service unlock key to generate an unlock verification result, and a preset cleanup routine is executed based on the unlock verification result. In some embodiments, when the preset cleanup routine is executed based on the unlock verification result, the target device can read the unlock verification result. If the unlock verification result indicates a key match, that is, the input service unlock key matches the device unlock key generated by the target device, the preset cleanup routine can be executed to release the graphics resources and system hooks corresponding to the full-screen graphics overlay, thereby terminating the execution process of the standard client payload and restoring the terminal environment of the target device to its initial state.

[0074] For example, after obtaining the service unlock key through an external device such as a mobile terminal, the user can input the obtained service unlock key into the verification interface of the PC graphics overlay. The target device in the exercise can then complete the key comparison and verification locally through the standard client payload. Once the verification is successful, the standard client payload will execute a preset cleanup routine, safely releasing all graphics resources and system hooks, and terminating its own process, completely restoring the user terminal environment to its initial state and ensuring the harmlessness of the exercise.

[0075] By applying the technical solutions of the above embodiments, the harmless network attack effectiveness testing method described in the above embodiments, through key distribution and cross-key verification mechanisms, enables the target device and analysis server to perform dual verification of the exercise process, improving the accuracy of the exercise results. Furthermore, by generating a unique identifier (SID) for each participating user, precise quantification is achieved, and the exercise results are accurate to the individual, providing reliable data for enterprises to assess their overall security level, identify high-risk employees, and provide targeted empowerment.

[0076] In some embodiments, as a refinement and extension of the specific implementation of the above embodiments, and to fully illustrate the specific implementation process of this embodiment, some embodiments of this application also provide a method for testing the effectiveness of harmless network attacks, applied to the target device in the exercise, such as... Figure 4 As shown, the method includes: S301, Standard Client Load; S302. Perform introspection using the standard client payload and extract key metadata of the session identifier from the standard client payload; S303. Generate a full-screen graphical overlay based on the session identifier; S304. By calling the underlying graphics device interface, display the full-screen graphics overlay with the highest priority.

[0077] For the target device in the exercise, the standard client payload can be executed after obtaining it. Since the section table of the standard client payload is programmatically reconstructed from a binary structure and injected into a custom data section, and this custom data section embeds key metadata such as a preset Uniform Resource Locator (URL) and session identifier, and the session identifier is a globally unique identifier instantiated by the analysis server for the target device, by executing the standard client payload, the analysis server can perform introspection based on the standard client payload and extract the key metadata of the session identifier from it.

[0078] The target device in the exercise then generates a full-screen graphical overlay based on the session identifier and displays the full-screen graphical overlay with the highest priority by calling the underlying graphics device interface. The full-screen graphical overlay includes a feedback identification code generated based on a preset Uniform Resource Locator (URL), enabling external devices to send network requests to the analysis server by scanning the feedback identification code; the external devices are terminal devices connected to a public network; the analysis server is configured to aggregate terminal event data from the target device based on network requests and generate an evaluation report based on the terminal event data.

[0079] By applying the technical solutions of the above embodiments, the harmless network attack effectiveness testing method described in the above embodiments can run locally on the target device in the exercise without any outbound network behavior, enabling it to penetrate the strictest network isolation policies and making it suitable for any complex network environment. Since the entire process is a high-fidelity simulation of a ransomware attack scenario, but is essentially a secure exercise program, it does not involve any file encryption or destruction. Therefore, the exercise process can be harmlessly controlled. Furthermore, the method can be equipped with multiple safety mechanisms, such as automatic timeout exit, to ensure that no actual damage is caused to the user's terminal system, and the environment automatically recovers after the exercise. In addition, the method can also achieve a highly customizable exercise mode through a full-screen graphic overlay. Elements such as warning messages, prompts, company logos, and emergency contact numbers in the full-screen graphic overlay can be flexibly configured, allowing enterprises to customize exercise scenarios that best suit their actual needs based on their own exercise objectives and culture.

[0080] In some embodiments, as a specific implementation of the harmless network attack effectiveness testing method in the above embodiments, some embodiments of this application also provide a harmless network attack effectiveness testing system, such as... Figure 5As shown, the system includes: an analysis server, target devices for the exercise, and external devices. The external devices and the analysis server are connected to a public network.

[0081] The analysis server is configured to: instantiate a session identifier for the target device of the exercise, wherein the session identifier is a globally unique identifier; programmatically reconstruct the binary structure of the standard client payload to inject a custom data section into the section table of the standard client payload; and embed the key metadata of the preset Uniform Resource Locator and session identifier into the custom data section. The target device for the exercise was configured to: execute a standard client payload; perform introspection through the standard client payload and extract key metadata of the session identifier from the standard client payload; generate a full-screen graphical overlay based on the session identifier, the full-screen graphical overlay including a feedback identification code generated according to a preset Uniform Resource Locator; and display the full-screen graphical overlay with the highest priority by calling the underlying graphics device interface. The external device is configured to: generate a network request by scanning a feedback identification code; and send the network request to the analysis server. The analysis server is also configured to: receive network requests sent by external devices; aggregate terminal event data of the target devices in the exercise based on the network requests; and generate an evaluation report based on the terminal event data.

[0082] By applying the technical solutions of the above embodiments, the harmless network attack effectiveness testing system described in the above embodiments can instantiate a globally unique session identifier for the target device through an analysis server, and programmatically reconstruct the binary structure of the standard client payload, embedding a preset Uniform Resource Locator (URL) and session identifier in a custom data section of the section table. After executing the standard client payload, the target device can extract the session identifier from the standard client payload. Then, a full-screen graphic overlay is generated based on the session identifier and displayed according to the highest priority. The external device then sends a network request to the analysis server by scanning the feedback identification code in the full-screen graphic overlay, so that the analysis server can aggregate terminal event data and generate an evaluation report based on the terminal event data. The system no longer relies on the network capabilities of the target device, but uses QR codes as information carriers to transfer the data return action to external devices, constructing an information channel that is not limited by the network environment of the target device, and improving the accuracy of network security exercise results.

[0083] It should be noted that other corresponding descriptions of the functional units involved in the harmless network attack effectiveness testing system provided in this application embodiment can be found in the corresponding descriptions in the harmless network attack effectiveness testing method provided in the above embodiment, and will not be repeated here.

[0084] This application also provides a computer device, specifically a personal computer, server, network device, etc. The computer device includes a bus, processor, memory, and communication interface, and may also include input / output interfaces and a display device. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores location information. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0085] Those skilled in the art will understand that the structure of the computer device described above is only a partial structure related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. A specific computer device may include more or fewer components, or combine certain components, or have different component arrangements.

[0086] In one embodiment, a computer-readable storage medium is also provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0087] In one embodiment, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0088] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0089] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the methods described above.

[0090] Any references to memory, database, or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc.

[0091] Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can take many forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0092] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchain. The processors involved in the embodiments provided in this application may be, but are not limited to, general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc.

[0093] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0094] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for testing the effectiveness of harmless network attacks, characterized in that, Applied to an analytics server, the method includes: To instantiate a session identifier for the target device in the exercise, the session identifier is a globally unique identifier; The binary structure of the standard client payload is programmatically reconstructed to inject custom data sections into the section table of the standard client payload; The key metadata of the preset Uniform Resource Locator and the session identifier are embedded in the custom data section so that after the standard client payload is executed by the target device of the exercise, a full-screen graphical overlay is generated based on the session identifier; the full-screen graphical overlay includes a feedback identification code generated based on the preset Uniform Resource Locator. Receive network requests sent by external devices, wherein the external device is a terminal device connected to a public network; the network request is a request generated by the external device by scanning the feedback identification code; The system aggregates terminal event data from the target device in the exercise based on the network request, and generates an evaluation report based on the terminal event data.

2. The method according to claim 1, characterized in that, The binary structure of the standard client payload is programmatically reconstructed to inject custom data sections into the section table of the standard client payload, including: Obtain a portable executable PE file with standard client payload; Read the section table of the PE file; The injection location is found in the section table, where the injection location is a data section in the section table whose data space is greater than or equal to a preset space threshold; the preset space threshold is set according to the session identifier and the preset Uniform Resource Locator. Add a new section entry to the section table according to the injection location to inject the custom data section into the section table.

3. The method according to claim 1, characterized in that, Embedding the key metadata of the preset Uniform Resource Locator and the session identifier into the custom data section includes: Obtain the network address of the analysis server in the public network; Generate a Uniform Resource Locator (URL) based on the network address to obtain a preset URL; Extract key metadata from the session identifier; A traceable digital watermark is generated based on the preset Uniform Resource Locator and the key metadata. The traceable digital watermark is embedded in the custom data section to form a standard client payload with the traceable digital watermark embedded.

4. The method according to claim 1, characterized in that, Based on the network request, the terminal event data of the target device in the exercise is aggregated, including: Read the session identifier from the network request; Verify the validity of the session identifier; If the session identifier is verified to be valid, a service unlock key is obtained, which is an unlock key deterministically derived from the session identifier. The service unlock key is sent to the external device. The service unlock key is used to enable the target device to perform key comparison verification locally and release the full-screen graphics overlay by executing a preset cleanup routine.

5. The method according to claim 1, characterized in that, Based on the network request, the terminal event data of the target device in the exercise is aggregated, including: Invoke the execution state machine model; The execution state machine model is used to track key events throughout the entire lifecycle of the standard terminal payload. These key events include payload execution success events, data return success events, unlock success events, terminal interception events, and session timeout events. The key events of multiple target devices in the exercise are aggregated to generate the terminal event data.

6. The method according to claim 5, characterized in that, An evaluation report is generated based on the terminal event data, including: Get the assessment report template; Read the event statistics dimensions from the assessment report template; According to the aforementioned event statistics dimensions, the key events in the terminal event data are statistically analyzed to generate event statistics results; the event statistics results include one or more combinations of initial vector success rate, average threat response time, comprehensive technical protection effectiveness, and security awareness level; A precise data profile is generated based on the event statistics. This precise data profile is used to characterize the comprehensive anti-attack capability of the target device in the exercise across multiple dimensions.

7. A method for testing the effectiveness of harmless network attacks, characterized in that, The method, applied to target equipment in a training exercise, includes: The standard client payload is executed, and the section table of the standard client payload is programmatically reconstructed through a binary structure and injected into a custom data section. The custom data section embeds key metadata such as preset Uniform Resource Locators and session identifiers. The session identifier is a globally unique identifier instantiated by the analysis server for the target device in the exercise. Perform introspection using the standard client payload to extract key metadata of the session identifier from the standard client payload; A full-screen graphical overlay is generated based on the session identifier, and the full-screen graphical overlay includes a feedback identification code generated based on the preset Uniform Resource Locator. By calling the underlying graphics device interface, the full-screen graphics overlay is displayed with the highest priority, so that external devices can send network requests to the analysis server by scanning the feedback identification code; the external devices are terminal devices connected to public networks; the analysis server is configured to aggregate terminal event data of the target device in the exercise based on the network request, and generate an evaluation report based on the terminal event data.

8. The method according to claim 7, characterized in that, The method further includes: The device unlock key is deterministically derived based on the session identifier; Obtain the service unlock key input by the user based on the full-screen graphics overlay. The service unlock key is an unlock key derived by the analysis server based on the session identifier after verifying the validity of the session identifier read from the network request. The device unlock key is used to verify the service unlock key in order to generate an unlock verification result; Execute a preset cleanup routine based on the unlock verification result.

9. The method according to claim 8, characterized in that, Execute a preset cleanup routine based on the unlock verification result, including: Read the unlock verification result; If the unlock verification result is that the key matches, the preset cleanup routine is executed to release the graphics resources and system hooks corresponding to the full-screen graphics overlay layer; Terminate the execution process of the standard client payload to restore the terminal environment to its initial state.

10. A harmless network attack effectiveness testing system, characterized in that, The system includes: an analysis server, a target device for the exercise, and external devices, wherein the external devices and the analysis server are connected to a public network; The analysis server is configured to: instantiate a session identifier for the target device of the exercise, wherein the session identifier is a globally unique identifier; programmatically reconstruct the binary structure of the standard client payload to inject a custom data section into the section table of the standard client payload; and embed the key metadata of the preset Uniform Resource Locator and the session identifier into the custom data section. The target device for the exercise is configured to: execute the standard client payload; perform introspection through the standard client payload to extract key metadata of the session identifier from the standard client payload; generate a full-screen graphical overlay based on the session identifier, the full-screen graphical overlay including a feedback identification code generated according to the preset Uniform Resource Locator; and display the full-screen graphical overlay with the highest priority by calling the underlying graphics device interface. The external device is configured to: generate a network request by scanning the feedback identification code; and send the network request to the analysis server; The analysis server is also configured to: receive network requests sent by external devices; aggregate terminal event data of the target device in the exercise based on the network requests; and generate an evaluation report based on the terminal event data.

Images