A System and Method for Attack Simulation and Decontamination Verification Based on a Digital Twin Dual-Track Architecture

Abstract

This invention provides an attack simulation and harmless verification system and method based on a dual-track digital twin architecture. An asset-level digital twin engine collects asset information from the production environment and dynamically maps a digital twin copy into an isolated digital twin environment. An attack simulation and control module executes a complete attack simulation task within the digital twin environment. A harmless verification and telemetry injection module performs feature injection attacks in the production environment. A snapshot management and environment recovery module generates preset snapshots and performs second-level resets when needed. A security policy evaluation and analysis module collects defense response data and generates a defense capability index and optimization suggestions. A visual management and operation interface module manages and operates each module in the system and generates reports. This invention, through a dual-track verification mechanism of digital twin and production, ensures high-fidelity, high-intensity, and reproducible realistic attack drills and defense capability assessments without zero business impact on the production system.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and more specifically, to an attack simulation and harmless verification system and method based on a digital twin dual-track architecture. Background Technology

[0002] In the construction of modern cybersecurity systems, attack simulation and verification testing are indispensable key components. However, traditional security testing methods, such as vulnerability scanning and manual penetration testing, are generally limited by a long-standing and irreconcilable fundamental contradiction: the conflict between the "authenticity" of verification and the "security" of the business. This contradiction leads to the following prominent defects in current technologies: 1. The Dilemma of High Risk and Low Fidelity: In pursuit of verifiability, executing real attack payloads directly in the production environment could lead to catastrophic consequences such as data corruption, system crashes, and even business interruptions—absolutely unacceptable for a production system. Conversely, if risk-free probing is conducted solely in the production environment for the sake of absolute security, the strength, depth, and realism of the attack will be greatly weakened, making it impossible to effectively assess the defense system's true response capability when facing real advanced threats.

[0003] 2. Validation Distortion Due to Environmental Fragmentation: Traditional solutions involve testing in isolated experimental environments. However, such environments differ significantly from real production systems in network topology, asset configuration, access control, data traffic, and business logic. This environmental fragmentation means that attack paths effective in the experimental environment may be ineffective in the production environment; conversely, potential risks in the production environment may remain unexposed in the experimental environment. Ultimately, this significantly diminishes the validity and guiding value of the test results.

[0004] 3. Lack of a closed-loop attack and defense optimization mechanism: Existing technical solutions lack a closed-loop mechanism that enables rapid and secure iteration between attack verification and defense tuning. Attack drills are often one-off, high-cost, and irreversible; once the environment is damaged, recovery is extremely time-consuming. This prevents security teams from conducting high-frequency, repeatable, evidence-based backtesting to verify the effectiveness of adjustments to a particular defense strategy, significantly hindering the continuous optimization efficiency of the defense system.

[0005] Therefore, there is an urgent need for a solution that can completely decouple the destructiveness and observable characteristics of attack behavior and verify them separately in an absolutely secure environment, thereby achieving both high fidelity in attack simulation and absolute harmlessness in the verification process, breaking through the aforementioned technical bottlenecks. Summary of the Invention

[0006] The present invention aims to provide an attack simulation and harmless verification system and method based on a digital twin dual-track architecture, so as to carry out high-fidelity, high-intensity, and reproducible real attack drills and defense capability assessments while ensuring zero business impact on the production system.

[0007] In a first aspect, the present invention provides an attack simulation and harmless verification system based on a digital twin dual-track architecture, comprising: An asset-level digital twin engine is used to collect asset information from the production environment based on dynamic discovery technology, and dynamically map the collected asset information into a digital twin copy in an isolated data twin environment. The attack simulation and control module is used to simulate the execution of a complete attack using a digital twin copy within a digital twin environment. The harmless verification and telemetry injection module is used to perform feature injection attacks in the production environment; The snapshot management and environment recovery module is used to generate a preset snapshot before each attack is executed, and to perform a second-level reset based on the preset snapshot when needed; The security strategy assessment and analysis module is used to collect defense response data from the digital twin environment and the production environment, and automatically generate defense capability indices and optimization suggestions based on quantifiable indicators. The visualization management and operation interface module is used to manage and operate the various modules in the system, visualize the generated data and analysis results, and generate reports based on the defense capability index and optimization suggestions.

[0008] In a preferred embodiment, the asset information includes an asset set and its status; the dynamic mapping is formalized as a mapping function. Through this mapping function The assets and their states in the production environment are mapped to the assets and their states in the digital twin environment, thereby generating a digital twin copy.

[0009] In a preferred embodiment, the dynamic mapping is updated via incremental synchronization and event-driven updates.

[0010] In a preferred embodiment, the asset-grade digital twin engine provides a programmable modeling interface.

[0011] In a preferred embodiment, the attack modes when the attack simulation and control module performs a full attack simulation task include: Scripted mode: Executes attack simulation tasks according to configurable attack scripts, compatible with common automated attack library interfaces; Intelligent mode: Combining rule-based reasoning and reinforcement learning strategies, the attack path is optimized based on feedback from the digital twin environment to approximate the decision-making logic of a real attacker.

[0012] In a preferred embodiment, the snapshot management and environment recovery module generates preset snapshots including: Output a complete initial baseline snapshot of the digital twin environment, which records state data; Before each attack is executed, a current second-level snapshot is created based on the initial baseline snapshot.

[0013] In a preferred embodiment, the defense capability index is expressed as:

[0014] in, As a defense capability index, The detection rate of injected features in the production environment is obtained from the defense response data of the harmlessness verification and telemetry injection module; The interception rate of attacks in the digital twin environment is obtained from the defense response data of the attack simulation and control module; The average response time, These are the weighting coefficients for each indicator.

[0015] In a preferred embodiment, the visual management and operation interface module can interface with an existing SOC platform.

[0016] Secondly, this invention provides a method for attack simulation and harmless verification based on a digital twin dual-track architecture, comprising: The asset-level digital twin engine collects asset information from the production environment based on dynamic discovery technology and dynamically maps the collected asset information into a digital twin copy in an isolated data twin environment. The snapshot management and environment recovery module generates preset snapshots and performs second-level resets based on the preset snapshots when it is necessary to continue executing the attack. The attack simulation and control module performs a full attack simulation task using a digital twin copy within a digital twin environment; The harmlessness verification and telemetry injection module performs feature injection attacks in the production environment; The security strategy assessment and analysis module collects defense response data from the digital twin environment and the production environment, and automatically generates defense capability indices and optimization suggestions based on quantifiable indicators. The visualization management and operation interface module visualizes the generated data and analysis results, and generates reports based on the defense capability index and optimization suggestions.

[0017] In a preferred embodiment, the need to continue the attack means that the current test batch has not been completed or has not met the preset termination test conditions.

[0018] In summary, this invention, through a dual-track verification mechanism of digital twin and production environments, ensures high-fidelity, high-intensity, and reproducible real-world attack drills and defense capability assessments without any impact on the production system's operations. Specifically, in a digital twin environment that maintains a high degree of asset-level consistency with the production environment, a complete and destructive attack payload is securely executed to achieve high-fidelity attack effect simulation. In the real production environment, only harmless telemetry features extracted from the attack payload and perceptible to the defense system are injected to achieve zero-risk defense capability verification. Therefore, the beneficial effects of this invention include: 1. Completely resolve the contradiction between authenticity and security: Through a dual-track verification mechanism that separates payload and features between the digital twin and production environments, high-risk destructive actions are restricted to an isolated digital twin environment, while zero-risk testing and verification are conducted in the production environment, achieving a perfect balance between deep verification requirements and the bottom line of business security.

[0019] 2. Eliminate the problem of environmental fragmentation and achieve high-fidelity asset-level verification: Through the dynamic synchronization of all elements of the asset-level digital twin engine, a digital twin environment that is highly consistent with the production environment in terms of topology, configuration, and strategy is established, which completely eliminates the topology distortion and configuration drift problems of traditional simulation environments and ensures that the verification results truly reflect the vulnerability of the production environment.

[0020] 3. Breaking business continuity constraints and enabling zero-risk destructive drills: The second-level snapshot rollback technology in the snapshot management and environment recovery module physically decouples the consequences of high-risk attack payloads. Security teams can conduct continuous, high-intensity live-fire drills 24 / 7 without waiting for business windows.

[0021] 4. Unique harmless telemetry injection for low-cost verification of defense awareness: The harmless verification and telemetry injection module simulates attack behaviors to generate telemetry features, including system call sequences, network communication behaviors, API call behaviors, file I / O operations, and system configuration modification traces, which are perceptible to security detection systems. This triggers the detection logic of EDR or SIEM systems in the production environment, completing the verification of defense capabilities without executing real attack payloads, thus avoiding any form of data pollution or business interruption.

[0022] 5. Enhance emergency response capabilities and quantitative assessment: The defense capability index generated by the security strategy assessment and analysis module transforms the abstract security situation into quantifiable indicators, providing objective data support for the performance evaluation of security investments and the optimization of defense strategies. It also supports the actual measurement and evaluation of RTO (Recovery Time Objective) and RPO (Recovery Point Objective). Attached Figure Description

[0023] Figure 1This invention provides a schematic diagram of an attack simulation and harmless verification system based on a digital twin dual-track architecture.

[0024] Figure 2 This is a schematic diagram illustrating the working principle of the harmless telemetry injection mechanism in this embodiment of the invention.

[0025] Figure 3 The flowchart illustrates an attack simulation and harmless verification method based on a digital twin dual-track architecture, as provided in this embodiment of the invention.

[0026] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0028] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0029] like Figure 1 As shown, this embodiment of the invention provides an attack simulation and harmless verification system based on a dual-track digital twin architecture, including an asset-level digital twin engine, an attack simulation and control module, a harmless verification and telemetry injection module, a snapshot management and environment recovery module, a security policy evaluation and analysis module, and a visualization management and operation interface module.

[0030] The asset-level digital twin engine is used to collect asset information from business assets in the production environment and construct corresponding digital twin copies based on automated asset discovery and modeling technologies. The automated asset discovery technologies include network scanning, host proxy collection, API call acquisition, and log and configuration data parsing to obtain the operating status and configuration data of business assets in the production environment. In this embodiment of the invention, the collected asset information includes: asset configuration, network topology, operating system, running services, port list, user permissions, access control policies, traffic patterns, and data status.

[0031] After acquiring the aforementioned asset information, the asset-level digital twin engine maps and reconstructs the asset information in an isolated digital twin environment (such as a virtualization platform like a virtual machine or container), thereby generating a high-fidelity digital twin copy that is consistent with the production environment in terms of system configuration, network topology, and access relationships.

[0032] The digital twin is used to perform attack simulation and security verification tasks in an isolated digital twin environment, so that the attack payload and its possible system state changes only occur in the digital twin environment; at the same time, the system collects and analyzes the behavioral characteristics generated during the attack process, and uses the extracted telemetry characteristics for subsequent harmless verification in the production environment, thereby realizing a dual-track execution mechanism for attack simulation and detection verification.

[0033] In this embodiment of the invention, the asset information includes an asset set and its status; the dynamic mapping of the digital twin can be formalized as a mapping function. Through this mapping function Collect assets in the production environment and its status Asset collection mapped to a digital twin environment and its status This generates a digital twin copy, and the dynamic mapping process is represented as follows:

[0034] Makes any asset Its twin Maintaining consistency across key attributes (such as asset configuration, network topology, operating system, running services, port list, user permissions, access control policies, traffic patterns, and data status) is crucial. Semantic modeling of user permissions and access control policies ensures logical consistency to support the reproduction of complex attack chains such as lateral movement. Optionally, this dynamic mapping achieves near real-time consistency between asset information and the digital twin copy through incremental synchronization and event-driven updates. Furthermore, the asset-level digital twin engine provides a programmable modeling interface (API / DSL) to support dynamic asset mapping across clouds and platforms.

[0035] An attack simulation and control module is used to simulate a full attack using a digital twin copy within a digital twin environment. During the simulation, defense response data needs to be recorded for subsequent security strategy evaluation and analysis. This defense response data includes operation logs, system call chains, network behavior, and time-series data. In this embodiment, the attack modes employed by the attack simulation and control module when performing the full attack simulation include: Scripted mode: Executes attack simulation tasks according to configurable attack scripts, compatible with common automated attack library interfaces (for drills and scenario testing). Intelligent Mode: The attack simulation and control module dynamically optimizes attack paths by combining rule-based reasoning mechanisms and reinforcement learning strategies. First, the system establishes a rule-based reasoning model based on a pre-set attack knowledge base. This knowledge base includes association rules between asset types, service configurations, permission relationships, and known security vulnerabilities. An initial set of candidate attack paths is generated through rule matching and logical reasoning. Then, a reinforcement learning strategy is introduced to iteratively optimize the attack paths. The system constructs the environment state space for reinforcement learning by considering the asset states, network connectivity, and security policy states in the digital twin environment. Attack steps or lateral movement behaviors are abstracted into action sets, and reward feedback signals are generated based on the attack execution results. These feedback signals include indicators such as whether the attack steps were successfully executed, whether security protection mechanisms were triggered, the attack path length, and the proximity to the attack target. Finally, the reinforcement learning agent updates the reinforcement learning strategy based on the feedback signals, gradually adjusting the attack path selection strategy through multiple rounds of simulation training. This ensures that the generated attack paths gradually approximate the decision-making behavior of real attackers in complex network environments in terms of success rate, stealth, and path efficiency.

[0036] It should be noted that, in this embodiment of the invention, the attack simulation process is executed only in an isolated digital twin environment for security defense capability assessment and verification, and does not involve providing any attack code or executable exploit that can be directly used for illegal intrusion.

[0037] The harmless verification and telemetry injection module is used to perform feature injection attacks in the production environment. It also needs to record defense response data for subsequent security strategy evaluation and analysis. Therefore, feature injection is used instead of payload execution, achieving "payload-feature" separation of the attack behavior. The specific description of "payload-feature" is as follows: An attack behavior X is defined as a tuple, represented as:

[0038] in, Payload This refers to a program entity or set of instructions that performs state-altering or destructive actions during an attack (such as encrypting files, deleting data, or privilege escalation). Feature This refers to the observational traces that will inevitably be generated or left behind during the execution of an attack, which can be perceived externally, namely telemetry characteristics (such as specific system call sequences, network connection patterns, registry modification traces, IOC / IOA, etc.).

[0039] Therefore, the attack simulation and control module and the harmless verification and telemetry injection module of this invention realize a twin-production dual-track verification mechanism, such as Figure 2 As shown, that is: Executing a simulation task of a complete attack within a digital twin environment means performing a complete attack. .

[0040] In a production environment, signature injection attacks are performed using a secure injector. Only inject telemetry features , represented as .

[0041] Collaborative verification is performed on two tracks, one in the digital twin environment and the other in the production environment, around the same process nodes.

[0042] During the "input" phase of the process node, the complete attack payload is received in the high-fidelity environment and the attack behavior is executed in the isolated digital twin environment; while in the production environment, only harmless telemetry features are extracted from the attack payload and used as input.

[0043] During the "execution" phase of the process node, the high-fidelity environment executes the complete attack action, such as ransomware encryption or destructive operations like service paralysis; while the production environment only injects identifiable behavioral features related to the attack behavior, such as system API calls, network connection establishment, or file I / O behavior, thereby simulating attack traces without executing real destructive behavior.

[0044] At the "target" stage of the process node, the high-fidelity environment is used to verify whether the attack behavior can successfully achieve the attack target and to assess its destructive impact; while the production environment is used to verify whether the security protection system can detect the relevant attack traces.

[0045] In the "monitoring object" stage of the process node, security systems in high-fidelity environments (such as EDR, IDS, etc.) are used to detect attack behaviors and assess their defense capabilities; security systems in production environments (such as SIEM, EDR, etc.) are used to detect harmless telemetry features and assess detection accuracy and response speed.

[0046] At the "risk" stage of the process node, attacks in the high-fidelity environment pose a high risk, but because they run in an isolated digital twin environment, they will not affect real business operations; the harmless verification process in the production environment does not perform any destructive operations, thus maintaining zero risk to the business system.

[0047] At the "Results" stage of the process node, the high-fidelity environment outputs whether the attack was successful and its specific impact, such as the impact on the system recovery time objective (RTO) or recovery point objective (RPO); the production environment outputs whether the security system successfully triggered alarms, the alarm delay time, and whether there were false alarms or missed alarms, thus forming a complete defense capability assessment result.

[0048] The snapshot management and environment recovery module, based on the underlying snapshot mechanism of the digital twin environment (such as Copy-on-Write and file system-level snapshots), implements second-level snapshots and rollbacks. It generates a pre-attack snapshot before each attack and performs second-level resets based on the pre-attack snapshot when needed. It supports differentiated storage, incremental rollback, and multi-version management. Working in conjunction with the asset-level digital twin engine, it can restore the digital twin environment to any historical snapshot in a very short time, supporting concurrent testing scenarios. The pre-attack snapshots generated by the snapshot management and environment recovery module include: Output a complete initial baseline snapshot of the digital twin environment. This initial baseline snapshot records state data, including all states such as disk, memory, CPU, and network connection. Before each attack is executed, a current second-level snapshot is created based on the initial baseline snapshot for subsequent rapid rollback.

[0049] The security policy assessment and analysis module collects defense response data (alarms, interception actions, response times, etc.) from the digital twin environment and production environment, and automatically generates a defense capability index and optimization suggestions based on a defense capability index quantification model. The module supports policy change backtesting and evidence-based improvement path suggestions.

[0050] Based on the defense capability index quantification model, the defense capability index It can be quantified as:

[0051] in, As a defense capability index, The detection rate of injection features in the production environment is obtained from the defense response data of the harmlessness verification and telemetry injection module. The attack interception rate in the digital twin environment is obtained from the defense response data of the attack simulation and control module. The average response time, These are the weighting coefficients for each indicator, thus providing objective and quantifiable data support for optimizing the defense system.

[0052] After generating the defense capability index, the security policy evaluation and analysis module further generates security policy optimization suggestions based on the detection results and attack simulation data. Specifically, the security policy evaluation and analysis module performs correlation analysis on the attack behavior data recorded in the digital twin environment and the detection results of the security system in the production environment, identifies the characteristics of attack behaviors that are not detected or have delayed response, and compares them with the security policy rule base.

[0053] When the system detects that an attack has been successfully executed in the digital twin environment but has not triggered an alarm in the production environment, the security policy assessment and analysis module marks the telemetry features corresponding to the attack as potential detection blind spots and generates corresponding optimization suggestions, such as adding detection rules for the corresponding behavioral features, adjusting alarm thresholds, or supplementing correlation analysis rules.

[0054] In another implementation, if the system detects that the attack behavior has been identified but the response time exceeds a preset threshold, the security policy evaluation and analysis module analyzes possible bottleneck nodes based on the attack path and security device logs, and generates improvement and optimization suggestions, including policy rule optimization, detection priority adjustment or monitoring scope expansion.

[0055] Through the above analysis mechanism, the security policy assessment and analysis module can form a closed-loop analysis based on the attack simulation results and actual detection data, and automatically output security policy optimization suggestions to improve the overall defense capability.

[0056] The visualization management and operation interface module provides a unified visualization operation console for managing and operating various modules in the system, visualizing the generated data and analysis results, and generating reports based on the defense capability index and optimization suggestions. The visualized data originates from the attack simulation and control module, the harmless verification and telemetry injection module, and the security policy evaluation and analysis module.

[0057] In its implementation, the visualization management and operation interface module generates various visualizations based on data collected during system operation, including: graphical topology display based on network topology information generated by the asset-level digital twin engine; attack chain replay based on attack steps, attack paths, and time series data recorded by the attack simulation and control module; log time series visualization based on log data and telemetry features collected by the system; and risk assessment charts and analysis reports based on the defense capability index and detection results calculated by the security policy assessment and analysis module.

[0058] In addition, the visualization management and operation interface module supports task orchestration, which is used to configure attack simulation tasks, verification processes and execution order, and uniformly display the running status and analysis results during the execution process on the console interface. It also supports generating analysis reports and exporting them.

[0059] In one embodiment, the visual management and operation interface module can also connect with the existing Security Operations Center (SOC) platform through a standard interface to achieve centralized display, unified control and auditing of security verification results.

[0060] Using the aforementioned attack simulation and harmless verification system based on a digital twin dual-track architecture, such as Figure 3 As shown, a method for attack simulation and harmless verification based on a digital twin dual-track architecture can be implemented, including: The asset-level digital twin engine uses dynamic discovery technology to collect asset information from the production environment and dynamically maps the collected asset information into a digital twin copy in an isolated data twin environment.

[0061] The snapshot management and environment recovery module generates preset snapshots and performs a second-level reset based on the preset snapshots when it is necessary to continue the attack. This ensures that each attack test is conducted in a clean and consistent environment by immediately restoring the digital twin environment to the preset snapshot state. The requirement to continue the attack means that the current test batch has not been completed or has not met the preset termination test conditions.

[0062] The attack simulation and control module performs a full attack simulation task using a digital twin copy within a digital twin environment.

[0063] The harmlessness verification and telemetry injection module performs feature injection attacks in the production environment.

[0064] The security strategy assessment and analysis module collects defense response data from the digital twin environment and the production environment, and automatically generates defense capability indices and optimization suggestions based on quantifiable indicators.

[0065] The visualization management and operation interface module visualizes the generated data and analysis results, and generates reports based on the defense capability index and optimization suggestions.

[0066] The specific implementation of each step in the above method can be found in the description in the aforementioned system embodiments, and will not be repeated here.

[0067] Based on the same technical concept, embodiments of the present invention also provide an electronic device that can implement the attack simulation and harmless verification method based on a digital twin dual-track architecture provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 4 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 4 The example used is the connection between the processor and memory via a bus. The bus... Figure 4 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 4 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0068] In this embodiment of the invention, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute the attack simulation and harmless verification method based on a digital twin dual-track architecture discussed above.

[0069] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0070] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0071] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the attack simulation and harmless verification method based on a digital twin dual-track architecture disclosed in the embodiments of this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0072] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0073] By designing and programming the processor, the code corresponding to the attack simulation and harmless verification method based on a digital twin dual-track architecture described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the method described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0074] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform an attack simulation and harmless verification method based on a digital twin dual-track architecture as described above.

[0075] In some alternative embodiments, the present invention also provides a method for attack simulation and harmless verification based on a digital twin dual-track architecture, which can also be implemented as a program product including program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the method for attack simulation and harmless verification based on a digital twin dual-track architecture according to various exemplary embodiments of the present invention as described above.

[0076] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0079] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0080] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0081] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0082] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0083] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An attack simulation and harmless verification system based on a digital twin dual-track architecture, characterized in that, include: An asset-level digital twin engine is used to collect asset information from the production environment based on dynamic discovery technology, and dynamically map the collected asset information into a digital twin copy in an isolated data twin environment. The attack simulation and control module is used to simulate the execution of a complete attack using a digital twin copy within a digital twin environment. The harmless verification and telemetry injection module is used to perform feature injection attacks in the production environment; The snapshot management and environment recovery module is used to generate a preset snapshot before each attack is executed, and to perform a second-level reset based on the preset snapshot when needed; The security strategy assessment and analysis module is used to collect defense response data from the digital twin environment and the production environment, and automatically generate defense capability indices and optimization suggestions based on quantifiable indicators. The visualization management and operation interface module is used to manage and operate the various modules in the system, visualize the generated data and analysis results, and generate reports based on the defense capability index and optimization suggestions.

2. The attack simulation and harmless verification system based on a digital twin dual-track architecture as described in claim 1, characterized in that, The asset information includes asset sets and their status; the dynamic mapping is formalized as a mapping function. Through this mapping function The assets and their states in the production environment are mapped to the assets and their states in the digital twin environment, thereby generating a digital twin copy.

3. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The dynamic mapping is updated through incremental synchronization and event-driven updates.

4. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The asset-grade digital twin engine provides a programmable modeling interface.

5. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The attack modes when the attack simulation and control module executes a complete attack simulation task include: Scripted mode: Executes attack simulation tasks according to configurable attack scripts, compatible with common automated attack library interfaces; Intelligent mode: Combining rule-based reasoning and reinforcement learning strategies, the attack path is optimized based on feedback from the digital twin environment to approximate the decision-making logic of a real attacker.

6. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The snapshot management and environment recovery module generates preset snapshots including: Output a complete initial baseline snapshot of the digital twin environment, which records the status data; Before each attack is executed, a current second-level snapshot is created based on the initial baseline snapshot.

7. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The defense capability index is expressed as: in, As a defense capability index, The detection rate of injected features in the production environment is obtained from the defense response data of the harmlessness verification and telemetry injection module; The interception rate of attacks in the digital twin environment is obtained from the defense response data of the attack simulation and control module; The average response time, These are the weighting coefficients for each indicator.

8. The attack simulation and harmless verification system based on a digital twin dual-track architecture according to claim 1, characterized in that, The visualization management and operation interface module can interface with existing SOC platforms.

9. A method for attack simulation and harmless verification based on a digital twin dual-track architecture, characterized in that, include: The asset-level digital twin engine collects asset information from the production environment based on dynamic discovery technology and dynamically maps the collected asset information into a digital twin copy in an isolated data twin environment. The snapshot management and environment recovery module generates preset snapshots and performs second-level resets based on the preset snapshots when it is necessary to continue executing the attack. The attack simulation and control module performs a full attack simulation task using a digital twin copy within a digital twin environment; The harmlessness verification and telemetry injection module performs feature injection attacks in the production environment; The security strategy assessment and analysis module collects defense response data from the digital twin environment and the production environment, and automatically generates defense capability indices and optimization suggestions based on quantifiable indicators. The visualization management and operation interface module visualizes the generated data and analysis results, and generates reports based on the defense capability index and optimization suggestions.

10. The attack simulation and harmless verification method based on a digital twin dual-track architecture according to claim 9, characterized in that, The requirement to continue the attack refers to the current test batch not being completed or not meeting the preset termination conditions.

Images