Attack and defense drill method, system, storage medium and electronic device

Abstract

The present disclosure relates to the technical field of big data, and particularly relates to a red teaming method, a red teaming system, a storage medium and an electronic device. The red teaming method comprises: generating a big data set with a preset data volume in response to a user inputted red teaming requirement; and generating an attack model in response to a user attack configuration operation; wherein the big data set comprises data of multiple data sources, and the data comprises offline data and real-time data; performing red teaming on a to-be-tested system according to the big data set and the attack model by using a pre-configured attack tool to obtain red teaming data, and monitoring the to-be-tested system in real time to obtain monitoring data; and evaluating the red teaming according to the red teaming data and the monitoring data to obtain an evaluation result. The red teaming method provided by the present disclosure can solve the problem of great difficulty in implementing red teaming in a big data environment.

Description

Technical Field

[0001] This disclosure relates to the field of database testing technology, specifically to an attack and defense exercise method, an attack and defense exercise system, a storage medium, and an electronic device. Background Technology

[0002] Attack and defense drills are activities that simulate cyberattacks and defenses, aiming to test and improve an organization's cybersecurity defense capabilities. Big data attack and defense drills, on the other hand, simulate attacks and defenses against big data assets in a big data environment.

[0003] Big data attack and defense drills differ from traditional fault drills. Traditional drills only need to cover aspects such as machine resources, interface performance, and degradation dependencies; the path is clear, the cost of constructing the environment is low, and implementation is relatively easy. Big data attack and defense, however, focuses on the data itself, requiring the construction of massive amounts of data and the data production process. It also demands high levels of skill from the drill participants, and the cost of constructing the environment and conditions is high, making implementation much more difficult. Currently, there is no universal solution; most drills focus on traditional fault-finding methods and are not effective at identifying problems.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this disclosure is to provide an attack and defense exercise method, an attack and defense exercise system, a storage medium, and an electronic device, aiming to solve the problem of the difficulty in implementing attack and defense exercises in a big data environment.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of the embodiments of this disclosure, an attack and defense exercise method is provided, comprising: generating a large dataset of a preset amount of data in response to user-inputted exercise requirements; and generating an attack model in response to user attack configuration operations; wherein the large dataset includes data from multiple data sources, including offline data and real-time data; using pre-configured attack tools, performing an attack and defense exercise on a system under test according to the large dataset and the attack model to obtain exercise data, and monitoring the system under test in real time to obtain monitoring data; and evaluating the attack and defense exercise based on the exercise data and the monitoring data to obtain an evaluation result.

[0008] Optionally, when the test rule in the exercise requirements is TPC-DS, the method further includes: generating the large dataset using the data generation tool of TPC-DS, and generating query statements using the query generation tool of TPC-DS to index the large dataset.

[0009] Optionally, the method further includes: pre-configuring the attack tool, which includes one or more of a vulnerability scanning tool, an SQL injection tool, and a DDoS attack tool.

[0010] Optionally, the exercise data includes attack data and defense data. The step of obtaining the exercise data by conducting attack and defense exercises on the system under test according to the big data set and the attack model includes: simulating business scenarios based on the big data set and the attack model to launch attack operations on the system under test, and recording the attack operations to obtain the attack data; the system under test monitors the operating status of the system under test in real time, and performs defense operations when the attack operation is detected, and records the defense operations to obtain the defense data.

[0011] Optionally, the real-time monitoring of the system under test to obtain monitoring data includes: real-time acquisition of system performance index data of the system under test; and / or real-time monitoring of whether there are security events in the system under test, and locating the source and scope of impact of the security events to obtain security event information when security events exist.

[0012] Optionally, after obtaining the evaluation results, the method further includes: generating a set of training use cases based on the large dataset and the attack model.

[0013] According to a second aspect of this disclosure, an attack and defense exercise system is provided, comprising: a data management layer, which generates a large dataset of a preset amount of data based on user-inputted exercise requirements, manages the large dataset, and records exercise data during the attack and defense exercise; an attack simulation layer, which provides pre-configured attack tools, generates an attack model based on user-configured attack operations, and executes attack operations; a defense system layer, which monitors the operating status of the system under test in real time and executes defense operations when an attack is detected; and a monitoring and evaluation layer, which collects monitoring data of the system under test in real time during the attack and defense exercise, and evaluates the attack and defense exercise based on the exercise data and the monitoring data to obtain an evaluation result.

[0014] Optionally, the attack and defense exercise system further includes: an infrastructure layer that provides computing resources for distributed computing of the large dataset, storage resources for distributed storage of the large dataset, and network resources for data communication of the large dataset.

[0015] According to a third aspect of the present disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the attack and defense exercise method as described in the above embodiments.

[0016] According to a fourth aspect of the present disclosure, an electronic device is provided, characterized in that it includes: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the attack and defense exercise method as described in the above embodiments.

[0017] The exemplary embodiments disclosed herein may have some or all of the following beneficial effects:

[0018] In the technical solutions provided by some embodiments of this disclosure, on the one hand, the attack and defense exercises provided by this disclosure can generate a large dataset with a preset amount of data according to the exercise requirements, which can simulate real business scenarios and different levels of data pressure, thus solving the problem of big data construction and preparation; on the other hand, through the design of a generalized exercise platform, commonly used exercise tools and methods are integrated, which lowers the threshold for big data attack and defense exercises and can improve the execution efficiency of big data attack and defense exercises; furthermore, by integrating corresponding monitoring methods and evaluation systems, the exercise effects can be summarized and reviewed, providing a basis for subsequent exercise improvements.

[0019] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0021] Figure 1 The schematic diagram illustrates a flowchart of an attack and defense drill method according to an exemplary embodiment of the present disclosure;

[0022] Figure 2 The illustration shows a flowchart of an attack and defense exercise in an exemplary embodiment of the present disclosure.

[0023] Figure 3 This illustration schematically shows a data flow diagram of an attack and defense exercise in an exemplary embodiment of the present disclosure;

[0024] Figure 4This schematic diagram illustrates the composition of an attack and defense drill system according to an exemplary embodiment of the present disclosure;

[0025] Figure 5 The schematic diagram illustrates the structure of a computer system of an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0026] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art.

[0027] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0028] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0029] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0030] Attack and defense drills are activities that simulate cyberattacks and defenses, aiming to test and improve an organization's cybersecurity defense capabilities. Big data attack and defense drills, on the other hand, simulate attacks and defenses against big data assets in a big data environment.

[0031] Big data attack and defense drills differ from traditional drills. Traditional drills cover aspects such as machine resources, interface performance, and dependency degradation, with clear paths and low-cost environment construction, making them relatively easy to implement. Big data attack and defense drills, however, focus on the data itself. They require constructing massive amounts of data and understanding the data production process. The large scale and diverse types of data increase computational complexity and difficulty, and also contribute to the low data value density. This places high demands on the skills of the drill participants, and the cost of constructing the environment and conditions is also very high.

[0032] Existing big data attack and defense drills, whether from the perspective of data preparation or the actual drill results, do not quite meet the requirements of big data testing. They cannot effectively discover potential risks and place high demands on big data testers. With the development of the big data era, massive data scenarios have become commonplace. How to efficiently and quickly complete big data fault drills, discover potential risks and omissions in SOP processes, ensure data accuracy and security, and provide basic data protection for business is a current challenge.

[0033] To address the problems existing in current technologies, this disclosure provides an attack and defense exercise method. It utilizes TPC-DS tools such as dsdgen to generate simulated large datasets that closely resemble real-world business scenarios. The data volume can be adjusted according to exercise requirements, focusing on solving the challenges of constructing and preparing large datasets. Then, based on the constructed massive dataset, various attack scenarios are simulated using toolsets such as SQL injection and DDoS attacks. Defense strategies are tested while attacks are conducted, and a monitoring and evaluation system is designed, including performance monitoring, security event monitoring, and evaluation metric settings. All indicators of the attack and defense exercise are fully recorded, and the effectiveness of the entire attack and defense process is evaluated, achieving a complete closed loop.

[0034] The implementation details of the technical solutions of the embodiments of this disclosure are described in detail below.

[0035] Figure 1 This schematic diagram illustrates a flowchart of an attack and defense drill method according to an exemplary embodiment of this disclosure. Figure 1 As shown, this attack and defense exercise method includes steps S101 to S105:

[0036] Step S101: In response to the user's input exercise requirements, a large dataset with a preset data volume is generated; and in response to the user's attack configuration operation, an attack model is generated; wherein, the large dataset includes data from multiple data sources, and the data includes offline data and real-time data;

[0037] Step S103: Using pre-configured attack tools, conduct attack and defense drills on the system under test according to the large dataset and the attack model to obtain drill data, and monitor the system under test in real time to obtain monitoring data;

[0038] Step S1015: Evaluate the attack and defense exercise based on the exercise data and the monitoring data to obtain the evaluation result.

[0039] In the technical solutions provided by some embodiments of this disclosure, on the one hand, the attack and defense exercises provided by this disclosure can generate a large dataset with a preset amount of data according to the exercise requirements, which can simulate real business scenarios and different levels of data pressure, thus solving the problem of big data construction and preparation; on the other hand, through the design of a generalized exercise platform, commonly used exercise tools and methods are integrated, which lowers the threshold for big data attack and defense exercises and can improve the execution efficiency of big data attack and defense exercises; furthermore, by integrating corresponding monitoring methods and evaluation systems, the exercise effects can be summarized and reviewed, providing a basis for subsequent exercise improvements.

[0040] The following will describe in more detail each step of the attack and defense exercise method in this example embodiment, with reference to the accompanying drawings and embodiments.

[0041] In step S101, a large dataset with a preset amount of data is generated in response to the user's input exercise requirements; and an attack model is generated in response to the user's attack configuration operation.

[0042] The implementation of the attack and defense drills is supported by the drill platform. Users input their drill requirements into the drill platform, and the platform can generate a large dataset based on those requirements.

[0043] Big data is a collection of data that cannot be captured, managed, and processed within a certain time frame using conventional software tools. It requires new processing models to have stronger decision-making, insight discovery, and process optimization capabilities to adapt to massive, high-growth, and diverse information assets. Big data is characterized by its huge data volume, diverse data types, fast processing speed, low value density, and high commercial value. It includes data from multiple data sources, including offline data and real-time data.

[0044] In addition, the amount of data in the big dataset can be adjusted according to the needs of the exercise, such as setting it to different scales like 1TB or 10TB, to simulate different levels of data pressure and focus on solving the challenges of big data construction and preparation.

[0045] The generated big data set can include multi-dimensional information such as sales records, customer information, and inventory data to closely resemble real business scenarios.

[0046] Specifically, when the test rule in the exercise requirements is TPC-DS, the method further includes: generating the large dataset using the data generation tool of TPC-DS, and generating query statements using the query generation tool of TPC-DS to index the large dataset.

[0047] TPC-DS (Transaction Processing Performance Council-Decision Support Benchmark) is a decision support benchmark designed by the Transaction Processing Performance Council (TPC) and is primarily used to evaluate the analytical performance of database management systems.

[0048] Its data generation tools, such as dsdgen, can be used to generate large-scale test datasets that conform to the TPC-DS specification. These datasets can be adjusted in terms of data volume and distribution as needed to meet the testing requirements of different scales and scenarios.

[0049] Its query generation tools, such as dsqgen, can automatically generate SQL query statements of different sizes and complexities based on TPC-DS query templates and rules, facilitating comprehensive performance testing of the database.

[0050] Therefore, based on TPC-DS's powerful data generation and preparation capabilities, it can generate large datasets required for attack and defense drills according to business characteristics, and easily generate test data that meets business needs, greatly saving time in constructing massive amounts of data and the data output process.

[0051] Step S101 also requires generating an attack model based on the user's attack configuration. The user performs the attack configuration operation on the training platform.

[0052] Users can configure different attack scenarios according to their training needs, including parameters such as attack type, attack intensity, and attack time, to achieve flexible attack simulation. Examples of configurable attack models include:

[0053] Data breach attacks are attacks that attempt to obtain sensitive data through vulnerability exploitation, SQL injection, or other means, such as querying tables containing customer privacy information to test the system's control and monitoring capabilities for data access.

[0054] Data tampering attacks simulate hackers maliciously altering data, such as modifying sales data or inventory quantities, to test data integrity protection mechanisms and anomaly detection capabilities.

[0055] Denial-of-service attacks involve launching a large number of query requests or data loading operations to exhaust system resources. This serves to assess the system's stability and resistance to attacks under high concurrency and large data volumes.

[0056] It should be noted that the training platform provides a range of common attack tools to facilitate simulated attacks. Users can configure attacks based on these tools, which greatly reduces the difficulty of configuration and significantly lowers the requirements for training personnel.

[0057] In step S103, using pre-configured attack tools, attack and defense drills are conducted on the system under test according to the large dataset and the attack model to obtain drill data, and the system under test is monitored in real time to obtain monitoring data.

[0058] Specifically, the attack simulation layer of the training platform provides an attack toolset, including a series of common attack tools. Therefore, the method also includes: pre-configuring the attack tools, which include one or more of vulnerability scanning tools, SQL injection tools, and DDoS attack tools. These attack tools require developers to integrate and develop the corresponding attack functions.

[0059] Vulnerability scanning tools can scan for system vulnerabilities, which can then be used to launch data breach attacks, data tampering attacks, and other attacks. SQL injection tools can be used to generate SQL statements to retrieve data, thereby enabling data breach attacks, denial-of-service attacks, and other attacks. DDoS attack tools can be used as software or scripts to launch distributed denial-of-service attacks, thereby disrupting target network services. Of course, the attack tools provided in this disclosure are merely illustrative and are not intended to be specific.

[0060] Based on the above methods, by designing and integrating a general-purpose training platform, commonly used training tools and methods are integrated, which lowers the threshold for big data attack and defense training and can improve the execution efficiency of big data attack and defense training.

[0061] Attack and defense drills are activities that simulate cyberattacks and defenses, aiming to test and improve an organization's cybersecurity defense capabilities.

[0062] In one embodiment of this disclosure, the exercise data includes attack data and defense data. The step of obtaining the exercise data by conducting attack and defense exercises on the system under test according to the big data set and the attack model includes: simulating business scenarios based on the big data set and the attack model to launch attack operations on the system under test, and recording the attack operations to obtain the attack data; the system under test monitors the operating status of the system under test in real time, and performs defense operations when the attack operation is detected, and records the defense operations to obtain the defense data.

[0063] After the user configures the attack model, the attack simulation layer launches an attack in a simulated business scenario according to the usual drill process. Relying on these attack tools, it executes attack operations according to these attack models, monitors the progress and effect of the attack in real time, and records relevant data and events during the attack process to obtain attack data.

[0064] Simultaneously, the platform's defense system layer, relying on pre-determined defense strategies, locates problems, restores the scene, provides early warnings and blocks potential attacks, and records and monitors the detailed defense process to obtain defense data. Specific defense strategy implementation examples include:

[0065] Access control and authentication: Strictly restrict access to data, implement multi-factor authentication to ensure that only authorized users can access sensitive data, and assign different operation permissions according to the user's role and permissions;

[0066] Data encryption: Encrypts the storage and transmission of important data, supports multiple encryption algorithms and key management methods, and ensures the security and confidentiality of data. Even if the data is stolen, it is difficult for attackers to obtain plaintext information.

[0067] Intrusion Detection and Prevention System: Deploy an intrusion detection system based on big data analytics to monitor abnormal behavior and attack signs in real time. By establishing behavioral models and rule bases, it can provide early warnings and block potential attacks, issue timely alerts, and take blocking measures.

[0068] Data Backup and Recovery: Perform regular data backups and test the availability and recovery speed of the backup data to ensure that data can be quickly recovered in the event of data loss or corruption due to an attack.

[0069] In one embodiment of this disclosure, the real-time monitoring of the system under test to obtain monitoring data includes: real-time acquisition of system performance index data of the system under test; and / or real-time monitoring of whether there are security events in the system under test, and locating the source and scope of impact of the security events when they exist to obtain security event information.

[0070] Specifically, it collects real-time system performance metrics data of the system under test, such as CPU utilization, memory usage, disk I / O, network bandwidth, query response time, and data loading speed, to assess the impact of attacks on system performance. It can also display the system's performance status through a visual interface to promptly identify performance bottlenecks and anomalies.

[0071] At the same time, it can also monitor and record security events that occur in the system in real time, including attack events, vulnerability events, data leakage events, etc. Through correlation analysis and tracing technology, the source and scope of impact of security events can be quickly located.

[0072] In step S1015, the attack and defense exercise is evaluated based on the exercise data and the monitoring data to obtain an evaluation result.

[0073] Specifically, evaluation indicators for attack and defense exercises can be set, such as attack detection rate, false alarm rate, data leakage amount, system recovery time, etc. The results of attack and defense exercises can be quantitatively calculated and analyzed based on exercise data and monitoring data, and the evaluation results can be displayed in the form of charts, reports and other forms.

[0074] Based on the above methods, and by integrating corresponding monitoring methods and evaluation systems, we can effectively summarize and review the results of the exercises, providing a basis for improving subsequent exercises.

[0075] In one embodiment of this disclosure, after obtaining the evaluation results, the method further includes: generating a set of training use cases based on the large dataset and the attack model.

[0076] Specifically, after the exercise is completed, follow-up plans are determined and a set of fresh test cases is maintained. The exercise content is then consistently executed, with attack and defense scenarios performed regularly. New scenarios are added, and generalized technical solutions are integrated into daily iterations. In this way, by continuously improving the exercise process and system, a generalized technical solution is formed, providing a set of exercise cases for the consistent execution of big data attack and defense exercises. This allows for earlier exposure of problems and risks, safeguarding the application of big data in business and playing a significant role in improving overall data quality and ensuring online business operations.

[0077] Figure 2 This illustration schematically depicts a flowchart of an attack and defense exercise according to an exemplary embodiment of this disclosure. Figure 2 As shown, the attack and defense exercise mainly consists of the attacking red team, the defending blue team, and the backup team responsible for monitoring and evaluation.

[0078] refer to Figure 2 As shown, the main tasks undertaken by the Red Team include: preparing the conditions for the exercise, i.e., preparing data or scripts; determining the method of initiation, whether it is a live attack or a fixed-point attack; executing the predetermined exercise plan; dynamically adjusting strategies; recording the attack process and data; and stopping the attack: resuming or intervening as a backup.

[0079] The main tasks undertaken by the blue team include: analyzing and monitoring anomalies and alarms, implementing defensive measures; communicating and coordinating resources; recording the response process and data; and resuming operations or providing backup after the defense is completed.

[0080] During the attack and defense drills, the backup team is responsible for handling unexpected situations, providing backup solutions for potential problems, ensuring the smooth progress of the drills, and conducting monitoring and evaluation. Finally, the attack records of the red team and the defense records of the blue team are aggregated into the attack and defense drill platform to obtain a summary drill report.

[0081] Figure 3 This illustration schematically depicts a data flow diagram of an attack and defense exercise according to an exemplary embodiment of this disclosure. For example... Figure 3As shown, the offensive and defensive drills are mainly divided into three stages: preparation, drill, and debriefing.

[0082] During the preparation phase, the exercise team needs to define the exercise objectives and scope, develop exercise procedures and standards, conduct risk assessments and formulate contingency plans, and establish and assign tasks to the exercise team. The technical support team completes the preparation of the exercise environment, exercise data, and exercise scripts, thereby determining the final attack model, including the scenario, time, and scope. The attack team launches an attack according to the attack model, while the defense team determines the defense monitoring and defense methods. The fallback team determines the fallback plan and emergency response plan.

[0083] During the exercise phase, the exercise team initiated the exercise, with the red team attacking the blue team's defense. If the defense was successful, the scene would be restored; if the defense was unsuccessful, a fallback plan would be implemented before restoring the scene.

[0084] In the debriefing phase, environmental cleanup and data cleaning are carried out after the exercise, followed by a summary of the exercise records, including problem analysis, improvement measures, and follow-up plans.

[0085] In one embodiment of this disclosure, an attack and defense drill system is also provided. Figure 4 This diagram schematically illustrates the composition of an attack and defense drill system according to an exemplary embodiment of this disclosure. Figure 4 As shown, the attack and defense drill system includes:

[0086] The data management layer 401 generates a large dataset with a preset data volume based on the user's input exercise requirements, performs data management on the large dataset, and records the exercise data in the attack and defense exercise.

[0087] Attack simulation layer 402 provides pre-configured attack tools, generates attack models based on user-configured attack operations, and executes attack operations;

[0088] Defense system layer 403 monitors the operating status of the system under test in real time and performs defensive operations when an attack is detected.

[0089] The monitoring and evaluation layer 404 collects monitoring data of the system under test in real time during the attack and defense exercise, and evaluates the attack and defense exercise based on the exercise data and the monitoring data to obtain the evaluation result;

[0090] Infrastructure layer 405 provides computing resources for distributed computing on the large dataset, storage resources for distributed storage of the large dataset, and network resources for data communication on the large dataset.

[0091] The data management layer 401 can include a data acquisition module, a data preprocessing module, and a data storage and management module. The data acquisition module is responsible for collecting data from various data sources, including log files, database records, and network traffic, and importing it into the platform for unified management. The acquired data can serve as a large dataset for drills or as reference data for generating large datasets. The data preprocessing module performs preprocessing operations such as cleaning, transformation, and normalization on the acquired data to improve its quality and usability. The data storage and management module stores the preprocessed data in appropriate storage media and establishes data indexes and metadata management mechanisms to facilitate data querying and retrieval.

[0092] The attack simulation layer 402 may include an attack toolset, an attack scenario configuration module, and an attack execution and monitoring module. The attack toolset provides a range of common attack tools, such as vulnerability scanning tools, SQL injection tools, and DDoS attack tools, facilitating attackers to simulate attacks. The attack scenario configuration module allows users to configure different attack scenarios according to their training needs, including parameters such as attack type, attack intensity, and attack time, enabling flexible attack simulation. The attack execution and monitoring module is responsible for executing attack operations and monitoring the progress and effects of the attack in real time, recording relevant data and events during the attack process.

[0093] Defense system layer 403 may include an access control and authentication module, a data encryption module, an intrusion detection and prevention module, and a data backup and recovery module. The access control and authentication module is used to authenticate users and control access permissions, ensuring that only legitimate users can access system resources and assigning different operational permissions based on user roles and privileges. The data encryption module is used to encrypt sensitive data, supporting multiple encryption algorithms and key management methods to ensure data security and confidentiality. The intrusion detection and prevention module uses big data analytics to monitor abnormal system behavior and attack signs in real time, establishing behavioral models and rule bases to provide early warnings and block potential attacks. The data backup and recovery module is used to periodically back up data and provides data recovery functionality, ensuring rapid data recovery in the event of an attack or data loss.

[0094] The monitoring and evaluation layer 404 includes a performance monitoring module, a security event monitoring module, and an evaluation metric calculation and display module. The performance monitoring module collects real-time system performance data, such as CPU utilization, memory usage, disk I / O, and network bandwidth, and displays the system's performance status through a visual interface, enabling timely detection of performance bottlenecks and anomalies. The security event monitoring module monitors and records security events occurring in the system in real time, including attack events, vulnerability events, and data breaches. Through correlation analysis and tracing techniques, it quickly locates the source and scope of impact of security events. The evaluation metric calculation and display module quantifies and analyzes the results of attack and defense drills based on set evaluation metrics, and displays the evaluation results through charts, reports, and other formats, providing data support for the summary and improvement of the drills.

[0095] The infrastructure layer 405 comprises the computing resource layer, storage resource layer, and network resource layer. Computing resources provide distributed computing architectures, such as Hadoop and Spark, offering powerful computing capabilities to handle the processing and analysis of large datasets. The storage resource layer provides distributed file systems or data warehouses, such as HDFS, Cassandra, and HBase, storing massive amounts of data and ensuring high availability and reliability. The network resource layer builds a high-speed, stable network architecture to ensure data transmission and communication, while also setting up network security devices such as firewalls and intrusion detection systems to prevent external attacks.

[0096] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0097] In exemplary embodiments of this disclosure, a storage medium capable of implementing the above-described methods is also provided. It may be a portable compact disc read-only memory (CD-ROM) and include program code, and can run on a terminal device, such as a mobile phone. However, the program product of this disclosure is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0098] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided. Figure 5 The schematic diagram illustrates the structure of a computer system of an electronic device according to an exemplary embodiment of the present disclosure.

[0099] It should be noted that, Figure 5 The computer system 500 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0100] like Figure 5 As shown, the computer system 500 includes a Central Processing Unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 502 or programs loaded from storage section 508 into Random Access Memory (RAM) 503. The RAM 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An Input / Output (I / O) interface 505 is also connected to the bus 504.

[0101] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. Removable media 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 510 as needed so that computer programs read from them can be installed into storage section 508 as needed.

[0102] In particular, according to embodiments of this disclosure, the processes described below with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs various functions defined in the system of this disclosure.

[0103] It should be noted that the computer-readable medium shown in the embodiments of this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0104] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0105] The units described in the embodiments of this disclosure can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the unit itself.

[0106] In another aspect, this disclosure also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs that, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0107] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0108] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this disclosure.

[0109] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein.

[0110] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. A method for conducting offensive and defensive drills, characterized in that, include: Generate a large dataset with a preset amount of data in response to user input for exercise requests; And generate attack models in response to user attack configuration operations; wherein, the large dataset includes data from multiple data sources, including offline data and real-time data; Using pre-configured attack tools, attack and defense drills are conducted on the system under test according to the large dataset and the attack model to obtain drill data, and the system under test is monitored in real time to obtain monitoring data. The attack and defense exercise is evaluated based on the exercise data and the monitoring data to obtain the evaluation results.

2. The attack and defense drill method according to claim 1, characterized in that, When the test rule in the exercise requirements is TPC-DS, the method further includes: The large dataset is generated using the TPC-DS data generation tool, and query statements are generated using the TPC-DS query generation tool to index the large dataset.

3. The attack and defense drill method according to claim 1, characterized in that, The method further includes: pre-configuring the attack tools, which include one or more of vulnerability scanning tools, SQL injection tools, and DDoS attack tools.

4. The attack and defense drill method according to claim 1, characterized in that, The exercise data includes attack data and defense data. The exercise data obtained by conducting attack and defense exercises on the system under test according to the big data set and the attack model includes: Based on the big data set and the attack model, simulate business scenarios to launch attack operations on the system under test, and record the attack operations to obtain the attack data; The system under test monitors the operating status of the system under test in real time, and performs defensive operations when the attack operation is detected, and records the defensive operations to obtain the defensive data.

5. The attack and defense drill method according to claim 1, characterized in that, The real-time monitoring of the system under test obtains monitoring data, including: Real-time acquisition of system performance index data of the system under test; and / or The system monitors in real time whether there are security events in the system under test, and when a security event exists, it locates the source and scope of the security event to obtain security event information.

6. The attack and defense drill method according to claim 1, characterized in that, After obtaining the evaluation results, the method further includes: A set of training test cases is generated based on the large dataset and the attack model.

7. An attack and defense drill system, characterized in that, include: The data management layer generates a large dataset with a preset data volume based on the user's input exercise requirements, manages the large dataset, and records the exercise data in the attack and defense exercise. The attack simulation layer provides pre-configured attack tools, generates attack models based on the user's attack configuration, and executes attack operations. The defense system layer monitors the operational status of the system under test in real time and performs defensive actions when an attack is detected. The monitoring and evaluation layer collects monitoring data of the system under test in real time during the attack and defense exercise, and evaluates the attack and defense exercise based on the exercise data and the monitoring data to obtain the evaluation result.

8. The attack and defense drill system according to claim 7, characterized in that, The attack and defense drill system also includes: The infrastructure layer provides computing resources for distributed computing on the large dataset, storage resources for distributed storage of the large dataset, and network resources for data communication of the large dataset.

9. A computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the attack and defense exercise method as described in any one of claims 1 to 6.

10. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the attack and defense exercise method as described in any one of claims 1 to 6.

Images