Method, apparatus, system, device and medium for testing multi-stage protection strategy

Abstract

The application discloses a multi-stage protection strategy testing method, device, system, equipment and medium. The method comprises the following steps: obtaining a feature transmission path of test data between multiple serial processing stages of a target device through a feature traversal tracking mechanism, the feature transmission path corresponding to an associated mapping result of processing data of the test data in each serial processing stage, wherein the processing data comprises a global tracking identifier and local processing data corresponding to each serial processing stage; and obtaining an evaluation result of a protection strategy corresponding to the multiple serial processing stages based on the feature transmission path. The method realizes comprehensive testing of the multi-stage protection strategy of the target device through parallel monitoring of multiple monitoring channels and a feature traversal tracking mechanism corresponding to the global tracking identifier, can accurately evaluate the cooperative effect of the protection strategies of each stage and the transmission integrity of data features between different stages, and solves the technical problem that the existing serial black box testing is difficult to track intermediate states.

Description

Technical Field

[0001] This application relates to the field of network security testing technology, specifically to a testing method, apparatus, system, equipment, and medium for a multi-stage protection strategy. Background Technology

[0002] In existing network security devices, in order to ensure the accuracy and security of network traffic processing, a multi-stage protection strategy (corresponding to a multi-stage serial processing architecture) is usually adopted to process the data stream. That is, the data stream goes through multiple processing stages in sequence for filtering, cleaning or transformation. In order to ensure the effectiveness of the protection strategy at each stage, it is necessary to conduct comprehensive testing on the protection strategy at each stage.

[0003] However, during comprehensive monitoring and testing, due to the existence of the above-mentioned multiple processing stages, the throughput of the device cluster is usually at the terabits per second (Tbps) level. Correspondingly, the number of data packets processed by a single node per second may be hundreds of millions, which results in a large number of data packets processed by a single node per second, increasing the difficulty of manual troubleshooting.

[0004] Secondly, existing testing methods mainly employ single-stage testing or simple end-to-end serial testing. Such testing methods can only obtain the final processing result, making it difficult to accurately locate the specific stage at which the data flow anomaly occurs, and also unable to accurately evaluate the synergistic effect between protection strategies at each stage, resulting in incomplete test coverage and low efficiency in troubleshooting. Summary of the Invention

[0005] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a testing method, device, system, equipment and medium for multi-stage protection strategies. This method realizes comprehensive testing of the multi-stage protection strategy of the target device through parallel monitoring of multiple monitoring channels and feature-based tracking mechanism corresponding to global tracking identifiers. It can accurately evaluate the synergistic effect of each stage of protection strategy and the integrity of data feature transmission between different stages, and solves the technical problem that it is difficult to track intermediate states in existing serial black-box testing.

[0006] In a first aspect, the present invention provides a testing method for a multi-stage protection strategy, the method comprising: The feature transfer path of test data between multiple serial processing stages of the target device is obtained through a feature-crossing tracing mechanism. The feature transfer path corresponds to the association mapping result of the processed data in each serial processing stage. The processed data includes a global tracing identifier and local processed data corresponding to each serial processing stage. Based on the feature propagation path, the evaluation results of the protection strategies corresponding to multiple serial processing stages are obtained. The execution steps for obtaining the feature transmission path through the feature-crossing tracking mechanism include: multiple monitoring channels synchronously acquiring the input and output data, processing time, and policy triggering status of the test data in each serial processing stage through data capture; and generating local processing data corresponding to each serial processing stage based on the input and output data, processing time, and policy triggering status; wherein each monitoring channel corresponds to one serial processing stage. Based on the global tracking identifier in the processed data, local processed data belonging to the same test data are matched, and the matched local processed data are sorted according to the preset time benchmark to generate feature transmission paths; wherein, the preset time benchmark is used to provide a unified timestamp mark for the collected processed data and ensure time synchronization between multiple monitoring channels.

[0007] In one possible implementation, after obtaining the feature propagation path corresponding to the test data, the method further includes: Anomaly detection is performed on the feature transfer path. If an anomaly in feature transfer is detected between adjacent serial processing stages, the abnormal node is located and the feature transfer path is updated based on the abnormal node.

[0008] In one possible implementation, if a feature transfer anomaly is detected between adjacent serial processing stages, the anomaly node is located, including: The input and output data corresponding to adjacent serial processing stages are obtained sequentially, and the key feature identifiers in the input and output data are compared. If the subsequent serial processing stage does not receive the output data of the previous serial processing stage, or if the key feature identifier in the input and output data undergoes abnormal changes during transmission, it is determined that there is a feature transmission abnormality between adjacent serial processing stages. The serial processing stage where the feature transmission anomaly occurs and / or the transmission link between adjacent serial processing stages where the feature transmission anomaly occurs are identified as abnormal nodes. The policy triggering state corresponding to the abnormal node is recorded, and the feature transmission path is updated based on the abnormal changes in the policy triggering state and the key feature identifier.

[0009] In one possible implementation, the method further includes: The time synchronization period is dynamically adjusted according to the protection delay status of the target equipment, and a precise time protocol is used to periodically synchronize the time of each monitoring channel according to the adjusted time synchronization period.

[0010] In one possible implementation, based on the feature propagation path, the evaluation results of the protection strategies corresponding to multiple serial processing stages are obtained, including: Based on the feature transfer path, the verification pass rate, resource consumption rate and processing time of each serial processing stage are statistically analyzed, and a single strategy evaluation report corresponding to each serial processing stage is generated. Statistically analyze the overall pass rate and average processing time of the protection strategy combinations corresponding to different serial processing stages, and generate a multi-strategy combination evaluation report corresponding to multiple serial processing stages; Based on single-strategy evaluation reports and multi-strategy combination evaluation reports, the synergistic effect of protection strategies and the integrity of data flow transmission are determined.

[0011] In one possible implementation, multiple monitoring channels correspond to a five-channel parallel monitoring architecture. These channels acquire the processed data of the test data at each serial processing stage, including: For any monitoring channel in the five-channel parallel monitoring architecture, the channel monitoring plugin in the monitoring channel is used to collect the raw processing data of the corresponding serial processing stage; The channel monitoring plugin is used to clean the raw processed data and obtain the processed data of the test data in each serial processing stage.

[0012] Secondly, a testing device for a multi-stage protection strategy is provided, the device comprising: The acquisition module is used to obtain the feature transfer path of test data between multiple serial processing stages of the target device through a feature-crossing tracing mechanism. The feature transfer path corresponds to the association mapping result of the processed data in each serial processing stage. The processed data includes a global tracing identifier and local processed data corresponding to each serial processing stage. The evaluation module is used to obtain the evaluation results of the protection strategies corresponding to multiple serial processing stages based on the feature transmission path. The execution steps for obtaining the feature transmission path through the feature-crossing tracking mechanism include: multiple monitoring channels synchronously acquiring the input and output data, processing time, and policy triggering status of the test data in each serial processing stage through data capture; and generating local processing data corresponding to each serial processing stage based on the input and output data, processing time, and policy triggering status; wherein each monitoring channel corresponds to one serial processing stage. Based on the global tracking identifier in the processed data, local processed data belonging to the same test data are matched, and the matched local processed data are sorted according to the preset time benchmark to generate feature transmission paths; wherein, the preset time benchmark is used to provide a unified timestamp mark for the collected processed data and ensure time synchronization between multiple monitoring channels.

[0013] Thirdly, a multi-stage protection system is provided, which includes a target device having multiple serial processing stages and a test device for the multi-stage protection strategy in the second aspect. The testing device has multiple monitoring channels that are connected to multiple serial processing stages of the target device.

[0014] Fourthly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, it implements the method of any one of the first aspects above.

[0015] Fifthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the method of any one of the first aspects above.

[0016] Compared to existing technologies where manual troubleshooting is difficult and primarily focuses on single-stage or simple end-to-end serial testing methods, the testing method, apparatus, system, equipment, and medium for multi-stage protection strategies provided in this application, on the one hand, form a bypass parallel acquisition mechanism based on multiple monitoring channels corresponding to multiple serial processing stages. This allows for the acquisition of local processing data at each stage without interfering with the normal operation of the protection strategy under test, solving the problem of the invisibility of intermediate states during serial processing. On the other hand, through an association mapping mechanism based on data processing timing and global tracking identifiers, abnormal situations in the transmission of data streams between subsequent stages can be effectively identified and located, overcoming the shortcomings of general link tracing technology in adapting to the discontinuous characteristics of data streams. In addition, the evaluation results generated based on the reconstructed feature transmission path can comprehensively and accurately reflect the synergistic effect of the multi-stage protection strategy and the integrity of data stream transmission, thereby significantly improving the comprehensiveness of testing and the efficiency of fault diagnosis. Attached Figure Description

[0017] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart illustrating a testing method for a multi-stage protection strategy provided in an embodiment of this application. Figure 2 This is a sequence diagram of component interactions in the overall architecture provided in the embodiments of this application; Figure 3 This is another flowchart illustrating the testing method for the multi-stage protection strategy provided in the embodiments of this application; Figure 4 This is a block diagram of the testing device 400 for the multi-stage protection strategy provided in this application embodiment; Figure 5 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0018] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0019] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. The present application will now be described in detail with reference to the accompanying drawings and embodiments. Furthermore, the term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The terms "first" and "second," etc., in the specification and claims of the embodiments of this application are used to distinguish different objects, not to describe a specific order of objects.

[0020] Currently, the multi-stage protection strategy specifically includes the protocol analysis stage, traffic scrubbing stage, anomaly detection stage, feature matching stage, and behavior analysis stage. Specifically, the protocol analysis stage is used to parse and standardize the test samples to identify protocol types and structural characteristics; the traffic scrubbing stage is used to filter suspicious traffic and perform traffic scrubbing operations on the samples after protocol analysis; the anomaly detection stage is used to detect abnormal packets or interactions in the samples based on rules; the feature matching stage is used to match and compare the sample features with a known threat signature database; and the behavior analysis stage is used to perform in-depth behavior analysis on the samples to assess their potential threat.

[0021] However, as cyberattack techniques become increasingly complex and varied, the aforementioned protection strategies are also being updated and adjusted accordingly; and in order to ensure the effectiveness of security equipment, it is necessary to conduct comprehensive testing of its multi-stage protection strategies.

[0022] Correspondingly, existing technologies provide a method for verifying the defense effectiveness of multiple security devices in a series. This method sends test vectors, which are processed sequentially by the multiple security devices in a series to obtain the logs of each device in order to evaluate the defense effectiveness. It also provides a test method based on call chain identification, which focuses on tracing the call relationship between services in a distributed system.

[0023] Based on this, it is clear that existing security testing methods for protection strategies can only obtain the final processing result, and cannot track the intermediate states of data at each stage, making it difficult to pinpoint the specific stage at which anomalies occur. Secondly, they cannot evaluate the synergistic effect between multi-stage strategies, nor can they analyze the integrity of data feature transmission between different stages. Furthermore, there is a lack of a systematic evaluation mechanism for the combined effectiveness of protection strategies, and the testing efficiency is low, making it difficult to meet the needs of large-scale protection strategy testing.

[0024] To address the aforementioned issues, this application provides a feature-based multi-stage protection strategy testing method to solve the problem that existing testing methods are unable to comprehensively evaluate the synergistic effect of multi-stage protection strategies, thereby achieving efficient and comprehensive testing of multi-stage protection strategies.

[0025] In one possible implementation, Figure 1 This is a flowchart illustrating a testing method for a multi-stage protection strategy provided in an embodiment of this application, such as... Figure 1 As shown, the method includes the following steps: Step S101: Obtain the feature transfer path of the test data between multiple serial processing stages of the target device through the feature traversal tracking mechanism. The feature transfer path corresponds to the association mapping result of the processed data in each serial processing stage. The processed data includes a global tracking identifier and local processed data corresponding to each serial processing stage.

[0026] In this embodiment, the feature-crossing tracking mechanism corresponds to the parallel acquisition of test data by multiple monitoring channels in each serial processing stage of the target device, and the sorting of the processed data belonging to the same test data based on the global tracking identifier in the processed data to generate the feature transmission path corresponding to the test data.

[0027] In one possible implementation, the connection between each monitoring channel and the corresponding serial processing stage of the target device (i.e., each protection stage of the multi-stage protection strategy) can be established in advance, so that each monitoring channel can collect the input and output data of the corresponding serial processing stage.

[0028] For example, after establishing the connection between each monitoring channel and the corresponding serial processing stage, the time synchronization period can be dynamically adjusted according to the protection delay status of the target device (i.e., the data processing delay status) so as to use the Precision Time Protocol (PTP) to perform periodic time synchronization of each monitoring channel according to the adjusted time synchronization period.

[0029] In this embodiment, the aforementioned periodic time synchronization operation can ensure that the time bases of multiple monitoring channels are highly consistent (i.e., at the microsecond level), thereby ensuring the timing accuracy when collecting and analyzing the processing data corresponding to each serial processing stage (i.e., ensuring the accuracy of subsequent cross-channel data association and timing analysis), and avoiding analysis deviations caused by time errors.

[0030] Specifically, each monitoring channel can achieve periodic time synchronization based on the system time of the security device under test, so that the error of the preset time reference between each monitoring channel is within a preset threshold. Secondly, a delay compensation mechanism is enabled at the same time to reduce the impact of network transmission; for example, the synchronization period is 100ms.

[0031] For example, when multiple serial processing stages include a protocol analysis stage, a traffic scrubbing stage, an anomaly detection stage, a feature matching stage, and a behavior analysis stage, based on each monitoring channel corresponding to one serial processing stage, the multiple monitoring channels can correspond to a protocol analysis monitoring channel, a traffic scrubbing monitoring channel, an anomaly detection monitoring channel, a feature matching monitoring channel, and a behavior analysis monitoring channel.

[0032] In one possible implementation, after achieving the aforementioned periodic time synchronization, multiple monitoring channels can be started simultaneously to collect local processing data and global tracking identifiers of test data in the corresponding serial processing stage in real time.

[0033] For example, the input and output data, processing time, and policy triggering status of each serial processing stage can be acquired synchronously through data capture, and local processing data can be generated based on the input and output data, processing time, and policy triggering status. The processing time is used to record the duration of data residence within the serial processing stage, and the policy triggering status is used to characterize what processing rules (such as filtering, transformation, and marking) were specifically executed in the serial processing stage.

[0034] Preferably, the above data capture method can be a non-intrusive bypass monitoring or interface hook mechanism to obtain high-fidelity local processing data without interfering with the normal business processing of the target device.

[0035] For example, data packets flowing through the entry and exit points of each serial processing stage can be copied in real time as input and output data using network splitters or port mirroring technology; or, a lightweight probe can be embedded in the software processing module of the target device to directly read data snapshots in the buffer using shared memory or zero-copy technology; correspondingly, such synchronous acquisition mechanisms ensure that the collected input and output data can accurately reflect the instantaneous state before and after the processing of that stage, rather than statistical information after caching or aggregation.

[0036] For example, the global tracking identifier can be a globally unique identifier (GUID) for the test data; correspondingly, a test sample set containing specific characteristics can be generated based on predefined test cases, and a globally unique identifier can be assigned to each test sample (i.e., test data) in the test sample set.

[0037] In one possible implementation, the aforementioned multiple monitoring channels correspond to a five-channel parallel monitoring architecture, that is, the number of monitoring channels is five.

[0038] For example, for any monitoring channel in a five-channel parallel monitoring architecture, the channel monitoring plugin in each monitoring channel can be used to acquire the data processed in the corresponding serial processing stage.

[0039] Specifically, the channel monitoring plugin in the monitoring channel can be used to collect the raw processing data of the corresponding serial processing stage, and then the raw processing data can be cleaned to obtain the processing data of the test data in multiple serial processing stages of the target device.

[0040] In one example, the channel monitoring plugin can provide a standard Remote Procedure Call (RPC) interface, allowing the target device to actively report the corresponding raw processing data via the RPC protocol. Secondly, the channel monitoring plugin can also provide data format specifications to ensure that the target device can efficiently and reliably transmit various monitoring indicators. That is, the data acquisition method provided in this embodiment supports RPC protocol reporting.

[0041] Optionally, the channel monitoring plugin can provide a plugin extension framework to support users in writing customized data acquisition code, thereby enabling the direct acquisition of data of specific formats and types from the target device. That is, the acquisition method provided in this embodiment corresponds to customized code data acquisition to meet the monitoring needs of specific scenarios and devices.

[0042] Correspondingly, after collecting the raw processing data, custom data cleaning can also be performed on the raw processing data.

[0043] In one example, the channel monitoring plugin can also have a built-in data cleaning module to allow users to configure custom cleaning rules.

[0044] For example, cleaning rules include data validity verification, data standardization processing, and data quality filtering. Data validity verification is used to check the format, range, and integrity of the collected data. Data standardization processing is used to convert data from different sources and in different formats into the system's standard format. Data quality filtering is used to remove outliers and handle missing data to ensure the reliability of the analyzed data.

[0045] For example, the input and output data, processing time, and policy triggering status of each serial processing stage can be determined based on the traffic characteristic data, processing status data, and identification information collected from each monitoring channel.

[0046] For example, traffic characteristic data should include at least packet size, traffic rate (bps), request rate (qps), protocol type, socket information, traffic pattern, and behavioral characteristics; processing status data should include at least processing timestamp, processing time, resource utilization (CPU, memory, bandwidth, etc.), policy triggering information, matching rule ID, and processing result; identification information should include at least metadata for different stages (including source stage, current stage, destination stage, etc.), traffic classification labels, and test case numbers.

[0047] In one possible implementation, local processing data belonging to the same test data can be matched based on the global tracking identifier in the processing data, and the matched local processing data can be sorted according to a preset time benchmark to generate the feature transmission path of the test data; wherein, the preset time benchmark is used to provide a unified timestamp for the collected processing data and ensure time synchronization between multiple monitoring channels.

[0048] In this embodiment, a feature-based tracking mechanism is adopted, which uses a globally unique identifier, high-precision timing confirmation, and feature association mapping to achieve full-link tracking and analysis of test data features across different serial processing stages.

[0049] One possible implementation is to use a global tracking identifier (i.e., a globally unique identifier) ​​mechanism to map the processing data acquired from multiple monitoring channels together and establish a complete data association relationship. This allows for trajectory reconstruction of the characteristic changes of the test data at each stage (by default time sequence) to verify the integrity and accuracy of the transmission of test data characteristics between multiple serial processing stages.

[0050] For example, after obtaining the processing data corresponding to each monitoring channel, key feature fields can be extracted from the processing data to form feature vectors; and the processing data at different stages can be located and arranged in time sequence by using GUID, while calculating the cosine similarity of the feature vectors.

[0051] In one possible implementation, after generating the feature transfer path, anomaly detection is performed on the feature transfer path. If an anomaly in feature transfer is detected between adjacent serial processing stages, the abnormal node is located, and the feature transfer path is updated based on the abnormal node.

[0052] For example, the input and output data corresponding to adjacent serial processing stages can be obtained sequentially, and the key feature identifiers in the input and output data can be compared.

[0053] Specifically, if the comparison result of the key feature identifier indicates that the subsequent serial processing stage did not receive the output data of the previous serial processing stage, or the key feature identifier in the input and output data underwent abnormal changes during transmission (e.g., feature value was tampered with, feature field was lost, or the format did not meet expectations), then it is determined that there is a feature transmission abnormality between adjacent serial processing stages.

[0054] Optionally, when the difference between the feature vectors generated through the above steps exceeds a preset threshold (e.g., similarity < 0.8), it can also be recorded as a feature transfer anomaly.

[0055] Correspondingly, the transmission link between the serial processing stage where the feature transmission anomaly occurs and / or the adjacent serial processing stage where the feature transmission anomaly occurs can be identified as an abnormal node. The policy triggering state corresponding to the abnormal node is recorded, and the feature transmission path is updated based on the abnormal changes in the policy triggering state and the key feature identifier.

[0056] That is, in this embodiment, the abnormal node can be the serial processing stage where the abnormality occurs, the transmission link between adjacent serial processing stages where the abnormality occurs, or the transmission link between the serial processing stage where the abnormality occurs and the adjacent serial processing stage where the abnormality occurs.

[0057] This embodiment, through the above-mentioned anomaly location mechanism, can accurately identify the specific stage at which a problem occurs in the multi-stage serial processing of the data stream, providing a precise fault location basis for subsequent strategy optimization.

[0058] Step S102: Based on the feature transmission path, obtain the evaluation results of the protection strategies corresponding to multiple serial processing stages.

[0059] In one possible implementation, a combined evaluation result of the protection strategy can be generated based on the single-strategy evaluation report and the multi-strategy combined evaluation report corresponding to each serial processing stage; wherein, the evaluation result represents the synergistic effect of the protection strategy and the integrity of data flow transmission.

[0060] For example, based on the feature transmission path, the verification pass rate, resource consumption rate and processing time of each serial processing stage can be statistically analyzed to generate a single strategy evaluation report for each serial processing stage.

[0061] For example, the overall pass rate and average processing time of the protection strategy combinations corresponding to different serial processing stages can be statistically analyzed to generate a multi-strategy combination evaluation report corresponding to multiple serial processing stages.

[0062] It should be noted that the above single-strategy evaluation report is used to measure the effectiveness, performance and resource consumption of a single protection strategy, while the above multi-strategy combination evaluation report is used to evaluate the overall protection effect and interaction effects when multiple protection strategies are used in combination. The combination of the two forms a multi-dimensional evaluation system, providing comprehensive data support for the optimization of protection strategies.

[0063] In another embodiment of this application, the data structure used in this application is also provided.

[0064] In one possible implementation, the core data structure includes a channel data structure called channel_data.

[0065] For example, the channel data structure includes fields such as a unique identifier for the monitoring channel, channel name, processing time, processing data type, processing time, processing status, rule type, and verification result; used to record the raw monitoring data and preliminary analysis results of a single monitoring channel.

[0066] In one example, the specific field definitions are shown in Table 1 below: Table 1. Definition fields of the channel data structure

[0067] In one possible implementation, the core data structure also includes a sample data structure, sample_data.

[0068] For example, the sample data structure includes fields such as a globally unique identifier, sending time, receiving time, original content of the test sample, response verification result, total time, channel data array, and additional information; to be used to integrate the data and verification results of a single test sample across all monitoring channels.

[0069] In one example, the specific field definitions are shown in Table 2 below: Table 2. Definition fields of sample data structure

[0070] In one possible implementation, the core data structure also includes a validation result structure, validation_result.

[0071] For example, the validation result structure includes fields such as validation item name, actual result, expected result, and matching status; to record the specific validation result of a single validation item.

[0072] In one example, the specific field definitions are shown in Table 3 below: Table 3 Definition fields of the verification result structure

[0073] In another embodiment of this application, an evaluation table structure used in this application is also provided.

[0074] In one possible implementation, a single-strategy evaluation table is used to record metrics such as the verification pass rate, resource consumption rate, processing time, processing bps, and processing qps of the protection strategies for each monitoring channel.

[0075] For example, the above indicators can be sorted in descending order according to the verification pass rate to intuitively compare the performance and effectiveness of different protection strategies.

[0076] In one example, the single-policy evaluation table is shown in Table 4 below: Table 4 Single Strategy Evaluation Table

[0077] In one possible implementation, a multi-strategy combination evaluation table is used to record metrics such as overall use case pass rate, resource consumption rate, processing time, processing bps, and processing qps for strategy combinations at different stages.

[0078] For example, the use cases can be sorted in descending order of overall use case pass rate to evaluate the synergistic effect of different strategy combinations.

[0079] In one example, the multi-strategy combination evaluation table is shown in Table 5 below: Table 5 Multi-strategy combination evaluation table

[0080] In another embodiment of this application, a standardized general data processing flow is also provided.

[0081] To further enhance the flexibility and scalability of testing, the standardized general data processing flow provided in this embodiment abstracts the common data processing logic of each monitoring channel into independent general process modules through modular design, so that the testing framework can flexibly adapt to the stage differences of different target devices. Secondly, the standardized data processing flow and unified interface design enable the system to be compatible with security devices from different manufacturers and with different architectures, reducing adaptation costs.

[0082] In one possible implementation, the general process includes the following steps: S1, Data Acquisition.

[0083] For example, the target device can report data to the monitoring channel via the RPC protocol, or the monitoring channel can actively acquire device data based on customized code.

[0084] S2, Custom Data Cleaning.

[0085] For example, data cleaning may include data validity verification, data standardization processing, and data quality filtering.

[0086] S3, preliminary verification.

[0087] For example, the preliminary verification process may include verifying whether the sample triggers the expected policy, checking whether the policy triggering conditions meet expectations, and confirming whether the policy activation stage is the expected stage.

[0088] S4, data normalization and encapsulation.

[0089] For example, key information such as sample GUID and policy processing time can be integrated with the verification results, which include key metadata (e.g., timestamps, channel IDs, etc.), to summarize the data in a standardized format, generate a standard data exchange format that can be recognized across channels, and transmit the encapsulated data to the data analyzer.

[0090] In another embodiment of this application, a system interaction process is also provided for the testing method based on the multi-stage protection strategy of this application.

[0091] The following is combined Figure 2 The component interaction sequence diagram shown illustrates the system interaction process in this embodiment of the application. Specifically, the test system components involved in this embodiment include: a control node, a cluster of worker nodes, a sample generator, a target security device, and a data analyzer.

[0092] I. Test Initialization Phase As the scheduling center for the entire testing process, the control node first performs the following initialization operations: The control node sends a test start command to the sample generator and manages the execution of test cases, including configuring parameters such as sample template, number of samples, sending duration, traffic rate (bps), and request rate (qps). The control node sends a monitoring task start command to the worker node cluster, deploys a multi-channel architecture, and establishes the connection relationship between each monitoring channel and the corresponding serial processing stage of the target security device. The control node sends an analysis task start command to the data analyzer, notifying the data analyzer to enter a ready state and wait to receive channel monitoring data and response verification data.

[0093] II. Sample Sending and Monitoring Phase After initialization is complete, the components interact according to the following sequence: The sample generator sends test samples to the target security device according to the instructions of the control node; After receiving the test sample, the target security device performs multi-stage protection processing (including protocol analysis, traffic cleaning, anomaly detection, feature matching, behavior analysis, etc.). While the target security device performs multi-stage protection processing, the working node cluster synchronously executes monitoring tasks, collecting processing data at each stage through a five-channel parallel monitoring architecture; The cluster of worker nodes performs data collection, cleaning, verification, and encapsulation within the channel to generate standardized channel monitoring data.

[0094] III. Data Collection and Analysis Stage The cluster of worker nodes sends the aggregated channel monitoring results and verification data to the data analyzer; After receiving the response from the target security device, the sample generator reports the sample response verification result to the data analyzer. After receiving the above data, the data analyzer performs inter-stage data analysis, including mapping the association of multi-channel data based on globally unique identifiers, reconstructing feature transfer trajectories, and verifying the integrity and accuracy of feature transfer between each stage. The data analyzer summarizes the sample response verification results and generates an analysis and verification report.

[0095] IV. Assessment Report Output Stage The data analyzer generates a comprehensive evaluation report (including single-strategy evaluation reports and multi-strategy combination evaluation reports) based on the analysis and verification report. The data analyzer will submit a comprehensive evaluation report to the control node, which will then use this report to determine the test results or output optimization suggestions.

[0096] Through the above-described interactive process, this embodiment achieves comprehensive testing and evaluation of the multi-stage protection strategy for the target security device.

[0097] In another embodiment of this application, another implementation of the testing method for a multi-stage protection strategy is also provided.

[0098] For example, Figure 3 This is another flowchart illustrating the testing method for the multi-stage protection strategy provided in this application embodiment, as shown below. Figure 3 As shown, the method includes the following steps: Step S301: Construct a monitoring channel.

[0099] For example, a five-channel parallel monitoring architecture is deployed, specifically including a protocol analysis monitoring channel, a traffic scrubbing monitoring channel, an anomaly detection monitoring channel, a feature matching monitoring channel, and a behavior analysis monitoring channel; and a connection relationship is established between each monitoring channel and the corresponding protection stage of the target security device to ensure that the monitoring channels can accurately capture the input and output data of the target stage.

[0100] Step S302: Control node initialization.

[0101] For example, the control node loads test configuration parameters (test environment protection address, protection policy, protection bandwidth, and other related information); defines the sample template, number of samples, sending duration, bps, qps, and other parameters of the test cases (i.e., the corresponding test data), the expected triggering of certain protection policies at a certain stage, and the expected response results; manages the timing, frequency, and termination conditions of test sample sending by the sample generator; starts the feature analysis and verification process of the analysis module and monitors the status of the analysis task; and coordinates the timing and synchronization mechanism of the entire test process to ensure that all components work together.

[0102] Step S303, test sample generation and injection.

[0103] For example, a set of test samples containing specific features is generated based on the test cases, and a globally unique identifier is assigned to each test sample.

[0104] Specifically, the sample generator sends test samples to the security device according to the preset rules in step S302, triggering a multi-stage protection process.

[0105] Step S304, five-channel synchronous monitoring.

[0106] For example, five monitoring channels are activated simultaneously to capture the processing status and characteristic changes of test samples in the corresponding protection phase in real time.

[0107] Step S305: Data processing and verification within the phase.

[0108] For example, each channel cleans, standardizes, and verifies the legality of the collected data, including data legality verification, data standardization, and data quality filtering; during the execution phase, verification analysis is performed to confirm whether the sample triggers the expected strategy, check whether the conditions for triggering the strategy meet expectations, and confirm whether the stage in which the strategy takes effect is the expected stage; key information such as the sample GUID and strategy processing time are integrated with the verification results, including key metadata (such as timestamps, channel IDs, etc.), and the data is summarized in a standardized format to generate a standard data exchange format, channel_data, that can be recognized across channels, and the encapsulated data is transmitted to the data analyzer.

[0109] Step S306: Feature transfer analysis and trajectory reconstruction.

[0110] For example, based on a globally unique identifier mechanism, the data from the five channels are correlated and mapped to establish a complete data association relationship. The trajectory of the feature changes of the test sample in each stage is reconstructed (default time sequence arrangement) to verify the integrity and accuracy of the feature transmission between the five stages.

[0111] Among them, a single sample, combined with the corresponding response verification result, forms a complete single sample data sample_data; multiple sets of samples are sorted in reverse order of sending time to form a sample analysis table, prioritizing the display of the latest test results.

[0112] Step S307: Multi-dimensional assessment and report generation.

[0113] For example, it generates a detailed analysis report, including feature propagation path, processing efficiency, verification results, and protection effectiveness evaluation.

[0114] Step S308: Optimization suggestions are generated.

[0115] For example, based on the analysis results, targeted suggestions for optimizing protection strategies are proposed, including parameter adjustment, algorithm optimization, and strategy combination optimization.

[0116] The following section uses the HTTP CC attack protection function test as an example to provide a detailed explanation of the technical solution of this application.

[0117] Step S1: Test case management and sample generation.

[0118] The testing system first creates a set of HTTP CC attack test cases, which includes the following sub-steps: S1.1: Create test cases containing 10 typical HTTP CC attack scenarios, covering scenarios such as low-frequency high concurrency, high-frequency low concurrency, targeted resource attacks, and session persistence attacks; S1.2: Inject specific HTTP header features, cookie features, and user-agent features into each test sample for subsequent feature tracking; S1.3: Assign a globally unique identifier in the format 'GUID_CC_YYYYMMDD_HHMMSS_XX' to each test sample; S1.4: Configure the sample generator to generate request messages that conform to the HTTP / 1.1 protocol specification, including different methods such as GET / POST / PUT; S1.5: The control node loads test configuration parameters, manages parameters such as test case sample templates, number of samples, sending duration, bps, qps, etc., and coordinates the timing and synchronization mechanism of the entire test process.

[0119] Step S2: Sample sending and synchronous monitoring process.

[0120] S2.1: The sample generator sends an HTTP CC attack sample to the device under test according to preset rules; S2.2: Five monitoring channels synchronously collect the processing status of HTTP requests at the corresponding stages. The key data collected by each monitoring channel includes: traffic characteristic data, identification information, and processing status data. S2.3: Each monitoring channel performs preliminary processing on the collected HTTP CC attack traffic data, including: data format verification, feature extraction, and status classification; S2.4: Validation analysis within each monitoring channel execution phase to confirm whether the sample triggers the expected strategy, check whether the conditions for triggering the strategy meet expectations, confirm whether the phase in which the strategy takes effect is the expected phase, and integrate key information such as sample GUID and strategy processing time with the validation results to generate a standard data exchange format channel_data that can be identified across channels.

[0121] Step S3: Feature propagation path reconstruction.

[0122] S3.1: Based on a globally unique identifier mechanism, the data of the same test sample across five monitoring channels are precisely correlated using the GUID field; S3.2: Reconstruct the complete processing timeline of the sample and analyze the processing time distribution at each stage; S3.3: Verify the integrity of HTTP request characteristics transmitted at each stage and detect cases of lost or tampered characteristics; S3.4: Identify key decision points and rule triggering situations that affect the request processing results.

[0123] S3.5: A single sample is combined with the corresponding response verification result to form a complete single sample data sample_data; S3.6: Multiple sets of samples are sorted in reverse order of sending time to form a sample analysis table, with the latest test results displayed first.

[0124] Step S4: Multidimensional evaluation and analysis.

[0125] The system performs a multi-dimensional evaluation and analysis of the effectiveness of HTTP CC attack protection.

[0126] S4.1: Single Strategy Evaluation - Statistical evaluation of the verification results of the internal protection strategies of each monitoring channel, including verification pass rate, resource consumption rate, channel data processing time, channel processing QPS, etc.

[0127] S4.2: Multi-strategy combination evaluation -- Statistical evaluation of overall evaluation items for strategy combinations at different stages, including overall use case pass rate, resource consumption rate, average processing time, processing QPS, etc.

[0128] Step S5: Optimization suggestions are generated.

[0129] Based on the data in the analysis and evaluation tables, the system provides specific optimization suggestions for different testing scenarios: S5.1: Optimization suggestions for device functions not meeting expectations: Find detailed information by sample GUID, traverse the channel_data array, and prioritize locating channel data where match is false; check the processing logic and parameter configuration of the policy within the channel; adjust policy parameters or logic accordingly, such as adjusting the rule trigger threshold.

[0130] S5.2: Optimization suggestions for throughput (QPS) not meeting targets: Filter sample groups with QPS lower than expected, and analyze process_duration_ms and process QPS metrics; optimize or replace inefficient strategies, add caching mechanisms, optimize resource allocation, and parallelize the processing flow.

[0131] S5.3: Optimization suggestions for handling excessive latency: Extract the five-channel processing data, reconstruct the processing timing diagram, identify the channels and processing stages that contribute the most to latency; identify channels and processing flows that can be executed in parallel, adjust the processing order, introduce asynchronous processing mechanisms, and optimize the data transmission path.

[0132] S5.4: Performance optimization suggestions for a single strategy: A multi-dimensional scoring system is established based on a single-strategy evaluation table, which divides strategies into efficient strategies, balanced strategies, and strategies to be optimized. The weight and priority of efficient and low-cost strategies are increased, and the algorithm is optimized for inefficient and high-cost strategies, thus establishing a dynamic scheduling mechanism for strategies.

[0133] S5.5: Strategy Combination Optimization Suggestions: Based on the analysis of the multi-strategy combination evaluation table, the overall use case pass rate, resource consumption and processing performance are comprehensively considered; appropriate strategy combinations are selected according to the needs of the scenario, the processing order of each stage is optimized, and a dynamic adjustment mechanism for strategy combinations is established.

[0134] S5.6: Specific optimization suggestions based on HTTP CC attack test results: Frequency limiting strategy: The current response to short-term bursts of traffic is not timely enough. It is recommended to adjust the granularity of the sliding window algorithm from 1 second to 100 milliseconds to improve response sensitivity and reduce the false negative rate of burst traffic attacks. It is expected to reduce the false negative rate by 0.2%. Session analysis strategy: Current resource consumption is high (5.8%). It is recommended to introduce a session state caching mechanism to reduce redundant calculations and optimize memory usage. The expected resource consumption will be reduced to about 3.5% while maintaining high detection accuracy. Strategy combination optimization: It is recommended to adopt a three-strategy combination of "frequency limiting + IP reputation + session analysis" to ensure 99.5% defense effectiveness while keeping resource consumption below 10%; Protocol analysis phase: The ability to identify HTTP / 2 protocol variant attacks is insufficient. It is recommended to update the protocol analysis module to increase support for HTTP / 2 features and the ability to identify variants. The implementation priority should be medium to high.

[0135] Step S6: Evaluation of the effectiveness of test results and protection strategies.

[0136] After conducting parallel testing of a complete HTTP CC attack protection strategy, the following key conclusions were drawn: S6.1: The overall protection effectiveness of the tested device against standard HTTP CC attacks reaches over 99.5%; S6.2: Stage Contribution Analysis -- The anomaly detection stage and the behavior analysis stage contribute the most to the identification of CC attacks, accounting for 40% and 35% of the total identification rate, respectively; S6.3: Performance and resource balance - The combination of three strategies can achieve the best balance between protection effectiveness and resource consumption; S6.4: Optimization potential – By implementing the recommended optimization measures, it is expected that the overall protection effectiveness can be increased to 99.8%, while reducing resource consumption by 25%.

[0137] In another embodiment of this application, a specific distribution of the testing apparatus for a multi-stage protection strategy is also provided.

[0138] In one possible implementation, Figure 4 This is a block diagram of the testing device 400 for the multi-stage protection strategy provided in this application embodiment, as shown below. Figure 4 As shown, the test device 400 for the multi-stage protection strategy includes an acquisition module 401 and an evaluation module 402.

[0139] For example, the acquisition module 401 is used to obtain the feature transfer path of the test data between multiple serial processing stages of the target device through a feature-crossing tracking mechanism. The feature transfer path corresponds to the association mapping result of the processed data in each serial processing stage. The processed data includes a global tracking identifier and local processed data corresponding to each serial processing stage.

[0140] The evaluation module 402 is used to obtain the evaluation results of the protection strategies corresponding to multiple serial processing stages based on the feature transmission path.

[0141] For example, the execution steps of obtaining the feature transmission path through the feature-crossing tracking mechanism include: multiple monitoring channels synchronously acquiring the input and output data, processing time, and policy triggering status of the test data in each serial processing stage through data capture; and generating local processing data corresponding to each serial processing stage based on the input and output data, processing time, and policy triggering status; wherein each monitoring channel corresponds to one serial processing stage. Based on the global tracking identifier in the processed data, local processed data belonging to the same test data are matched, and the matched local processed data are sorted according to the preset time benchmark to generate feature transmission paths; wherein, the preset time benchmark is used to provide a unified timestamp mark for the collected processed data and ensure time synchronization between multiple monitoring channels.

[0142] The following is for reference. Figure 5 , Figure 5 A schematic diagram of a communication device suitable for implementing embodiments of this application is shown, such as... Figure 5 As shown, the computer device 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 502 or programs loaded from storage section 508 into random access memory (RAM) 503. The RAM 503 also stores various programs and data required for the system's operating instructions. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0143] The following components are connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0144] It should be noted that the computer-readable medium shown in this application may be a computer-readable signal medium or a computer-readable storage medium or any combination thereof.

[0145] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operational instructions of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two connected blocks may actually be executed substantially in parallel, or they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified functions or operational instructions, or using a combination of dedicated hardware and computer instructions.

[0146] The units or modules described in the embodiments of this application can be implemented in software or hardware. The described units or modules can also be housed in a processor; for example, a processor may be described as including an acquisition module 401 and an evaluation module 402. The names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0147] On the other hand, this application also provides a computer-readable storage medium, which may be included in the communication device described in the above embodiments, or may exist independently and not assembled into the communication device. The aforementioned computer-readable storage medium stores one or more programs that, when used by one or more processors, execute the methods described in this application. For example, it may execute... Figure 1 The steps of the method shown are as follows.

[0148] This application provides a computer program product including instructions that, when executed, cause the method described in this application to be performed. For example, it can execute... Figure 1 The steps of the method shown are as follows.

[0149] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the foregoing disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A testing method for a multi-stage protection strategy, characterized in that, The method includes: The feature transfer path of the test data is obtained through a feature-crossing tracing mechanism. The feature transfer path corresponds to the association mapping result of the test data in each of the serial processing stages. The processed data includes a global tracing identifier and local processed data corresponding to each of the serial processing stages. Based on the feature transmission path, the evaluation results of the protection strategies corresponding to the multiple serial processing stages are obtained; The execution steps for obtaining the feature transmission path through the feature-crossing tracking mechanism include: synchronously acquiring the input and output data, processing time, and policy triggering status of the test data in each of the serial processing stages through multiple monitoring channels via data capture; and generating local processing data corresponding to each of the serial processing stages based on the input and output data, the processing time, and the policy triggering status; wherein each monitoring channel corresponds to one serial processing stage. The local processing data belonging to the same test data are matched according to the global tracking identifier in the processed data, and the matched local processing data are sorted according to a preset time benchmark to generate the feature transmission path; wherein, the preset time benchmark is used to provide a unified timestamp for the collected processed data and ensure time synchronization between the multiple monitoring channels; The evaluation results of the protection strategies corresponding to the multiple serial processing stages based on the feature transmission path include: Based on the feature transmission path, the verification pass rate, resource consumption rate and processing time of each serial processing stage are statistically analyzed, and a single strategy evaluation report corresponding to each serial processing stage is generated. Statistically analyze the overall pass rate and average processing time of the protection strategy combinations corresponding to different serial processing stages, and generate a multi-strategy combination evaluation report corresponding to multiple serial processing stages; Based on the single-strategy evaluation report and the multi-strategy combination evaluation report, the synergistic effect of the protection strategies and the integrity of data flow transmission are determined.

2. The testing method for the multi-stage protection strategy according to claim 1, characterized in that, After obtaining the feature propagation path corresponding to the test data, the method further includes: Anomaly detection is performed on the feature transmission path. If an anomaly in feature transmission is detected between adjacent serial processing stages, the abnormal node is located, and the feature transmission path is updated based on the abnormal node.

3. The testing method for the multi-stage protection strategy according to claim 2, characterized in that, If an anomaly in feature transmission is detected between adjacent serial processing stages, the abnormal node is located, including: The input and output data corresponding to adjacent serial processing stages are obtained sequentially, and the key feature identifiers in the input and output data are compared. If the subsequent serial processing stage does not receive the output data of the previous serial processing stage, or if the key feature identifier in the input and output data undergoes abnormal changes during transmission, it is determined that there is a feature transmission abnormality between the adjacent serial processing stages. The transmission link between the serial processing stage where the feature transmission anomaly occurs and / or the adjacent serial processing stage where the feature transmission anomaly occurs is identified as the abnormal node. The policy triggering state corresponding to the abnormal node is recorded, and the feature transmission path is updated based on the policy triggering state and the abnormal change of the key feature identifier.

4. The testing method for the multi-stage protection strategy according to claim 1, characterized in that, The method further includes: The time synchronization period is dynamically adjusted according to the protection delay status of the target device, and a precise time protocol is used to periodically synchronize the time of each monitoring channel according to the adjusted time synchronization period.

5. The testing method for the multi-stage protection strategy according to claim 1, characterized in that, The multiple monitoring channels correspond to a five-channel parallel monitoring architecture. The processing data obtained by the multiple monitoring channels in each of the serial processing stages includes: For any monitoring channel in the five-channel parallel monitoring architecture, the raw processing data of the corresponding serial processing stage is collected using the channel monitoring plugin in the monitoring channel; The original processed data is cleaned using the channel monitoring plugin to obtain the processed data of the test data in each of the serial processing stages.

6. A testing device for a multi-stage protection strategy, characterized in that, The device includes: The acquisition module is used to obtain the feature transfer path of the test data between multiple serial processing stages of the target device through a feature-crossing tracking mechanism. The feature transfer path corresponds to the association mapping result of the test data in each of the serial processing stages. The processed data includes a global tracking identifier and local processed data corresponding to each of the serial processing stages. An evaluation module is used to obtain evaluation results of the protection strategies corresponding to the multiple serial processing stages based on the feature transmission path. The execution steps for obtaining the feature transmission path through the feature-crossing tracking mechanism include: synchronously acquiring the input and output data, processing time, and policy triggering status of the test data in each of the serial processing stages through multiple monitoring channels via data capture; and generating local processing data corresponding to each of the serial processing stages based on the input and output data, the processing time, and the policy triggering status; wherein each monitoring channel corresponds to one serial processing stage. The local processing data belonging to the same test data are matched according to the global tracking identifier in the processed data, and the matched local processing data are sorted according to a preset time benchmark to generate the feature transmission path; wherein, the preset time benchmark is used to provide a unified timestamp for the collected processed data and ensure time synchronization between the multiple monitoring channels; The evaluation results of the protection strategies corresponding to the multiple serial processing stages based on the feature transmission path include: Based on the feature transmission path, the verification pass rate, resource consumption rate and processing time of each serial processing stage are statistically analyzed, and a single strategy evaluation report corresponding to each serial processing stage is generated. Statistically analyze the overall pass rate and average processing time of the protection strategy combinations corresponding to different serial processing stages, and generate a multi-strategy combination evaluation report corresponding to multiple serial processing stages; Based on the single-strategy evaluation report and the multi-strategy combination evaluation report, the synergistic effect of the protection strategies and the integrity of data flow transmission are determined.

7. A multi-stage protection system, characterized in that, The system includes a target device having multiple serial processing stages and a test device for the multi-stage protection strategy as described in claim 6. The multiple monitoring channels of the testing device are respectively connected to multiple serial processing stages of the target device.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images