An attack scenario script variation method, device and medium

Abstract

This application belongs to the fields of network security testing and network range technology, and discloses a method, device, and medium for mutation of attack simulation scripts. This application enables the server to strengthen the direction of potential risks based on the current attack simulation script and the built-in expert knowledge base. By mutating the direction of potential risks, the anomaly coverage of potential risks is improved. At the same time, a random perturbation strategy is used to ensure that as many potential risks as possible can be discovered in multiple rounds of mutation iterations. After a risk is discovered, the mutated script is merged into the system's built-in script library, thereby achieving the goal of automatically expanding the script library and reducing the input of manually generated scripts.

Description

Technical Field

[0001] This application belongs to the fields of network security testing and network range technology, and in particular relates to a method, device and medium for attack simulation script variation. Background Technology

[0002] With the increasing complexity and dynamic nature of cyber threats, traditional security assessment methods such as regular penetration testing and vulnerability scanning have gradually revealed their limitations. Network security verification systems, which can automatically and continuously verify target networks and promptly identify potential security risks, have received increasing attention.

[0003] A security verification system consists of two parts: a server and a client. A typical deployment method is as follows: Figure 1 As shown, the server is deployed at the exit of the target network that needs to be verified, and the client is deployed in each subnet of the target network.

[0004] Attack simulation scenarios are the soul of a network verification system. Their coverage and realism determine the accuracy of the verification. The server continuously sends attack simulation scenarios (i.e., verification data) to all clients to simulate real-world attacks and judges whether the security strategy in this link is correct and whether the security system is complete based on the client's feedback, thus comprehensively testing the defense capabilities of the defense system. The current method of generating attack simulation scenarios has the following problems: 1. The attack simulation script sent by the server needs to be pre-built into the system; the script itself cannot be modified. The system can only detect predefined risk issues in the script and cannot expand based on known issues to discover more risk issues. 2. Simulated scripts need to be manually created and generated, which is costly and cannot effectively cover abnormal branches. Summary of the Invention

[0005] The purpose of this application is to overcome the problems of the prior art by disclosing an attack simulation script mutation method, device and medium that can automatically generate mutated scripts based on scripts that have been compromised, thereby improving the efficiency and coverage of attack simulation.

[0006] The objective of this application is achieved through the following technical solution: An attack simulation script mutation method, the attack simulation script mutation method comprising: S1: Send a full set of simulated scenarios based on the target to be tested, parse and obtain all scenarios where risks occur; S2: For each script A where a risk occurs, extract the HTTP header Ai of the script one by one, where i represents the setting field of the header; Embed each header Ai and match the embedding results with the knowledge base. Find the vector Vx in the knowledge base that has the highest matching degree with the current header. Vx represents a specific vector in the expert knowledge base. S3: For all vectors Vx matched in S2, count the number of times each vector appears, and select the N vectors with the most occurrences as candidate mutation strategies. S4: Randomly generate perturbation mutation strategies, and randomly select K vectors from the knowledge base that are not in the candidate mutation strategies as perturbation mutation strategies; S5: Generate the final mutation strategy, combining candidate mutation strategies and perturbation mutation strategies, and use it as the final mutation strategy for the current round; S6: Based on the mutation strategy obtained in step S5, mutate each of the current scripts one by one to obtain the mutated HTTP header fields; S7: Adjust the HTTP header generated by mutation in S6. The adjustment method is as follows: perform similarity matching between the mutated header and the knowledge in the knowledge base, and select the header with the highest similarity to the knowledge base as the final value of the header to be adjusted. S8: After all the HTTP headers of all scripts have been mutated and adjusted, mutated scripts are generated, all mutated scripts are sent to the target to be tested, and all scripts that have been at risk are parsed and obtained.

[0007] According to a preferred embodiment, in step S2, the embedding operation is performed by mapping the corresponding data to a continuous vector space.

[0008] According to a preferred embodiment, in step S3, N≤5.

[0009] According to a preferred embodiment, in step S4, K is either 1 or 2.

[0010] According to a preferred embodiment, step S6 includes: traversing each mutation strategy, obtaining the corresponding HTTP header field, and inputting the selected mutation strategy into the decoder to obtain the mutated HTTP header field.

[0011] According to a preferred embodiment, the matching algorithm in step S7 includes: cosine similarity matching algorithm and Levenshtein distance matching algorithm.

[0012] According to a preferred embodiment, step S8 further includes: adding the variant scripts that have been at risk to the built-in simulation scripts, thereby increasing the number of built-in simulation scripts.

[0013] According to a preferred embodiment, step S8 further includes: counting the number N of scripts with risk of mutation in the current round, and recording the number of scripts with risk in the previous round as M; if M is not 0, and N / M is greater than a specified threshold, repeating steps S2 to S8; otherwise, ending the script mutation process.

[0014] On the other hand, this application also discloses: An electronic device includes: at least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the aforementioned attack simulation script mutation method.

[0015] On the other hand, this application also discloses: A computer-readable storage medium for storing instructions that, when executed, cause the aforementioned attack simulation script mutation method to be implemented.

[0016] The aforementioned main solution and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed in this application. Those skilled in the art, after understanding the solution of this application, will realize that there are many combinations based on the prior art and common general knowledge, all of which are technical solutions to be protected in this application, and will not be exhaustively listed here.

[0017] The beneficial effects of this application are: Based on the scripts where risks have occurred, this application combines a maintained expert knowledge base based on HTTP headers to extract the content of the HTTP headers for vector embedding. Then, based on the similarity matching and statistics of the vectors, it determines the script mutation strategy to generate mutated scripts. This can strengthen the direction of risk issues and improve the anomaly coverage of risk issue directions.

[0018] In each round of mutation, this application dynamically calculates the mutation strategy to be executed based on the script that has a risk, and further randomly adds perturbation strategies to ensure that the system does not get trapped in local optima.

[0019] This application uses a mutation strategy to mutate existing scripts and replays the mutated scripts. Based on the risk results obtained from the replay, the scripts are continuously mutated and automatically expanded. This can greatly reduce the cost of manually creating simulated scripts, and the automatically expanded scripts have a higher coverage of abnormal branches in the mutation direction. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of a typical security verification system deployment method; Figure 2 This is a flowchart illustrating the attack simulation script mutation method of this application; Figure 3 This is a schematic diagram of the equipment structure in this application. Detailed Implementation

[0021] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0022] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0023] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this application is in use. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on this application. In addition, the terms "first," "second," and "third," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0024] Furthermore, terms such as "horizontal," "vertical," and "sag" do not imply that components must be absolutely horizontal or suspended, but rather that they can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal relative to "vertical," and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0025] In the description of this application, it should also be noted that, unless otherwise expressly specified and limited, the terms "set up," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0026] Furthermore, it should be noted that unless otherwise specified in this application, the specific structures, connections, positions, power sources, etc. involved are all things that a person skilled in the art can know without creative effort based on the prior art.

[0027] Example 1 refer to Figure 2 As shown in the figure, a method for mutating attack simulation scripts is illustrated. This method enables the server to strengthen the direction of potential risks based on the current attack simulation script and a built-in expert knowledge base. Mutating the direction of potential risks increases the anomaly coverage of those directions. Simultaneously, the system utilizes a random perturbation strategy to ensure that as many potential risks as possible are discovered in multiple rounds of mutation iterations. Mutated scripts, once risks are discovered, are merged into the system's built-in script library, thereby automatically expanding the script library and reducing the need for manually generated scripts.

[0028] Specifically, the attack simulation script mutation method of this application includes the following steps.

[0029] Step S1: Send a full set of simulation scripts based on the target to be tested, parse and obtain all scripts where risks occur.

[0030] Step S2: For each script A that has a risk, extract the HTTP header Ai of the script one by one, where i represents the setting field of the header, for example, i=1 means user-agent.

[0031] Embedding is performed on each header Ai, and the embedding results are matched against the knowledge base. The vector Vx with the highest matching degree to the current header is found in the knowledge base, where Vx represents a specific vector in the expert knowledge base. The embedding operation involves mapping the corresponding data to a continuous vector space.

[0032] Step S3: For all vectors Vx matched in S2, count the frequency of each vector. The N vectors with the highest frequency are selected as candidate mutation strategies. The value of N generally does not exceed 5.

[0033] Step S4: Randomly generate perturbation mutation strategies. Randomly select K vectors from the knowledge base that are not in the candidate mutation strategies as perturbation mutation strategies, where K is generally 1 or 2.

[0034] Step S5: Generate the final mutation strategy, combining candidate mutation strategies and perturbation mutation strategies to form the final mutation strategy for the current round.

[0035] Step S6: Based on the mutation strategy obtained in step S5, mutate all current scripts one by one in the following manner to obtain the mutated HTTP header fields.

[0036] Specifically, step S6 includes: traversing each mutation strategy, obtaining the corresponding HTTP header field, and inputting the selected mutation strategy into the decoder to obtain the mutated HTTP header field.

[0037] Step S7: Adjust the HTTP header generated by mutation in S6. Since the HTTP header generated by decoding mutation in step S6 may not completely match the existing HTTP header, it is necessary to adjust the HTTP header generated by mutation. The knowledge base maintains all known enumeration information for each HTTP header.

[0038] The adjustment method is as follows: the mutated header is matched with the knowledge in the knowledge base based on similarity, and the header with the highest similarity to the knowledge base is selected as the final value of the header to be adjusted. Preferably, the matching algorithm includes, but is not limited to: cosine similarity matching algorithm and Levenshtein distance matching algorithm.

[0039] Step S8: After all the HTTP headers of all scripts have been mutated and adjusted, mutated scripts are generated. All mutated scripts are sent to the target to be tested, and all scripts that have been at risk are parsed and obtained.

[0040] Preferably, step S8 further includes: adding the variant scripts that have encountered risks to the built-in simulation scripts, thereby expanding the number of built-in simulation scripts.

[0041] Furthermore, step S8 also includes: counting the number N of scripts at risk of mutation in the current round, and recording the number M of scripts at risk in the previous round; if M is not 0, and N / M is greater than a specified threshold, repeat steps S2 to S8; otherwise, end the script mutation process.

[0042] Based on the scripts where risks have occurred, this application combines a maintained expert knowledge base based on HTTP headers to extract the content of the HTTP headers for vector embedding. Then, based on the similarity matching and statistics of the vectors, a script mutation strategy is determined to generate mutated scripts. This can strengthen the direction of risk issues and improve the anomaly coverage of risk issue directions.

[0043] In each round of mutation, this application dynamically calculates the mutation strategy to be executed based on the script that has a risk, and further randomly adds perturbation strategies to ensure that the system does not get trapped in local optima.

[0044] This application uses a mutation strategy to mutate existing scripts and replays the mutated scripts. Based on the risk results obtained from the replay, the scripts are continuously mutated and automatically expanded. This can greatly reduce the cost of manually creating simulated scripts, and the automatically expanded scripts have a higher coverage of abnormal branches in the mutation direction.

[0045] Example 2 like Figure 3 As shown in Embodiment 1, this embodiment also discloses an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor; the specific connection medium between the processor and the memory is not limited in this embodiment.

[0046] Figure 3 This example illustrates the connection between the processor and memory via a bus. The bus... Figure 3 The connections between other components are shown in thick lines for illustrative purposes only and should not be construed as limiting. Buses can be categorized into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 3 A single thick line is used to represent a processor, but this does not mean there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there is no restriction on the name.

[0047] In this embodiment, the memory stores instructions executable by the at least one processor. By executing the instructions stored in the memory, the at least one processor performs the method described in Embodiment 1. The processor can implement... Figure 3 The functions of each module in the device are shown.

[0048] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines, and can run or execute instructions stored in memory and call data stored in memory.

[0049] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0050] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the attack simulation script mutation method disclosed in the embodiments of this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0051] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), and electrically erasable programmable read-only memory (EPROM). Only memory (EEPROM), magnetic storage, magnetic disks, optical disks, etc. A memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. The memory in embodiments of this invention can also be a circuit or any other device capable of performing storage functions for storing program instructions and / or data.

[0052] By designing and programming the processor, the code corresponding to the attack simulation script mutation method described in the foregoing embodiments can be embedded into the chip, thereby enabling the chip to execute the steps of the method described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0053] Example 3 Based on Embodiment 1, this embodiment also discloses: a computer-readable storage medium for storing instructions that, when executed, cause the method described in Embodiment 1 to be implemented.

[0054] In some alternative embodiments, the present invention also provides that various aspects of the attack simulation script mutation method can also be implemented in the form of a program product comprising program code that, when the program product is run on a device, causes the control device to perform the steps in an attack simulation script mutation method according to various exemplary embodiments of the present invention as described above.

[0055] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0056] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can be implemented in one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs) containing computer-usable program code. The form of a computer program product implemented on ROM, optical memory, etc.

[0057] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0058] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0059] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0060] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0061] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

Claims

1. A method for attack simulation script mutation, characterized in that, The attack simulation script mutation method includes: S1: Send a full set of simulated scenarios based on the target to be tested, parse and obtain all scenarios where risks occur; S2: For each script A where a risk occurs, extract the HTTP header Ai of the script one by one, where i represents the setting field of the header; Embed each header Ai and match the embedding results with the knowledge base. Find the vector Vx in the knowledge base that has the highest matching degree with the current header. Vx represents a specific vector in the expert knowledge base. S3: For all vectors Vx matched in S2, count the number of times each vector appears, and select the N vectors with the most occurrences as candidate mutation strategies. S4: Randomly generate perturbation mutation strategies, and randomly select K vectors from the knowledge base that are not in the candidate mutation strategies as perturbation mutation strategies; S5: Generate the final mutation strategy, combining candidate mutation strategies and perturbation mutation strategies, and use it as the final mutation strategy for the current round; S6: Based on the mutation strategy obtained in step S5, mutate each of the current scripts one by one to obtain the mutated HTTP header fields; S7: Adjust the HTTP header generated by mutation in S6. The adjustment method is as follows: perform similarity matching between the mutated header and the knowledge in the knowledge base, and select the header with the highest similarity to the knowledge base as the final value of the header to be adjusted. S8: After all the HTTP headers of all scripts have been mutated and adjusted, mutated scripts are generated, all mutated scripts are sent to the target to be tested, and all scripts that have been at risk are parsed and obtained.

2. The attack simulation script mutation method as described in claim 1, characterized in that, In step S2, the embedding operation is performed by mapping the corresponding data to a continuous vector space.

3. The attack simulation script mutation method as described in claim 1, characterized in that, In step S3, N≤5.

4. The attack simulation script mutation method as described in claim 1, characterized in that, In step S4, K is either 1 or 2.

5. The attack simulation script mutation method as described in claim 1, characterized in that, Step S6 includes: traversing each mutation strategy, obtaining the corresponding HTTP header field, and inputting the selected mutation strategy into the decoder to obtain the mutated HTTP header field.

6. The attack simulation script mutation method as described in claim 1, characterized in that, The matching algorithms in step S7 include: cosine similarity matching algorithm and Levenshtein distance matching algorithm.

7. The attack simulation script mutation method as described in claim 1, characterized in that, Step S8 also includes: adding the variant scripts that have been at risk to the built-in simulation scripts, thereby increasing the number of built-in simulation scripts.

8. The attack simulation script mutation method as described in claim 7, characterized in that, Step S8 further includes: counting the number N of scripts at risk of mutation in the current round, and recording the number M of scripts at risk in the previous round; if M is not 0, and N / M is greater than a specified threshold, repeat steps S2 to S8; otherwise, end the script mutation process.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the attack simulation script mutation method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the attack simulation script mutation method as described in any one of claims 1 to 8 to be implemented.

Images