AI-based multi-dimensional intranet threat defense test system and method

Abstract

The invention discloses an AI-based multi-dimensional intranet threat defense test system and method. The method comprises the following steps: firstly, selecting a threat defense test scheme adaptive to an intranet protection requirement from a preset test scene library; then analyzing the test scheme into a multi-branch attack chain and generating an instruction set, and cooperatively issuing a network attack, a host attack and an identity attack according to a time sequence and a dependency relationship of the instruction set to realize multi-dimensional attack simulation; capturing system response data corresponding to the attack, and combining the system response data into a standardized feature vector after feature extraction; inputting the feature vector into an AI evaluation model, and outputting a quantized defense effectiveness evaluation score; and finally, based on the evaluation score and a preset report template, automatically generating a test report containing defense weak links and optimization suggestions. According to the method, through multi-dimensional attack simulation reproducing a real attack chain, precise quantitative evaluation of defense efficiency is realized in combination with an AI technology, and various threat scenes of an intranet can be comprehensively covered.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to an AI-based multi-dimensional intranet threat defense testing system and method. Background Technology

[0002] In today's era of rapid digital development, cyberspace has become a critical infrastructure for the operation of various industries. However, the landscape of cyberattacks is also becoming increasingly severe and complex, posing unprecedented challenges to internal network security. As cyberattack methods continue to evolve and upgrade, the limitations of traditional perimeter protection methods are becoming increasingly apparent. Classic security tools such as firewalls and intrusion detection systems primarily focus on protecting the network perimeter, aiming to block unauthorized external intrusions. However, these traditional methods are proving inadequate when dealing with the increasingly rampant Advanced Persistent Threats (APTs) in internal network environments. APT attacks are often highly covert, targeted, and persistent; attackers can remain lurking within the internal network for extended periods, gradually infiltrating and stealing critical data, making it difficult for traditional perimeter protection to effectively identify and block them.

[0003] Meanwhile, lateral movement attacks within intranets pose significant challenges to security detection. Once attackers breach the perimeter and enter the intranet, they exploit the trust relationships between devices to spread their attacks across different systems and devices. Traditional defense methods struggle to detect and prevent this malicious lateral propagation in a timely manner. Furthermore, data theft, a common objective of intranet attacks, is becoming increasingly diverse and covert. Traditional perimeter defenses are unable to provide detailed monitoring and analysis of data flow within the intranet, making it difficult to effectively prevent data breaches.

[0004] Most existing intranet security detection technologies rely on rule bases or static signature matching. While this approach can identify known attack behaviors to some extent, its adaptive detection capability is severely inadequate in the face of constantly emerging new attack methods. Because new attacks often have unique characteristics and behavioral patterns, rule bases and static signatures are difficult to fully cover and update in a timely manner, causing security detection systems to fail to detect these new threats accurately and promptly.

[0005] Furthermore, the intranet environment itself is highly complex. It contains various types of devices, such as servers, workstations, and mobile terminals, which differ in operating systems and application software, increasing the difficulty of security management. Simultaneously, the communication protocols used within the intranet are diverse, each with different characteristics and security requirements, limiting the coverage of threat detection. Existing security detection technologies struggle to conduct comprehensive and in-depth analysis of all devices and protocols, resulting in some potential security threats going undetected in a timely manner, thus affecting the accuracy of threat detection. In conclusion, intranet security faces numerous serious challenges, urgently requiring innovative security detection technologies and methods to address increasingly complex network attack threats. Summary of the Invention

[0006] The purpose of this invention is to address the technical problems of existing technologies lacking adaptive detection capabilities against new types of attacks, and the limited coverage and accuracy of threat detection due to the complexity of device types and diverse communication protocols in intranet environments. This invention provides an AI-based multidimensional intranet threat defense testing system and method.

[0007] To achieve the above objectives, the present invention employs the following technical solution: The first aspect of this invention provides an AI-based multi-dimensional intranet threat defense testing method, comprising the following steps: Select a threat defense test plan from the pre-set test scenario library; The threat defense test scheme is parsed into a multi-branch attack chain to generate an instruction set; based on the instruction set, network attacks, host attacks, and identity attacks are launched in sequence and according to dependencies to simulate multi-dimensional attacks. The system response data of the network attack, host attack and identity attack are captured, and the system response data is combined into a feature vector after feature extraction; The feature vector is input into the evaluation model, and the evaluation score is output. A test report is generated based on the evaluation score and the preset report template.

[0008] Furthermore, the threat defense testing scheme is analyzed as a multi-branch attack chain using a workflow engine based on a directed acyclic graph.

[0009] Furthermore, the system response data for capturing network attacks, host attacks, and identity attacks is retrieved in real time from various security devices such as firewalls, IDS / IPS, WAF, EDR, and SIEM via Syslog, Kafka API, and SNMP Trap protocols, including alarm logs, blocking records, and performance metrics.

[0010] Furthermore, the step of extracting features from the system response data and combining them into a feature vector specifically involves: The system response data is cleaned and normalized sequentially to obtain preprocessed data; Feature extraction is performed on the preprocessed data based on a predefined feature library; The extracted features are merged into a feature vector.

[0011] Furthermore, the evaluation model includes a convolutional neural network branch, a long short-term memory network branch, and an attention mechanism layer; the convolutional neural network branch and the long short-term memory network branch are connected in parallel and then connected in series with the attention mechanism layer.

[0012] Furthermore, the identity attack employs a test account specifically configured in a domain environment to simulate an identity attack; the identity attack includes attempting to access shared network resources and simulating login behavior at abnormal times or locations.

[0013] Furthermore, the generated test report uses the Jinja2 template engine.

[0014] Furthermore, the host attack simulates a host attack by executing a real fileless attack script within system privileges.

[0015] A second aspect of the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the AI-based multidimensional intranet threat defense testing method.

[0016] A third aspect of this invention provides an AI-based multi-dimensional intranet threat defense testing system, comprising: The control center module selects a threat defense test plan from a pre-set test scenario library; The attack simulation engine module parses the threat defense test scheme into a multi-branch attack chain and generates an instruction set; based on the instruction set, it delivers network attacks, host attacks, and identity attacks in sequence and according to dependencies to perform multi-dimensional attack simulation. The defense response acquisition module captures system response data for network attacks, host attacks, and identity attacks. The multi-dimensional feature extraction module extracts features from the system response data and combines them into a feature vector. The defense effectiveness evaluation module inputs the feature vector into the evaluation model and outputs an evaluation score; The test report generation module generates a test report based on the evaluation score and a preset report template.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This invention discloses an AI-based multi-dimensional intranet threat defense testing method. It selects test schemes (such as APT phishing attack chains and ransomware lateral movement) from a pre-set test scenario library to simulate real intranet threats. The schemes are then parsed into multi-branch attack chains, and network, host, and identity attacks are simulated collaboratively according to the timing and dependencies of real attacks, completely reproducing the entire attack chain process. Compared to traditional single-dimensional attack testing, this method comprehensively covers various attack behaviors in the intranet, including port scanning, vulnerability exploitation, fileless attacks, credential theft, and abnormal logins. It accurately simulates complex attack scenarios such as Advanced Persistent Threats (APTs), making the test results closer to actual defense needs. The method specifically captures system response data corresponding to the three-layer attacks and transforms heterogeneous alarm logs, blocking records, process behaviors, and other data into a unified format feature vector through a standardized feature extraction process. This effectively solves the data fragmentation problem caused by the complexity of intranet device types and the diversity of communication protocols. The construction of feature vectors retains key defense features such as network layer protocol types, host layer process relationships, and identity layer login information, while also achieving structured data processing. This provides high-quality data support for subsequent intelligent assessment and enhances the analyzability of defense features. By leveraging an AI assessment model to perform deep analysis on the feature vectors and outputting quantitative assessment scores, the limitations of traditional qualitative assessments relying on rule bases or static feature matching are overcome. The model can accurately quantify core indicators of the defense system, such as detection rate, response time, and handling effectiveness, clearly identifying weaknesses in each stage of the attack chain (such as missing detection of fileless attacks or failure to intercept lateral movement traffic). This provides a data-driven scientific basis for optimizing the internal network security protection system, avoiding the unclear optimization direction caused by "fuzzy assessment" in traditional testing. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a structural diagram of the AI-based multi-dimensional intranet threat defense testing system provided in an embodiment of the present invention; Figure 2 This is a flowchart of the AI-based multi-dimensional intranet threat defense testing method provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0022] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0023] The present invention will now be described in further detail with reference to the accompanying drawings: like Figure 1 The diagram shown is a structural diagram of the AI-based multi-dimensional intranet threat defense testing system provided in an embodiment of the present invention, including a control center module S1, an attack simulation engine module S2, a network attack simulation module S3, a host attack simulation module S4, an identity attack simulation module S5, a defense response acquisition module S6, a multi-dimensional feature extraction module S7, a defense effectiveness evaluation module S8, and a test report generation module S9.

[0024] like Figure 2 The diagram shows a flowchart of the AI-based multi-dimensional intranet threat defense testing method provided in this embodiment of the invention. It mainly includes five stages: test preparation, attack simulation, data collection, intelligent analysis, and report feedback, forming a complete closed-loop testing process. The control center module S1 is present throughout the entire process, responsible for scheduling and management.

[0025] In the test preparation phase S11, the control center module S1 receives user instructions and initializes the test environment. In the embodiment provided by this invention, S1 adopts a microservice architecture based on Docker containerization and communicates with all other modules through a RESTful API. Users can select a test plan from a pre-set test scenario library (such as "APT phishing attack chain", "ransomware lateral movement", "insider data theft", etc.) through the web interface provided by S1, or customize the attack chain process through graphical drag-and-drop components. S1 converts the finalized test plan into a standard JSON format instruction set.

[0026] The attack simulation execution phase S12 is crucial for triggering the defense system's response. It is scheduled by S1 and executed collaboratively by S2 through S5, specifically as follows: The attack simulation engine module S2 receives a JSON instruction set from S1. In the embodiment provided by this invention, S2 employs a workflow engine based on a directed acyclic graph (DAG) to parse and execute complex, multi-branch attack chains. Based on the instruction set, it issues specific attack commands to S3, S4, and S5 in the correct timing and according to dependencies.

[0027] The network attack simulation module S3 receives instructions from S2. In the embodiments provided by this invention, S3 employs a highly customized combination of the Metasploit Framework and the Python Scapy library. For example, during the simulation of the "lateral movement" phase, S3 generates attack traffic that exploits an SMB protocol vulnerability (such as MS17-010). The source IP, destination IP, and payload content are dynamically constructed according to the test plan to simulate a real attacker.

[0028] The host attack simulation module S4 receives instructions from S2. In the embodiments provided by this invention, S4 is a lightweight agent program deployed on the target test server and terminal. It ensures its own security through digital signatures and two-way certificate authentication mechanisms. Upon receiving instructions, it executes a real fileless attack script within system privileges. For example, it uses PowerShell to execute a memory-loaded Mimikatz script to simulate credential theft. The entire process is not written to disk, and traces are automatically cleaned up after completion.

[0029] The identity attack simulation module S5 receives instructions from S2. In the embodiment provided by this invention, S5 uses a test account specially configured in a domain environment to perform the operation. It uses tool libraries such as Impacket to simulate launching attacks such as pass-the-hash attacks to attempt to access shared network resources; or to simulate login behavior at abnormal times or in abnormal geographical locations to test the detection capabilities of the identity security system.

[0030] The data acquisition and feature extraction phase S13 is responsible for capturing the defense system's response and converting it into analyzable data, which is accomplished by modules S6 and S7.

[0031] The defense response acquisition module S6 operates continuously throughout the entire attack simulation process. In the embodiment provided by this invention, S6 employs a multi-threaded asynchronous approach, using various protocols such as Syslog, Kafka API, and SNMP Trap to retrieve raw data such as alarm logs, blocking records, and performance metrics in real time from various security devices including firewalls, IDS / IPS, WAF, EDR, and SIEM.

[0032] The multi-dimensional feature extraction module S7 standardizes the raw heterogeneous data collected by S6. In the embodiment provided by this invention, S7 uses a data pipeline built on the Elastic Stack (Elasticsearch, Logstash) technology stack. It first cleans and normalizes the data, and then extracts features based on a predefined feature library. For example, for a firewall log, features such as "action (allow / deny)," "protocol type," "destination port," and "matching policy ID" are extracted; for an EDR alarm, features such as "process hash," "parent-child process relationship," "triggered rule ID," and "confidence level" are extracted. Finally, all features are combined into a fixed-length feature vector for subsequent analysis.

[0033] The intelligent analysis and evaluation phase S14 is the core of this invention. In this phase, the defense effectiveness evaluation module S8 receives feature vectors from S7. In the embodiment provided by this invention, S8 employs an evaluation model built based on the TensorFlow framework. This model is a multi-input neural network, comprising: (1) Convolutional Neural Network (CNN) branch: used to process spatially local features extracted from network device logs.

[0034] (2) Long Short-Term Memory (LSTM) Branch: Used to process host process behavior and authentication logs organized in time sequence, and capture their sequential dependencies.

[0035] (3) Attention layer: The outputs of the two branches above are weighted and fused to make the model pay more attention to key defense events that are strongly related to the attack.

[0036] The model ultimately outputs an overall evaluation score for this test, as well as detailed evaluation metrics for each attack phase (such as initial intrusion, persistence, lateral movement, and data leakage), such as detection rate, false positive rate, and average response time (MTTD / MTTR).

[0037] In the report generation and feedback phase S15, the test report generation module S9 receives the evaluation results from S8. In the embodiment provided by this invention, S9 is an automatic report generation system based on the Jinja2 template engine. It obtains structured evaluation data from S8, populates it into a pre-designed Word / PDF template, and automatically generates a detailed report. The report not only includes scores and charts, but also clearly points out the weaknesses in the defense system, such as "EDR fails to detect fileless attacks" and "firewall policies allow lateral movement traffic," and provides specific reinforcement suggestions, such as "It is recommended to enable the firewall's IPS function and perform deep inspection of SMB traffic" and "It is recommended to enable XX rule in EDR," etc. The report is finally sent back to the S1 interface for display to the user, completing a full test loop.

[0038] In one embodiment of the present invention, a storage medium is also provided, specifically a computer-readable storage medium (Memory), which is a memory device in a terminal device for storing programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device; it can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor, which can be one or more computer programs (including program code). It should be noted that more specific examples (a non-exhaustive list) of the computer-readable storage medium include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0039] Computer-readable storage media also include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable storage medium can also be any readable medium other than a readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium can be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0040] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0041] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the AI-based multidimensional intranet threat defense testing method in the above embodiments.

[0042] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A multi-dimensional intranet threat defense testing method based on AI, characterized in that, Includes the following steps: Select a threat defense test plan from the pre-set test scenario library; The threat defense test scheme is parsed into a multi-branch attack chain to generate an instruction set; based on the instruction set, network attacks, host attacks, and identity attacks are launched in sequence and according to dependencies to simulate multi-dimensional attacks. The system response data of the network attack, host attack and identity attack are captured, and the system response data is combined into a feature vector after feature extraction; The feature vector is input into the evaluation model, and the evaluation score is output. A test report is generated based on the evaluation score and the preset report template.

2. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The threat defense testing scheme is analyzed as a multi-branch attack chain using a workflow engine based on a directed acyclic graph.

3. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The system response data for capturing network attacks, host attacks, and identity attacks is retrieved in real time from various security devices such as firewalls, IDS / IPS, WAF, EDR, and SIEM via Syslog, Kafka API, and SNMP Trap protocols, including alarm logs, blocking records, and performance metrics.

4. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The specific steps of extracting features from the system response data and combining them into a feature vector are as follows: The system response data is cleaned and normalized sequentially to obtain preprocessed data; Feature extraction is performed on the preprocessed data based on a predefined feature library; The extracted features are merged into a feature vector.

5. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The evaluation model includes a convolutional neural network branch, a long short-term memory network branch, and an attention mechanism layer; the convolutional neural network branch and the long short-term memory network branch are connected in parallel and then connected in series with the attention mechanism layer.

6. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The identity attack uses a test account specially configured in a domain environment to simulate an identity attack; the identity attack includes attempting to access network shared resources and simulating login behavior at abnormal times or locations.

7. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The test report is generated using the Jinja2 template engine.

8. The AI-based multi-dimensional intranet threat defense testing method according to claim 1, characterized in that, The host attack simulates a host attack by executing a real fileless attack script within system privileges.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the AI-based multidimensional intranet threat defense testing method according to any one of claims 1-8.

10. An AI-based multi-dimensional intranet threat defense testing system, characterized in that, include: The control center module selects a threat defense test plan from a pre-set test scenario library; The attack simulation engine module parses the threat defense test scheme into a multi-branch attack chain and generates an instruction set; based on the instruction set, it delivers network attacks, host attacks, and identity attacks in sequence and according to dependencies to perform multi-dimensional attack simulation. The defense response acquisition module captures system response data for network attacks, host attacks, and identity attacks. The multi-dimensional feature extraction module extracts features from the system response data and combines them into a feature vector. The defense effectiveness evaluation module inputs the feature vector into the evaluation model and outputs an evaluation score; The test report generation module generates a test report based on the evaluation score and a preset report template.

Images