Fault optimization method and system of network attack and defense platform based on fault detection

Abstract

The application discloses a fault optimization method and system of a network attack and defense platform based on fault detection, and relates to the technical field of fault optimization methods. A multidimensional detection system of the network attack and defense platform is determined based on multiple fault detection modes, the external form of the network attack and defense platform and the model of the network attack and defense platform, so as to collect fault test data sets of each fault detection dimension, and multiple internal fault features are determined according to the identification of the fault test data sets of each fault detection dimension. Therefore, corresponding fault events are determined according to multiple external fault features, multiple internal fault features and the working procedure of the network attack and defense platform; a fault optimization strategy of the network attack and defense platform is determined according to each fault event and the current working state of the network attack and defense platform, a current fault optimization content is determined based on the fault optimization strategy of the network attack and defense platform and the current working procedure of the network attack and defense platform, and the accuracy of the fault optimization content is improved.

Description

Technical Field

[0001] This invention relates to the technical field of fault optimization methods, and in particular to a fault optimization method and system for a network attack and defense platform based on fault detection. Background Technology

[0002] With the development of technology, network attack and defense platforms are applied in network environments, encompassing both network attack and defense layers. These platforms primarily simulate network attack behaviors, helping users master attack techniques and test the security of target systems. Current technologies collect multiple operational parameters during the platform's operation and determine fault parameters based on these parameters. However, the fault detection mode of these platforms operates on a single dimension and cannot perform multi-dimensional detection across different fault dimensions. This affects the accuracy of the multi-dimensional detection system and consequently, the accuracy of fault optimization within the network attack and defense platform. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides a fault optimization method and system for a network attack and defense platform based on fault detection.

[0004] This invention provides a fault optimization method for a network attack and defense platform based on fault detection, comprising: collecting multiple surrounding environmental parameters of the network attack and defense platform; determining the usage scenario of the network attack and defense platform based on the platform model and the multiple surrounding environmental parameters; determining multiple sub-test items based on the identification of the network attack and defense platform's test sequence list; determining multiple fault detection modes of the network attack and defense platform based on the multiple sub-test items, the usage scenario of the platform, and multiple operating parameters; determining a multi-dimensional detection system of the platform based on the multiple fault detection modes, the platform's external form, and the platform model, to collect fault test data sets for each fault detection dimension; determining multiple internal fault features based on the identification of the fault test data sets for each fault detection dimension; determining multiple external fault features based on the identification of multiple images of the platform; and determining corresponding fault events based on the multiple external fault features, the multiple internal fault features, and the platform's operating procedures. Based on each fault event and the current working status of the network attack and defense platform, determine the fault optimization strategy of the network attack and defense platform, and based on the fault optimization strategy of the network attack and defense platform and the current working procedure of the network attack and defense platform, determine the current fault optimization content.

[0005] This invention provides a fault optimization system for a network attack and defense platform based on fault detection. This fault optimization system is applied to the aforementioned fault optimization method for a network attack and defense platform based on fault detection. The fault optimization system for the network attack and defense platform based on fault detection includes: The usage scenario module is used to collect multiple surrounding environmental parameters of the network attack and defense platform, and determine the usage scenario of the network attack and defense platform based on the model of the network attack and defense platform and multiple surrounding environmental parameters. The fault detection module is used to identify multiple sub-test items based on the test sequence list of the network attack and defense platform, and to determine multiple fault detection modes of the network attack and defense platform based on the multiple sub-test items, the usage scenario of the network attack and defense platform, and multiple working parameters. The internal fault feature module is used to determine the multi-dimensional detection system of the network attack and defense platform based on multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform. It collects fault test data sets of each fault detection dimension and determines multiple internal fault features based on the identification of the fault test data sets of each fault detection dimension. The fault event module is used to identify multiple external fault features based on the recognition of multiple images from the network attack and defense platform, and to determine the corresponding fault events based on the multiple external fault features, multiple internal fault features, and the working procedures of the network attack and defense platform. The fault optimization content module is used to determine the fault optimization strategy of the network attack and defense platform based on various fault events and the current working status of the network attack and defense platform, and to determine the current fault optimization content based on the fault optimization strategy and the current working procedure of the network attack and defense platform.

[0006] Compared with the prior art, the beneficial effects of the present invention are: In this embodiment of the invention, the method is used to determine a multi-dimensional detection system for the network attack and defense platform based on multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform. This involves collecting fault test data sets for each fault detection dimension, identifying multiple internal fault characteristics based on the identification of the fault test data sets for each fault detection dimension, introducing multiple fault detection modes, and controlling these multiple fault detection modes. This approach takes into account the overall considerations of multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform, thereby improving the accuracy of the multi-dimensional detection system and further enhancing the accuracy of the internal fault characteristics.

[0007] Therefore, multiple external fault characteristics are identified based on the recognition of multiple images from the network attack and defense platform. Corresponding fault events are then determined based on these external and internal fault characteristics and the operational procedures of the network attack and defense platform. Fault optimization strategies for the network attack and defense platform are determined based on each fault event and its current operational status. Finally, the current fault optimization content is determined based on these strategies and the platform's current operational procedures. By incorporating various fault events, a holistic consideration of each fault event and the platform's current operational status is achieved, improving the accuracy of fault optimization content and facilitating dynamic fault optimization of the network attack and defense platform. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating the fault optimization method of a network attack and defense platform based on fault detection in an embodiment of the present invention. Figure 2 This is a flowchart illustrating step S11 of the fault optimization method for a network attack and defense platform based on fault detection in an embodiment of the present invention. Figure 3 This is a flowchart illustrating step S12 of the fault optimization method for a network attack and defense platform based on fault detection in an embodiment of the present invention. Figure 4 This is a flowchart illustrating step S13 of the fault optimization method for a network attack and defense platform based on fault detection in an embodiment of the present invention. Figure 5 This is a flowchart illustrating step S14 of the fault optimization method for a network attack and defense platform based on fault detection in an embodiment of the present invention. Figure 6 This is a flowchart illustrating step S15 of the fault optimization method for a network attack and defense platform based on fault detection in this embodiment of the invention. Figure 7 This is a schematic diagram of the structural composition of the fault optimization system of the network attack and defense platform based on fault detection in an embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0010] Please see Figures 1 to 7 A fault optimization method for a network attack and defense platform based on fault detection is proposed and applied to fault optimization scenarios of the network attack and defense platform. The fault optimization method for the network attack and defense platform based on fault detection includes: Step S11: Collect multiple surrounding environmental parameters of the network attack and defense platform, and determine the usage scenario of the network attack and defense platform based on the model of the network attack and defense platform and the multiple surrounding environmental parameters; Step S12: Based on the identification of the test sequence list of the network attack and defense platform, determine multiple sub-test items, and determine multiple fault detection modes of the network attack and defense platform according to the multiple sub-test items, the usage scenario of the network attack and defense platform, and multiple working parameters; Step S13: Based on multiple fault detection modes, the external form of the network attack and defense platform and the model of the network attack and defense platform, determine the multi-dimensional detection system of the network attack and defense platform, so as to collect fault test data sets of each fault detection dimension, and determine multiple internal fault characteristics based on the identification of the fault test data sets of each fault detection dimension. Step S14: Based on the recognition of multiple images from the network attack and defense platform, determine multiple external fault features, and based on the multiple external fault features, multiple internal fault features, and the working procedures of the network attack and defense platform, determine the corresponding fault events. Step S15: Determine the fault optimization strategy of the network attack and defense platform based on each fault event and the current working status of the network attack and defense platform, and determine the current fault optimization content based on the fault optimization strategy and the current working procedure of the network attack and defense platform. refer to Figure 2 In step S11, the specific steps are as follows: S111: Collect the current location of the network attack and defense platform, determine the surrounding detection area of ​​the network attack and defense platform based on the current location and external form of the network attack and defense platform, and determine multiple surrounding environmental parameters of the network attack and defense platform based on the environmental detection of the surrounding detection area. S112: Based on the combination of multiple surrounding environment parameters of the network attack and defense platform, each surrounding environment combination is configured, and the environment matching coefficient of each surrounding environment combination is marked. S113: Determine the characteristics of each environment based on the combination of each surrounding environment, the corresponding environment matching coefficient, and the model of the network attack and defense platform. Determine the application scenario of the network attack and defense platform based on the characteristics of each environment and the scenario mapping relationship.

[0011] In the embodiments of this application, the current location of the network attack and defense platform is collected, and a radius or range centered on that location is set based on the collected current location; for example, the physical location can be represented by a circular or rectangular area; the shape of the platform (size, antenna direction, interface layout, etc.) will affect its "sensing" range; at this time, if the platform has a directional antenna (such as the beamwidth of a Wi-Fi antenna), then the detection area is a fan-shaped area, rather than an omnidirectional circle; large rack-mounted equipment is more sensitive to temperature, humidity, and airflow within a few meters; small equipment has a smaller affected range; the location of the network interface affects which directions of network traffic are more easily monitored or interfered with. Furthermore, the detection area is calculated by combining the location and shape.

[0012] Within the detection area identified in the previous step, various data reflecting the environmental state of that area are collected. This data will be used to assess the current environmental conditions of the platform. Optionally, the platform's built-in temperature, humidity, voltage, and current sensors can directly measure its local environment. Physical environment: temperature, humidity, air pressure, vibration, and electromagnetic interference intensity; Network environment: bandwidth utilization, latency, packet loss rate, number of TCP / UDP connections, number of active sessions, traffic on specific ports, traffic patterns of adjacent network segments, DNS query latency, and external reachability; Security environment: abnormal traffic patterns detected within the detection area, number of known malicious IP addresses, scanning activity frequency, and exposure of specific vulnerabilities.

[0013] Furthermore, the collected independent environmental parameters are combined according to certain rules or logic to form a more macroscopic and representative description of the environmental state. Directly using scattered parameters is difficult to reflect the overall environment in which the platform is located, but combining them can form a more meaningful "environmental pattern" or "environmental state". At the same time, the values ​​of each parameter are combined in a Cartesian product. For example, if the temperature only has three states: "high", "medium", and "low", and the humidity only has two states: "high" and "low", then there are six combinations: "high temperature and high humidity", "high temperature and low humidity", "medium temperature and high humidity", "medium temperature and low humidity", "low temperature and high humidity", and "low temperature and low humidity".

[0014] Each formed "surrounding environment combination" is assigned a "matching coefficient." This coefficient quantifies the degree of matching between the combination and the platform's "ideal" or "typical" operating environment, or in other words, quantifies the degree of "abnormality" or "specialness" of the combination. A high matching coefficient indicates that the environment combination is very close to the platform's expected operating environment, representing a relatively "normal" or "standard" environment. A low matching coefficient indicates that the environment combination differs significantly from the platform's expected operating environment, representing a relatively "abnormal" or "harsh" environment. Furthermore, the deviation of the current environment combination parameter value from its historical average or standard value is calculated; the greater the deviation, the lower the matching coefficient.

[0015] Therefore, the characteristics of each environment are determined based on the combination of various surrounding environments, the corresponding environment matching coefficients, and the model of the network attack and defense platform. The usage scenarios of the network attack and defense platform are determined based on the mapping relationship between each environment characteristic and the scenario. This approach takes into account the overall consideration of the mapping relationship between each environment characteristic and the scenario, ensuring the accuracy of the usage scenarios of the network attack and defense platform. At this point, the environmental combination with matching coefficients formed in S112 is combined with the platform's own model characteristics to extract more refined features that better represent the current environmental state of the platform. This step aims to extract the most critical part that affects the operation of the platform from a large amount of environmental information.

[0016] The environmental combination in S112 describes the composition of the environment, while the matching coefficient quantifies the degree of deviation of the environment from the ideal environment; for example, one environmental combination is "high temperature, high humidity, high load", with a matching coefficient of 0.4 (indicating poor); another combination is "normal temperature, normal humidity, low load", with a matching coefficient of 0.95 (indicating good).

[0017] Different network attack and defense platform models have different hardware configurations, software functions, and design goals, and their sensitivity to the environment also varies. For example, a platform that focuses on high-speed packet analysis is very sensitive to network latency and bandwidth, while a platform that focuses on deep packet inspection is more sensitive to CPU performance and memory capacity. Model information can guide us to pay attention to which environmental parameters and their combinations. Based on the above two points, we extract the features that best summarize the current environmental state and are strongly correlated with the operation of the platform model. The features should be more abstract and focused than the original environmental combinations.

[0018] Example of a feature: For a temperature-sensitive platform model A, the environmental combination obtained in S112 is "high temperature, normal humidity, low network latency" with a matching coefficient of 0.7, which is extracted as the feature "high temperature operating environment"; For a platform model B with high network quality requirements, the environmental combination obtained in S112 is "normal temperature, normal humidity, high network latency, low bandwidth" with a matching coefficient of 0.5, which is extracted as the feature "network congestion environment"; For a general-purpose platform model C, the environmental combination obtained in S112 is "high temperature, high humidity, high load" with a matching coefficient of 0.3, which is extracted as the feature "harsh operating environment".

[0019] Scenario mapping relationships are typically a pre-established rule base or knowledge base that defines which environmental features (or combinations of features) correspond to which use cases. For example: Rule 1: If the environmental feature is "high-temperature operating environment" and the matching coefficient is <0.8, then the scenario is "data center high-load testing"; Rule 2: If the environmental feature is "network congestion environment", then the scenario is "complex network penetration testing"; Rule 3: If the environmental feature is "harsh operating environment", then the scenario is "field / harsh condition deployment"; Rule 4: If all environmental features match well (high matching coefficient) and the platform model is C, then the scenario is "laboratory routine functional testing".

[0020] The obtained environmental features are substituted into this mapping relationship for matching to find the scene description that best matches the current feature combination; there may be one best matching scene, multiple matching scenes (which need to be further filtered or combined), or no matching scenes (which need to be marked as "unknown scene" or "normal scene").

[0021] refer to Figure 3 In step S12, the specific steps are as follows: S121: Collect the internal database of the network attack and defense platform, determine the test sequence list of the network attack and defense platform based on the internal database and time dimension, determine multiple sub-test items based on the division of the test sequence list, and mark the corresponding test content for each sub-test item. S122: Collect the usage scenarios of the network attack and defense platform, and determine the first fault detection coefficient based on multiple sub-test projects and the usage scenarios of the network attack and defense platform, and determine the second fault detection coefficient based on multiple sub-test projects and multiple working parameters of the network attack and defense platform; S123: Based on the first fault detection coefficient, the second fault detection coefficient, and the mapping relationship of detection modes, the corresponding sub-detection mode is determined. At the same time, based on the comparison of the first fault detection coefficient and the second fault detection coefficient, the corresponding correlation coefficient is determined. Based on the correlation coefficient and the sub-detection mode, multiple fault detection modes of the network attack and defense platform are determined. In the embodiments of this application, the internal database of the network attack and defense platform is collected. From the massive amount of internal data collected, test tasks that need to be executed at a specific time point or time period are selected and arranged into an ordered list, namely the test sequence list, according to a certain logic (such as priority, dependency relationship, execution order).

[0022] The time dimension is key to dynamic filtering; the time dimension is reflected in relative time: such as "execute the 'service identification' sub-test project immediately after completing the 'port scanning' sub-test project"; test tasks that meet the conditions are filtered according to time conditions (such as planned execution time, trigger condition timestamp), and then these tasks are sorted according to preset rules (such as priority, dependency relationship, resource requirements) to generate the final test sequence list.

[0023] The generated test sequence list is further broken down into smaller and more executable units, namely sub-test items; and each sub-test item is clearly labeled with its specific test content so that subsequent steps can perform targeted fault detection; the division can be based on various factors: functional modules, technology types, target systems, or test steps; each sub-test item is given a clear label or description explaining what it is specifically supposed to do.

[0024] Furthermore, the use cases of the network attack and defense platform are collected. These cases describe the current environmental state and operating conditions of the platform, such as "high-intensity confrontation environment", "routine penetration testing", "internal security audit", etc. This information is crucial for understanding the importance of testing, potential risks and interference encountered.

[0025] The first fault detection coefficient is determined based on multiple sub-test projects and the usage scenarios of the network attack and defense platform. The calculation of this coefficient needs to consider: the nature of the sub-test project: for example, whether a sub-test project involves high bandwidth consumption, long-term operation, dependence on specific network protocols, or whether it triggers the target system's security protection mechanisms; the characteristics of the usage scenario: for example, in a "high-intensity confrontation environment," the network is unstable, there is a large amount of interference traffic, and the target system has stronger anti-reconnaissance capabilities; while in "internal security audits," the network is usually more stable and there is less interference; if the sub-test project requires a stable network, but the current scenario is a "network congestion area," then this coefficient should be higher, indicating that executing this test is more likely to fail or the results are unreliable; conversely, if the sub-test project is a lightweight port scan, the coefficient is lower in a "stable office environment."

[0026] Specifically, a first scoring model is designed; a series of environment-related attribute weights (such as network stability requirements, bandwidth requirements, interaction complexity, etc.) are defined for each sub-test item; then, based on the feature values ​​of the current scenario (such as the environment matching coefficients and specific parameter values ​​calculated in S11 / S112 / S113), the attributes of the sub-test items are matched and calculated to obtain a coefficient value between 0 and 1; the higher the value, the more "dangerous" or "difficult" it is to perform the test in the current scenario, requiring higher attention or more stringent testing.

[0027] The second fault detection coefficient is determined based on multiple sub-test projects and various operating parameters of the network attack and defense platform. The calculation of this coefficient needs to consider: the resource consumption of the sub-test projects: for example, whether a certain sub-test project requires a large amount of CPU, memory, network bandwidth, storage space, etc.; the current operating parameters of the platform: these parameters can be obtained through the platform's internal monitoring system, such as the current CPU utilization, memory usage, disk I / O, network interface speed, the operating status of each functional module (normal / warning / error), remaining storage space, etc.; resource matching degree: if the sub-test project requires high CPU computation, but the platform's current CPU utilization is already high, then this coefficient should be high, indicating that executing this test causes the platform to experience performance bottlenecks or crashes; conversely, if the platform resources are sufficient, the coefficient will be low.

[0028] Specifically, a second scoring model is designed; the expected resource consumption of each sub-test item is defined; then, these expected consumptions are compared with the platform's current actual operating parameters; for example, if a sub-test item is expected to require 50% CPU, while the platform's current CPU utilization is already 70%, then this coefficient will increase significantly; a coefficient value between 0 and 1 can be obtained by setting a threshold, calculating the resource stress ratio, etc.; the higher the value, the more likely the execution of the test under the current platform conditions will cause problems for the platform itself.

[0029] Therefore, based on the mapping relationship between the first fault detection coefficient, the second fault detection coefficient, and the detection mode, the corresponding sub-detection mode is determined. At the same time, based on the comparison between the first fault detection coefficient and the second fault detection coefficient, the corresponding correlation coefficient is determined. Based on the correlation coefficient and the sub-detection mode, multiple fault detection modes of the network attack and defense platform are determined, which takes into account the overall consideration of the correlation coefficient and the sub-detection mode, and ensures the accuracy of multiple fault detection modes of the network attack and defense platform.

[0030] At this point, the detection mode mapping relationship is a preset rule base or decision table, which defines which detection mode should be used under different combinations of coefficients; for example: high first coefficient (high environmental risk) + high second coefficient (high platform pressure): mapped to "conservative mode" or "low priority mode", that is, reduce the intensity of testing, increase the interval, or even skip it; high first coefficient + low second coefficient: mapped to "environmental monitoring mode", that is, focus on monitoring environmental changes, wait for the conditions to improve before execution, or add stronger disguise when execution.

[0031] Low first coefficient + high second coefficient: mapped to "platform optimization mode", that is, adjusting test parameters to reduce the consumption of platform resources, or temporarily reducing the priority of other non-critical tasks on the platform; Low first coefficient + low second coefficient: mapped to "standard mode" or "high priority mode", that is, normal execution, or even increasing the test intensity or frequency; the system finds the mapping relationship based on the specific coefficient value calculated by S122, and matches a temporary "sub-detection mode" for each sub-test item.

[0032] To quantify the relative relationship between the first coefficient (environmental risk) and the second coefficient (platform stress), and to understand which factor is the primary constraint on test execution, this "correlation coefficient" can be used to adjust the final testing strategy to make it more targeted. Comparison method: Difference: |First Coefficient - Second Coefficient|; If the first coefficient is much larger than the second coefficient (e.g., a large difference and a high first coefficient), the correlation coefficient indicates that "the environment is the primary limiting factor," meaning that even if the platform is in good condition, the external environment is dangerous; if the second coefficient is much larger than the first coefficient, the correlation coefficient indicates that "the platform is the primary limiting factor," meaning that even if the environment is relatively safe, the platform's own poor condition limits the test; if the two are close, the correlation coefficient indicates that "both have a combined effect."

[0033] Based on the sub-detection modes and combined with the main contradictions reflected by the correlation coefficients, a more refined "fault detection mode" is finally determined for each sub-test item. Here, the "fault detection mode" is more specific than the "sub-detection mode", or it is a combination and priority ranking of multiple sub-detection modes.

[0034] The correlation coefficient provides direction for adjustments. For example, if the correlation coefficient indicates that "the environment is the main limiting factor," even in "standard mode," stronger environmental awareness and adaptive logic need to be added, such as dynamically adjusting test parameters to avoid detection. If the correlation coefficient indicates that "the platform is the main limiting factor," even in "standard mode," more attention needs to be paid to resource management, such as concentrating execution when the platform load is low or offloading some computing tasks. The correlation coefficient is also used to determine the execution order or parallelism between multiple sub-detection modes. For example, for tasks heavily constrained by the environment, their priority can be reduced; for tasks heavily constrained by the platform, they can be scheduled during platform idle periods. The adjusted strategy is determined as the final fault detection mode, which is a mode name and also a configuration object containing specific parameters (such as priority, resource allocation ratio, environmental response strategy, etc.).

[0035] Specifically, Sub-test Project A: The sub-detection mode is "Conservative Mode," and the correlation coefficient is "Environment is a slightly major limiting factor." Based on "Conservative Mode," environmental monitoring is further emphasized, such as adding real-time monitoring of target network traffic. Once an abnormal increase is detected (indicating a more dangerous environment), the execution intensity of A is immediately paused or reduced. The final mode can be named "Environment-Sensitive Conservative Mode." Sub-test Project B: The sub-detection mode is the default "Standard Mode" (assuming the first coefficient of 0.4 and the second coefficient of 0.1 map to the Standard Mode), and the correlation coefficient is "Environment is the major limiting factor." Although the platform pressure is low, the environment still needs to be considered. Under "Standard Mode," some lightweight environment masquerading is added, such as randomizing the scan source IP (if) or using more common scan port combinations. The final mode can be named "Standard Mode (with Environment Masquerading)."

[0036] refer to Figure 4 In step S13, the specific steps are as follows: S131: Collect multiple fault detection modes, determine multiple fault detection combinations based on the matching of multiple fault detection modes and network attack and defense platform models, determine the corresponding fault detection dimensions based on the identification of multiple fault detection combinations, and mark the fault detection content corresponding to multiple fault detection combinations. S132: Determine the multi-dimensional detection system of the network attack and defense platform based on the fault detection dimensions, corresponding fault detection content, and external form of the network attack and defense platform corresponding to multiple fault detection combinations, and trigger cross-detection of the network attack and defense platform in different fault detection dimensions based on the multi-dimensional detection system of the network attack and defense platform to determine the fault test data set of each fault detection dimension. S133: In each fault test data set, multiple fault parameters are determined based on the detection of the fault test data set, and multiple internal fault features are determined based on the cross-identification of multiple fault parameters. The multiple internal fault features are distributed in different internal components of the network attack and defense platform. In the embodiments of this application, all sub-detection modes generated in S123 are collected to form a mode set that can be used in subsequent steps. This set contains a variety of detection modes with different levels of strictness and different focuses, such as: fast scanning mode, deep penetration mode, resource lightweight mode, high stealth mode, etc.

[0037] The collected detection modes are matched with specific platform models to generate "fault detection combinations" that meet detection requirements without exceeding the platform's processing capabilities. Here, "model" can be understood as the platform's hardware configuration, software version, functional modules, and other specific specifications. The matching process needs to consider: Mode requirements vs. platform capabilities: Some detection modes (such as deep scanning and high-concurrency testing) require high CPU, memory, or network bandwidth, requiring the platform model to support them; Mode compatibility: Some modes cannot run simultaneously (e.g., one mode modifies the system configuration, while another depends on the original configuration), requiring consideration of mutual exclusion when combining them; Test target coverage: The combination needs to cover the key aspects to be detected. This step generates one or more "fault detection combinations," each containing a set of detection modes that can be executed collaboratively on that specific platform model.

[0038] The fault detection combinations generated in the previous step are then "categorized" and "described." The purpose is to clarify which aspects (dimensions) of platform faults each combination focuses on, and what specific content the combination will detect. At this point, based on the functions of the sub-detection modes contained in the combination, it is categorized into predefined fault detection dimensions. Common dimensions include: network connectivity, system stability, security protection, resource utilization, and functional integrity. A combination corresponds to one or more dimensions. The specific detection tasks that the combination will perform are clearly described.

[0039] Specifically, we have "Combination A" (deep network scanning mode + deep vulnerability detection mode) and "Combination B" (deep network scanning mode + interface fast self-test mode). Processing Combination A: "Deep Network Scanning Mode" primarily focuses on network-level connectivity and reachability; "Deep Vulnerability Probing Mode" primarily focuses on system / application-level security vulnerabilities; therefore, "Combination A" mainly corresponds to the "network connectivity dimension" and the "security protection dimension"; this combination will perform deep port scanning and service identification on the target network, and perform deep probing on common vulnerabilities (such as SQL injection and XSS) on the identified web services, recording the scan results and vulnerability details; Processing Combination B: "Deep Network Scan Mode" focuses on network connectivity; "Interface Quick Self-Check Mode" focuses on the status of the platform's own hardware interfaces; therefore, "Combination B" mainly corresponds to the "network connectivity dimension" and the "system stability dimension" (interface status is part of system stability); this combination will perform deep port scanning and service identification on the target network, while quickly detecting whether the physical connection status, link speed, and duplex mode of the platform's own network interfaces (such as network cards and switch ports) are normal.

[0040] Furthermore, based on the fault detection dimensions, corresponding fault detection content, and external form of the network attack and defense platform corresponding to multiple fault detection combinations, a multi-dimensional detection system for the network attack and defense platform is determined. Based on this multi-dimensional detection system, cross-detection of the network attack and defense platform at different fault detection dimensions is triggered to determine the fault test data set for each fault detection dimension. This approach takes into account the overall consideration of the fault detection dimensions, corresponding fault detection content, and external form of the network attack and defense platform corresponding to multiple fault detection combinations, ensuring the accuracy of the multi-dimensional detection system of the network attack and defense platform.

[0041] At this point, all the detection dimensions (such as network connectivity, security protection, system stability, etc.) and specific detection content (such as port scanning, vulnerability detection, interface status checks, etc.) corresponding to the fault detection combination are summarized, which ensures that the detection covers all aspects that were previously planned.

[0042] The external form of a network attack and defense platform refers to its physical hardware configuration, software architecture, deployment topology, etc. Based on the above information, a detection system structure is designed. This structure is a hierarchical structure that organizes related detection dimensions and content together; it is also a network structure that represents the dependency or parallel relationship between different detection tasks. This system defines "what we want to detect," "how to organize these detection tasks," and "the execution order or parallel relationship of detection tasks," etc.

[0043] Specifically, we have two fault detection combinations: Combination A: Dimensions = network connectivity, security protection; Content = deep network scanning, web service vulnerability detection; Combination B: Dimensions = network connectivity, system stability; Content = deep network scanning, interface status check; Assuming the external form of the network attack and defense platform is: a physical server with two network interfaces (eth0 connected to the internal network, eth1 connected to the external Internet), and web services are deployed.

[0044] Overall dimensions = network connectivity, security protection, system stability; Overall content = deep network scanning (for internal networks and external internet), web service vulnerability detection (for deployed web services), interface status inspection (for eth0 and eth1); Since there are two network interfaces, deep network scanning needs to be performed separately for the networks connected to eth0 and eth1; interface status inspection needs to be performed separately for eth0 and eth1; web service vulnerability detection targets web services deployed on the server; The constructed multi-dimensional detection system is as follows: Dimension 1: Network connectivity: Task 1.1: Perform deep network scanning on the internal network connected to eth0; Task 1.2: Perform deep network scanning on the external internet connected to eth1.

[0045] Based on the established detection system, the defined detection tasks are actually run. The key lies in "cross-detection" and "data sets." Here, "cross-detection" means that detection tasks from different dimensions will affect each other, or that information from multiple dimensions needs to be combined to evaluate the platform's status. For example, when conducting network connectivity testing (dimensional 1), if an abnormal status is found in a certain interface (dimensional 3), the connectivity test related to that interface needs to be adjusted or stopped, or the interface status information can be used as part of the connectivity test results. Or, when conducting security protection testing (dimensional 2), if the network connectivity test (dimensional 1) finds the target service unreachable, then the security protection test needs to be skipped or the strategy adjusted. Cross-detection emphasizes that the detection tasks are not completely independent, but rather coordinated and feedback-driven. According to the structure of the detection system, each detection task is started, which involves calling the platform's internal detection scripts and tools, or interacting with external detection resources.

[0046] During the execution of the detection task, all relevant data generated are collected. This data consists of raw, unanalyzed detection results; for example, a list of port scan results, detailed vulnerability detection reports, and return values ​​from interface status checks. The collected data is then categorized and organized according to fault detection dimensions. For example, all raw data related to network connectivity (such as scan results and ping results) is grouped into the "Network Connectivity Data Set"; all raw data related to security protection (such as vulnerability reports) is grouped into the "Security Protection Data Set"; and all raw data related to system stability (such as interface status and CPU / memory usage records) is grouped into the "System Stability Data Set".

[0047] Therefore, in each fault test data set, multiple fault parameters are determined based on the detection of the fault test data set, and multiple internal fault features are determined based on the cross-identification of multiple fault parameters. These multiple internal fault features are distributed in different internal components of the network attack and defense platform, which is compatible with the overall consideration of the cross-identification of multiple fault parameters and ensures the accuracy of multiple internal fault features. At the same time, multiple fault detection modes are introduced and controlled, which is compatible with the overall consideration of multiple fault detection modes, the external form of the network attack and defense platform and the model of the network attack and defense platform, improving the accuracy of the multi-dimensional detection system and further improving the accuracy of internal fault features. At this point, a fault test dataset is introduced into each fault test dataset to process and analyze the original detection reports, logs, status information, etc., and extract indicators that can quantify or describe potential fault states, namely fault parameters.

[0048] Specifically, each dataset is as follows: Network connectivity dataset: includes port scan results, ping latency, packet loss rate, routing table information, interface status records, etc.; Security protection dataset: includes vulnerability scan reports (vulnerability name, severity level, affected components), firewall rule hit logs, intrusion detection alarms, etc.; System stability dataset: includes CPU utilization, memory usage, disk I / O, process status, service start / stop logs, interface status reports, etc.

[0049] For each dataset, predefined rules are applied to extract fault parameters. This typically includes: comparing certain metrics to preset thresholds; for example, CPU utilization consistently exceeding 90%; or identifying abnormal patterns in the data; for example, a large number of connection failures on specific ports occurring within a short period of time.

[0050] The extracted parameters are typically specific values, states, or identifiers used to describe a particular aspect of the state; for example: network connectivity parameters: average Ping latency (ms), packet loss rate (%), number of unresponsive ports, number of routing table entries; security protection parameters: number of high-risk vulnerabilities, number of medium-risk vulnerabilities, number of firewall rule hits, number of intrusion alarms; system stability parameters: peak CPU utilization (%), memory usage (%), disk I / O wait time (ms), number of service crashes.

[0051] Multiple internal fault features are determined by cross-identification of multiple fault parameters. After extracting fault parameters from various dimensions, a deeper comprehensive analysis and correlation are conducted. The aim is to identify those more specific fault features that are jointly indicated by multiple parameters and point to one or more components within the platform.

[0052] Simultaneously, parameters from different dimensions are combined to determine characteristics; for example, "if network connectivity parameters show that the target port is inaccessible, and security protection parameters show that the firewall rule corresponding to that port is disabled, then the characteristic of 'firewall rule configuration error' is identified, and the firewall module is located," and the correlation between different parameters is analyzed; for example, the simultaneous occurrence of "peak CPU usage" and "packet loss rate of a specific network interface" points to "overload of the network card driver or network processing module"; or, attempts are made to infer the causal relationship between parameters; for example, "continuously increasing memory usage" leads to "slower scan task response" (increased latency), thus... The "memory leak" characteristic is inferred, locating the process or module responsible for the scanning task. The identified characteristics are more specific and structured fault descriptions than single parameters, and clearly point to internal components of the platform. For example: Characteristic 1: "Firewall rule configuration error (port 80 disabled)," locating component: firewall module / configuration file; Characteristic 2: "Network card driver overload causing packet loss," locating component: network interface card (NIC) driver; Characteristic 3: "Scanning engine memory leak," locating component: scanning service process / module; Characteristic 4: "Database connection pool exhausted," locating component: database service / connection management module.

[0053] refer to Figure 5 In step S14, the specific steps are as follows: S141: Collect multiple images of the network attack and defense platform based on the circumferential detection of the network attack and defense platform by UAV, determine the actual three-dimensional model of the network attack and defense platform based on the multiple images of the network attack and defense platform and the external shape of the network attack and defense platform, and determine multiple external fault characteristics based on the external fault detection of the actual three-dimensional model of the network attack and defense platform. S142: Multiple sub-fault events are determined based on the combination of multiple external fault characteristics and multiple internal fault characteristics, and the corresponding fault screening system is determined based on the matching of multiple sub-fault events and the working parameters of the network attack and defense platform. S143: Based on the fault screening system, trigger multiple sub-fault events for fault screening to determine multiple predicted fault events; collect the work procedures of the network attack and defense platform, and determine the corresponding fault events based on the work procedures of the network attack and defense platform and multiple predicted fault events; In the embodiments of this application, multiple images of the network attack and defense platform are collected based on the circumferential detection of the network attack and defense platform by the drone. The drone will not only take pictures from a fixed position, but will fly around the network attack and defense platform. For example, the drone can be set to fly on a track at a certain distance around the platform, while adjusting its height and angle to ensure that clear images can be taken from the top, bottom, sides and all corners. This "circumferential" method is to obtain complete visual coverage of the outside of the platform and avoid missing any area.

[0054] This process generates a large amount of image data, which needs to meet certain overlap requirements (e.g., 60%-80% overlap between adjacent images), which is crucial for subsequent 3D reconstruction using computer vision technology. During acquisition, lighting conditions need to be considered, and the acquisition should be carried out under uniform and sufficient light to reduce the impact of shadows and reflections on image quality.

[0055] Multiple images and the external form of the network attack and defense platform are introduced. The multiple images contain rich spatial geometric and texture information. The external form of the network attack and defense platform can be understood as the approximate shape, size or known structural information of the platform. For example, we know that it is a cuboid and its approximate height and width. This prior information can be used as constraints to help improve the accuracy and speed of 3D reconstruction, especially in areas with low image quality or insufficient feature points. The actual stereo model is a 3D reconstruction process in computer vision. Common techniques include: automatically finding and matching the same feature points (such as corners, edges, etc.) in all images; calculating the coordinates of these feature points in 3D space by analyzing the matching relationship of feature points and camera pose, thereby reconstructing the surface geometry of the object; and further utilizing the pixel information of the image to generate a denser point cloud or mesh model based on the sparse point cloud, resulting in more refined surface details. The final "actual stereo model" is usually a 3D point cloud, mesh model, or textured model that accurately reflects the external physical shape and structure of the network attack and defense platform.

[0056] External fault detection is performed on the actual 3D model of the network attack and defense platform. "External fault detection" is a model-based analysis process. The system searches for signs of faults on the 3D model according to the preset "fault rule base" or "anomaly detection algorithm". These rules include: geometric anomalies: such as missing components (an interface or fan is not in the expected position), component deformation (such as twisted cabinet doors or dented panels), and component misalignment (such as loose screws causing component displacement); texture / color anomalies: such as discoloration caused by overheating (by comparing the texture color on the model with the normal color database), physical damage (such as cracks or scratches, manifested as texture interruption or irregularity), and dust accumulation (causing darkening of specific areas or abnormal reflection); missing features: such as an indicator light not being lit on the model (if the model contains lighting information).

[0057] Each detected anomaly or region is recorded as an "external fault feature," which is typically assigned attributes such as location information (coordinates on the 3D model), type (e.g., "interface missing," "panel dent," "overheating discoloration"), and severity (e.g., minor, moderate, severe).

[0058] Furthermore, multiple external fault features and multiple internal fault features are introduced. External features describe abnormal physical states of the platform (such as missing interfaces, overheating and discoloration, looseness, etc.), while internal features describe abnormalities during platform operation (such as CPU overload, memory leaks, network packet loss, response timeouts of specific modules, etc.).

[0059] "Combination" means that the system needs to analyze whether there is a correlation between these internal and external features or whether they all point to a potential problem. This is usually not a simple addition of features, but requires certain rules or algorithms to determine whether they are caused by the same root cause or whether they together constitute a more complex failure scenario.

[0060] Predefine some association rules; for example: "If physical damage to an external interface is detected (external feature), and at the same time the internal module corresponding to that interface reports a communication failure (internal feature), then combine them into a 'interface communication failure' sub-event"; "If localized overheating and discoloration of the device casing (external feature) are detected, and at the same time, internal sensors report an abnormal increase in the temperature of the corresponding component in that area (internal feature), then this is combined into a 'component overheating fault' sub-event." "If multiple internal modules are detected to have intermittent response timeouts (internal characteristics) but no obvious external physical damage, they are combined into a 'internal network congestion or software conflict' sub-event."

[0061] The system needs to "package" the relevant internal and external features according to these rules to form one or more "sub-fault events". A sub-fault event can usually describe a specific cause or phenomenon better than a single feature. The output is "multiple sub-fault events". Each sub-fault event is associated with a set of fault features (including external and internal) and provides a preliminary description of the fault phenomenon. These sub-events are more structured and meaningful information units than the original features.

[0062] Specifically, the system first checks the rule base; the rule includes: "Interface physical missing (external) + corresponding module unresponsive (internal) > combined into the sub-event 'interface module communication interruption'"; the system finds that external feature 1 (interface missing) and internal feature 3 (right network module unresponsive) are highly correlated, and they point to the same problem: the right network interface and its associated module have failed; therefore, the system combines these two features to determine the first sub-fault event: "Sub-fault event A: interface module communication interruption"; its associated features are interface missing and module unresponsive, and its severity is comprehensively assessed as severe.

[0063] The system continued its check; the rules included: "Overheating and discoloration of the casing (external) + unstable fan speed (internal) + high CPU utilization (internal) > combination into 'heat dissipation system malfunction' sub-event". The system found that external feature 2 (overheating and discoloration) was related to internal feature 4 (high CPU load) and internal feature 5 (unstable fan speed). Overheating was caused by high load and also by fan failure. Unstable fan speed directly pointed to a fan problem. These three features together pointed to a problem with the heat dissipation system. Therefore, the system combined these three features to determine the second sub-fault event: "Sub-fault event B: Heat dissipation system malfunction". Its associated features are overheating and discoloration, high CPU load, and unstable fan speed. The severity was comprehensively assessed as severe (because it involves overheating and core component load). Finally, two sub-fault events were determined: A (interface module communication interruption) and B (heat dissipation system malfunction).

[0064] Multiple sub-fault events and network attack and defense platform operating parameters are introduced. "Matching" refers to analyzing the occurrence of each sub-fault event and, within the context of the current platform operating parameters, whether its importance and impact require special attention. Different operating parameters indicate different platform states, with varying tolerances and concerns regarding faults. Sub-fault events are then correlated with operating parameters; for example: "If the sub-fault event is 'interface module communication interruption,' and the platform's current operating parameters show that a 'port scan' task is being performed, then this event should be filtered with high priority, because communication interruption will directly affect task execution." "If the sub-fault event is 'abnormally high CPU utilization,' and the platform's current operating parameters show that it is in 'defense hardening mode' and the CPU load threshold is set high, then this event should be filtered with low priority, because defense mode itself requires high load." "If the sub-fault event is 'suspected overheating and discoloration,' and the platform's current operating parameters show that it is during nighttime maintenance, then this event should be marked as needing to be recorded and processed later, with a lower priority than faults in real-time tasks."

[0065] Based on these matching rules, a "fault screening system" is constructed. This system defines how to prioritize and classify sub-fault events (e.g., urgent, important, general, record) under different operating parameters, and whether to trigger alarms or take subsequent actions immediately. This system makes fault handling more intelligent and contextualized. The output is the "corresponding fault screening system", which is a set of rules or logic that links sub-fault events with the platform's operating status, providing a decision basis for subsequent fault screening (S143).

[0066] Specifically, for sub-fault event A (interface module communication interruption): Rule 1: satisfied (severity level, non-maintenance period); Rule 2: satisfied (port scan requires network communication); therefore, the priority of event A is set to "urgent"; For sub-fault event B (heat dissipation system malfunction): Rule 1: Meets the criteria (severity level, non-maintenance period); Rule 3: Current CPU load is 70%, not high, priority is initially set to "important"; Rule 4: Port scanning tasks have certain stability requirements, but usually not as high as long-term high-load penetration; The system judges that Rule 3 has a higher priority and maintains the "important" priority; or, if the rule definition is more detailed, the priority will be raised to "relatively high"; The system has established a temporary fault screening system, which is as follows: Sub-fault event A (interface module communication interruption): screening priority is "urgent"; Sub-fault event B (heat dissipation system malfunction): screening priority is "important" (or "higher"). This screening system clarifies which sub-fault event needs to be handled first when the "port scanning" task is in progress under the current "penetration testing mode".

[0067] Therefore, based on the fault screening system, multiple sub-fault events are triggered for fault screening to determine multiple predicted fault events; the work procedures of the network attack and defense platform are collected, and the corresponding fault events are determined according to the work procedures of the network attack and defense platform and multiple predicted fault events. This approach is compatible with the overall consideration of the work procedures of the network attack and defense platform and multiple predicted fault events, ensuring the accuracy of the corresponding fault events. At this point, the input is the "fault screening system" determined in S142 and the "multiple sub-fault events" generated in S142; the fault screening system includes the priority, importance or other screening criteria (such as urgent, important, general, or specific thresholds) of the sub-fault events; "trigger" means that the system starts processing the list of sub-fault events according to the rules in the fault screening system; the purpose of screening is usually to select the most noteworthy, most frequent, or most urgent sub-fault events from among many sub-fault events based on criteria such as priority, scope of impact, and frequency of occurrence.

[0068] The filtering logic includes: Priority filtering: only retaining sub-fault events with a priority higher than a certain threshold (e.g., only retaining "urgent" and "important" levels); Impact assessment: assessing the impact of sub-fault events on the overall platform functionality or current tasks, prioritizing those with a greater impact; Occurrence frequency / duration: giving higher filtering weight to sub-fault events that are persistent or occur frequently; Task relevance: considering the main tasks currently being performed on the platform, prioritizing the filtering of sub-fault events that affect the task.

[0069] The result of the filtering is "multiple predicted failure events". Here, "prediction" means: Trend-based prediction: If a sub-failure event (such as a continuous increase in CPU temperature) conforms to the trend of leading to more serious failures in historical data, it is predicted as a higher-level failure event that will evolve into a failure event; Correlation-based prediction: If multiple sub-failure events (such as memory leaks and slow response of specific services) occur together, the system predicts that this is a failure event that will lead to service crash; Direct mapping: In simple cases, the filtered sub-failure events are also directly regarded as predicted failure events, especially when these sub-failure events themselves represent a complete and identifiable failure scenario.

[0070] Specifically, suppose S142 outputs the following sub-fault events and filtering system: Sub-fault event A: Interface module communication interruption (priority: urgent); Sub-fault event B: Heat dissipation system malfunction (priority: important); Sub-fault event C: Disk read / write speed decrease (priority: normal); Fault filtering system rule: Prioritize processing sub-fault events with priority of "urgent" or "important".

[0071] The system triggers the screening of sub-fault events according to the screening system rules. It checks the priority of each sub-fault event; sub-fault event A (urgent) and sub-fault event B (important) meet the screening criteria; sub-fault event C (general) is filtered out; the system also makes trend predictions: if the interface module communication interruption (sub-fault event A) persists, and historical data shows that this usually leads to the entire network module crashing, then the system also lists "complete network module crash" as a "predicted fault event"; the final "multiple predicted fault events" are: interface module communication interruption (directly from sub-fault event A); heat dissipation system abnormality (directly from sub-fault event B); predicted complete network module crash (based on the trend prediction of sub-fault event A).

[0072] The input consists of a set of "multiple predicted failure events" and the "work procedures of the network attack and defense platform" that need to be collected. The work procedures refer to a series of operation steps or task processes that the platform is currently executing. For example, a penetration test is in progress, and its procedures include: information gathering > vulnerability scanning > privilege escalation > data theft, etc.

[0073] This is achieved by monitoring the platform's task queue, reading current active session information, or querying the platform's status API. Understanding what the platform is doing is crucial for comprehending the practical significance of predicted failure events. The system needs to combine abstract predicted failure events with the platform's current specific work procedures to generate more concrete and realistic descriptions of "failure events." This process involves: placing the predicted failure event within the context of the current work procedure; for example, a predicted "complete network module failure" occurring during the "information gathering" phase has a different impact and urgency than one occurring during the "data theft" phase; and assessing the direct or indirect impact of the predicted failure event on the current work procedure. Impact; for example, if interface communication interruption (predicted event 1) occurs during the "information gathering" phase, it directly leads to the failure of the scanning task; if it occurs during the "data theft" phase, it prevents data transmission; transforming predicted failure events into more specific, actionable, and understandable failure events; for example, refining "predicted complete network module downtime" to "during the information gathering phase, due to interface module communication interruption, all subsequent tasks relying on network connections fail"; the final output is "corresponding failure events," which are the results after contextualization and impact assessment, and they more specifically describe the actual problems and consequences caused by the predicted failure events under the current operating state of the platform.

[0074] Specifically, for predicted event 1 (interface module communication interruption): combined with the current process "information collection (port scanning)", the system determines the corresponding fault event as: "During the information collection phase, the interface module communication is interrupted, resulting in the port scanning task being unable to be completed or the results being incomplete".

[0075] For predicted event 2 (heat dissipation system malfunction): Based on the current process, the system determines the corresponding fault event as: "During the information collection phase, the heat dissipation system malfunctions, causing a decrease in platform performance and affecting port scanning speed, but the task is not directly interrupted at present."

[0076] For predicted event 3 (predicted network module complete failure): Based on the current process, the system determines the corresponding failure event as: "If the communication interruption problem of the interface module continues to worsen during the information collection phase, it will cause the network module to completely fail, thereby forcing the entire penetration testing task to be terminated"; the final determined "corresponding failure event" is the above three contextualized descriptions.

[0077] refer to Figure 6 In step S15, the specific steps are as follows: S151: Collect the current working status of the network attack and defense platform, which includes network attack status, network defense status, network infiltration status, and integrated attack and defense status; determine multiple fault optimization events based on the current working status of the network attack and defense platform and various fault events; S152: Determine multiple fault optimization contents based on the analysis of multiple fault optimization events, and determine the fault optimization strategy of the network attack and defense platform based on the multiple fault optimization contents and the current working status of the network attack and defense platform. S153: In this fault optimization strategy, multiple online optimization items are determined based on the analysis of the fault optimization strategy, and the current fault optimization content is determined according to the fault optimization content, fault optimization order and the current work procedure of the network attack and defense platform of the multiple online optimization items. In the embodiments of this application, the current working state of the network attack and defense platform is as follows: This refers to the main tasks or modes that the platform is currently performing; specifically, it includes: Network attack state: The platform is actively performing offensive operations such as penetration testing, vulnerability exploitation, and network scanning; Network defense state: The platform is performing defensive operations such as intrusion detection, firewall rule updates, log monitoring, and emergency response; Network stealth state: The platform is in standby, low-power monitoring, or covert penetration (such as maintaining persistence in the internal network); Offense and defense integrated state: The platform performs both attack and defense tasks simultaneously, for example, in simulated confrontation exercises, it plays both the role of attacker and defender.

[0078] Each fault event is a filtered and contextualized list of predicted fault events output by step S143; for example, "CPU overheating leads to decreased scan performance", "Disk I / O blocking affects log writing", "Network interface interruption leads to information collection failure", etc.

[0079] The system first needs to accurately identify the platform's current operating state, which can be achieved by monitoring the platform's core task processes, API calls, configuration file status, or user commands. It then needs to correlate the current operating state with identified fault events. The key is to assess the impact and urgency of the fault events on the current operating state. For example, in a "network attack state," "overheating CPU" significantly impacts scanning speed; "network interface interruption" causes the attack task to fail completely, a catastrophic impact. In a "network defense state," "disk I / O blocking affecting log writing" affects post-incident analysis, but if it affects Intrusion Detection System (IDS) rule updates, it is even more serious; "network interface interruption" also prevents critical defense information from being obtained or sent. In a "network incubation state," there is a higher tolerance for resource consumption and abnormal behavior, but "network interface interruption" exposes anomalies. In a "combined offense and defense state," it is necessary to consider the impact on both attack and defense aspects simultaneously.

[0080] Based on the above correlation analysis, fault events are transformed into specific "fault optimization events." These optimization events not only contain information about the fault itself but also clearly indicate the reasons and objectives for optimization measures needed in the current state. For example: from "CPU overheating causing decreased scanning performance," an optimization event is generated: "CPU load needs to be optimized to restore attack scanning performance." From "Network interface interruption causing information collection failure," an optimization event is generated: "The network interface needs to be urgently restored to resume the attack information collection task." From "Disk I / O blocking affecting log writing," an optimization event is generated: "Disk I / O needs to be optimized to ensure complete recording of defense logs." Multiple fault optimization events are output, which serve as the direct basis for subsequent optimization strategies. They clearly define what problems need to be solved and why they need to be solved (based on the current working state).

[0081] Specifically, assuming the current network attack and defense platform is in a "network attack state" and is conducting a large-scale port scan; the predicted fault events output by S143 are: Predicted fault event 1: CPU temperature remains at 90°C, causing a significant decrease in scanning speed; Predicted fault event 2: Network interface module occasionally loses packets, but is not completely interrupted.

[0082] The current working status is collected as "Network Attack Status" (specifically "Large-scale Port Scan"). For predicted fault event 1 (CPU overheating): In the "Large-scale Port Scan" state, the CPU is the main source of load; overheating not only affects speed but also triggers overheat protection, causing task interruption; the impact is severe and urgent. For predicted fault event 2 (Network packet loss): Although there is no interruption, packet loss will directly affect the accuracy and efficiency of scanning, especially when there are many scanning targets or the network environment is complex; the impact is moderate and requires attention.

[0083] Generate fault optimization events: Fault optimization event A: "Need to reduce CPU load / improve heat dissipation to maintain the current attack scanning speed and prevent interruption" (based on event 1 and attack status); Fault optimization event B: "Need to investigate and reduce network packet loss to improve the accuracy and efficiency of attack scanning" (based on event 2 and attack status).

[0084] Furthermore, multiple fault optimization contents are determined based on the analysis of multiple fault optimization events. The fault optimization strategy of the network attack and defense platform is determined based on the multiple fault optimization contents and the current working status of the network attack and defense platform. This comprehensive consideration of multiple fault optimization contents and the current working status of the network attack and defense platform ensures the accuracy of the fault optimization strategy of the network attack and defense platform.

[0085] At this time, multiple fault optimization events come from S151, such as "requires reducing CPU load / improving heat dissipation to maintain the current attack scanning speed and prevent interruption"; the current working state of the network attack and defense platform is still the current mode of the platform, such as "network attack status - large-scale port scanning".

[0086] Each fault optimization event requires in-depth analysis to extract specific optimization measures or adjustment directions. This necessitates accessing knowledge bases, expert rules, or algorithm models. For "reducing CPU load / improving heat dissipation," optimizations include "reducing the number of concurrent scanning threads," "enabling CPU power-saving mode," "checking fan operation status," and "adjusting scan target priority to distribute the load." For "investigating and reducing network packet loss," optimizations include "checking network interface drivers," "restarting network services," "adjusting MTU size," and "switching to a backup network link (if available)."

[0087] The extracted optimization content is matched and filtered with the current working status. The goal is to select the most effective, safest, and most feasible optimization measures under the current status. For example, in the "large-scale port scanning" state, "reducing the number of concurrent scanning threads" is a directly effective optimization. While "checking the fan running status" is relevant, it requires manual intervention or shutdown and is not suitable for online optimization at the moment. Similarly, "switching to a backup network link" requires determining whether the backup link is available and the impact of switching on the current scanning task.

[0088] Based on the selected optimization content and the current working status, an overall "fault optimization strategy" is formulated. This strategy includes: priority: which optimization content needs to be executed first (e.g., solving CPU high temperature is more urgent than solving minor packet loss); combination scheme: multiple optimization content needs to be executed simultaneously to effectively solve the problem; constraints: rules that need to be followed when executing optimizations, such as not affecting core attack tasks, not causing more serious faults, etc.; execution method: whether to execute automatically or require manual confirmation; output the fault optimization strategy of the network attack and defense platform, which is an action plan to guide subsequent optimization operations.

[0089] Specifically, fault optimization event A: "Need to reduce CPU load / improve heat dissipation to maintain the current attack scanning speed and prevent interruption"; fault optimization event B: "Need to investigate and reduce network packet loss to improve the accuracy and efficiency of attack scanning"; current working status: "Network attack status - large-scale port scanning".

[0090] For event A: Parsed content 1: "Reduce the number of concurrent scanning threads"; content 2: "Adjust the priority of the scanning target"; content 3: "Check the fan status" (not suitable for online); For event B: Parsed content 4: "Check the network interface driver status"; content 5: "Restart the network service"; content 6: "Adjust the MTU size".

[0091] Contents 1 and 2 are feasible and relevant under the current "large-scale port scanning" state; Content 3 requires later processing or manual intervention; Contents 4, 5, and 6 require careful evaluation under the current attack state; Restarting the network service will briefly interrupt the scan, and it is necessary to determine whether the severity of packet loss is worth the risk; Checking the driver status is feasible; Adjusting the MTU has a small impact and is feasible.

[0092] Optimizations addressing CPU overheating (related to Event A) (Content 1, Content 2) are set to high priority due to the higher risk of CPU interruption; optimizations addressing packet loss (related to Event B) (Content 4, Content 6) are set to medium priority. High-priority strategies include "reducing the number of concurrent scanning threads" and "adjusting the priority of scanning targets"; medium-priority strategies include "checking the network interface driver status" and "adjusting the MTU size". During optimization, ensure that scanning tasks are not interrupted (unless it is a planned, brief interruption, such as a service restart). Execution method: High-priority tasks can attempt to execute automatically; medium-priority tasks first automatically check the driver status, and if the problem is severe, prompt for manual confirmation to restart the service. Final output (fault optimization strategy): Prioritize automatic execution of "reducing the number of concurrent scanning threads" and "adjusting the priority of scanning targets"; simultaneously automatically execute "checking the network interface driver status" and "adjusting the MTU size"; if the driver check finds a problem and packet loss is severe, prompt for manual confirmation to restart the network service.

[0093] Therefore, in this fault optimization strategy, multiple online optimization projects are determined based on the analysis of the fault optimization strategy. The current fault optimization content is determined according to the fault optimization content, fault optimization order of multiple online optimization projects and the current working procedure of the network attack and defense platform. This approach takes into account the overall consideration of the fault optimization content, fault optimization order of multiple online optimization projects and the current working procedure of the network attack and defense platform, ensuring the accuracy of the current fault optimization content. At the same time, various fault events are introduced, realizing the overall consideration of each fault event and the current working status of the network attack and defense platform, which improves the accuracy of the fault optimization content and facilitates dynamic fault optimization of the network attack and defense platform.

[0094] At this point, the fault optimization strategy, derived from S152, includes priorities, combination schemes, specific optimization content (such as "reducing the number of concurrent scanning threads" and "adjusting the MTU size"), execution order suggestions, and constraints; multiple online optimization projects, which are specific tasks extracted from the fault optimization strategy and suitable for online execution; for example, "reducing the number of concurrent scanning threads," "adjusting the MTU size," and "checking the network interface driver status" in the strategy can all become online optimization projects; and the current work procedure of the network attack and defense platform, which is a more granular operation step than "work status"; for example, the current procedure under "large-scale port scanning" is "scanning target 192.168.1.1-100".

[0095] A thorough analysis of fault optimization strategies is needed, breaking them down into smaller, independently executable operational units, known as "online optimization projects." These projects typically correspond to specific optimization content within the strategy. It's crucial to clearly define the specific operations, expected results, and required resources for each project. Considering the optimization order (priority) given in the strategy and the currently ongoing specific work steps, online optimization projects should be arranged according to the strategy's priority and recommended execution order. Evaluate whether the current work step is suitable for executing the next highest-priority online optimization project. For example, in the step "Scanning target 192.168.1.1-100," to execute "Reduce scan speed,"... The "concurrent thread count" requires waiting for the scan batch of the current target to complete, or directly adjusting the parameters of the ongoing scan; if "restart network service" is to be executed, it must wait for all current network-related operations (including scans) to complete or pause; based on the order of optimization projects and the results of process adaptation, select the online optimization project that should be executed at the current moment and determine it as the "current fault optimization content". This selection needs to be judged in real time to ensure that the optimization operation will not interfere with the ongoing critical process, or to choose the time with the least interference; output the current fault optimization content, which is the specific optimization operation that the system suggests or is preparing to execute at the current moment.

[0096] Specifically, the fault optimization strategy is as follows: Prioritize executing "reduce the number of concurrent scanning threads" (content 1) and "adjust the priority of scanning targets" (content 2); then execute "check network interface driver status" (content 4) and "adjust MTU size" (content 6); conditionally execute "restart network service" (content 5); online optimization projects: Project 1: "Execute content 1 - reduce the number of concurrent scanning threads to 500"; Project 2: "Execute content 2 - adjust target priority, prioritize scanning high-value targets"; Project 3: "Execute content 4 - check eth0 interface driver status"; Project 4: "Execute content 6 - adjust MTU to 1492"; Project 5: "Prepare to execute content 5 - restart network service (requires manual confirmation)"; current work process: "Scanning target 192.168.1.1-100" (assuming this is a large batch, it is expected to take another 5 minutes to complete).

[0097] The fault optimization strategy has been broken down into Projects 1-5; prioritized as follows: Project 1 > Project 2 > Project 3 > Project 4 > Project 5. Project 1 (reducing thread count): can be executed directly in the current process "Scanning target 192.168.1.1-100", requiring only modification of the scanning tool parameters; minimal interference. Project 2 (adjusting priority): can also be executed in the current process, but requires waiting for the current batch to finish or partially finish; relatively minor interference. Project 3 (checking driver status): this is a check operation that can be performed in the background without interfering with the current scanning process. Project 4 (adjusting MTU): can be executed in the current process with minimal impact on ongoing scans. Project 5 (restarting service): requires waiting for all current scan tasks to pause or complete, significant interference, and requires manual confirmation. Project 1 has the highest priority. The check revealed that Project 1 can be executed in the current process; therefore, the "current fault optimization content" is determined to be: "Execute content 1 - reduce the number of concurrent scanning threads to 500".

[0098] Please see Figure 7 , Figure 7 This is a schematic diagram of the structural composition of the fault optimization system of the network attack and defense platform based on fault detection in this embodiment of the invention; the fault optimization system of the network attack and defense platform based on fault detection includes: Use case module 21 is used to collect multiple surrounding environmental parameters of the network attack and defense platform, and determine the use case of the network attack and defense platform based on the model of the network attack and defense platform and multiple surrounding environmental parameters. The fault detection module 22 is used to identify multiple sub-test items based on the test sequence list of the network attack and defense platform, and to determine multiple fault detection modes of the network attack and defense platform according to the multiple sub-test items, the usage scenario of the network attack and defense platform and multiple working parameters. The internal fault feature module 23 is used to determine the multi-dimensional detection system of the network attack and defense platform based on multiple fault detection modes, the external form of the network attack and defense platform and the model of the network attack and defense platform, so as to collect the fault test data set of each fault detection dimension and determine multiple internal fault features based on the identification of the fault test data set of each fault detection dimension. The fault event module 24 is used to determine multiple external fault features based on the recognition of multiple images from the network attack and defense platform, and to determine the corresponding fault events based on the multiple external fault features, multiple internal fault features, and the working procedures of the network attack and defense platform. The fault optimization content module 25 is used to determine the fault optimization strategy of the network attack and defense platform based on each fault event and the current working status of the network attack and defense platform, and to determine the current fault optimization content based on the fault optimization strategy of the network attack and defense platform and the current working procedure of the network attack and defense platform.

[0099] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A fault optimization method for a network attack and defense platform based on fault detection, characterized in that, include: Collect multiple environmental parameters of the network attack and defense platform, and determine the application scenario of the network attack and defense platform based on the platform model and these parameters. Based on the identification of the test sequence list of the network attack and defense platform, multiple sub-test items are determined. Based on the multiple sub-test items, the usage scenario of the network attack and defense platform, and multiple working parameters, multiple fault detection modes of the network attack and defense platform are determined. Based on multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform, a multi-dimensional detection system for the network attack and defense platform is determined to collect fault test data sets of each fault detection dimension, and to determine multiple internal fault characteristics based on the identification of the fault test data sets of each fault detection dimension. Multiple external fault characteristics are identified based on the recognition of multiple images from the network attack and defense platform. The corresponding fault events are then determined based on the multiple external fault characteristics, multiple internal fault characteristics, and the working procedures of the network attack and defense platform. Based on each fault event and the current working status of the network attack and defense platform, determine the fault optimization strategy of the network attack and defense platform, and based on the fault optimization strategy of the network attack and defense platform and the current working procedure of the network attack and defense platform, determine the current fault optimization content.

2. The fault optimization method for a network attack and defense platform based on fault detection according to claim 1, characterized in that, The system collects multiple surrounding environmental parameters of the network attack and defense platform. Based on the model of the network attack and defense platform and these parameters, it determines the application scenario of the platform, including: The system collects the current location of the network attack and defense platform, determines the surrounding detection area of ​​the network attack and defense platform based on its current location and external shape, and determines multiple surrounding environmental parameters of the network attack and defense platform based on the environmental detection of the surrounding detection area. The network attack and defense platform combines multiple surrounding environment parameters to form various surrounding environment combinations, and marks the environment matching coefficient of each surrounding environment combination. The characteristics of each environment are determined based on the combination of various surrounding environments, the corresponding environment matching coefficients, and the model of the network attack and defense platform. The application scenarios of the network attack and defense platform are determined based on the characteristics of each environment and the scenario mapping relationship.

3. The fault optimization method for a network attack and defense platform based on fault detection according to claim 1, characterized in that, The identification of the test sequence list based on the network attack and defense platform determines multiple sub-test items. Based on these sub-test items, the usage scenario of the network attack and defense platform, and multiple operating parameters, multiple fault detection modes of the network attack and defense platform are determined, including: Collect data from the internal database of the network attack and defense platform, determine the test sequence list of the network attack and defense platform based on the internal database and time dimension, and determine multiple sub-test items based on the division of the test sequence list, with each sub-test item marked with the corresponding test content; The usage scenarios of the network attack and defense platform are collected, and the first fault detection coefficient is determined based on multiple sub-test projects and the usage scenarios of the network attack and defense platform. The second fault detection coefficient is determined based on multiple sub-test projects and multiple working parameters of the network attack and defense platform. The corresponding sub-detection modes are determined based on the mapping relationship between the first fault detection coefficient, the second fault detection coefficient, and the detection mode. At the same time, the corresponding correlation coefficient is determined based on the comparison between the first fault detection coefficient and the second fault detection coefficient. Multiple fault detection modes of the network attack and defense platform are determined based on the correlation coefficient and the sub-detection modes.

4. The fault optimization method for a network attack and defense platform based on fault detection according to claim 1, characterized in that, The multi-dimensional detection system of the network attack and defense platform is determined based on multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform. This system collects fault test data sets for each fault detection dimension and determines multiple internal fault characteristics based on the identification of these data sets. These characteristics include: Multiple fault detection modes are collected, and multiple fault detection combinations are determined based on the matching of multiple fault detection modes and network attack and defense platform models. The corresponding fault detection dimensions are determined based on the identification of multiple fault detection combinations, and the fault detection content corresponding to multiple fault detection combinations is marked.

5. The fault optimization method for a network attack and defense platform based on fault detection according to claim 4, characterized in that, The multi-dimensional detection system for the network attack and defense platform, determined based on multiple fault detection modes, the external form of the platform, and its model, collects fault test data sets for each fault detection dimension. Multiple internal fault characteristics are determined based on the identification of these data sets. This also includes: Based on the fault detection dimensions, corresponding fault detection content, and external form of the network attack and defense platform corresponding to multiple fault detection combinations, a multi-dimensional detection system of the network attack and defense platform is determined. Based on the multi-dimensional detection system of the network attack and defense platform, cross-detection of the network attack and defense platform in different fault detection dimensions is triggered to determine the fault test data set of each fault detection dimension. In each fault test data set, multiple fault parameters are determined based on the detection of the fault test data set, and multiple internal fault features are determined based on the cross-identification of multiple fault parameters. These multiple internal fault features are distributed in different internal components of the network attack and defense platform.

6. The fault optimization method for a network attack and defense platform based on fault detection according to claim 1, characterized in that, The process of identifying multiple external fault features based on the recognition of multiple images from the network attack and defense platform, and determining corresponding fault events based on these external fault features, multiple internal fault features, and the operational procedures of the network attack and defense platform, includes: Multiple images of the network attack and defense platform are collected based on the circumferential detection of the network attack and defense platform by UAVs. The actual three-dimensional model of the network attack and defense platform is determined based on the multiple images and the external shape of the network attack and defense platform. Multiple external fault characteristics are determined based on the external fault detection of the actual three-dimensional model of the network attack and defense platform.

7. The fault optimization method for a network attack and defense platform based on fault detection according to claim 6, characterized in that, The method of determining multiple external fault features based on the recognition of multiple images from the network attack and defense platform, and determining the corresponding fault events based on the multiple external fault features, multiple internal fault features, and the working procedures of the network attack and defense platform, further includes: Multiple sub-fault events are determined based on the combination of multiple external fault characteristics and multiple internal fault characteristics. The corresponding fault screening system is determined based on the matching of multiple sub-fault events and the working parameters of the network attack and defense platform. The fault screening system triggers multiple sub-fault events to identify multiple predicted fault events; the work procedures of the network attack and defense platform are collected, and the corresponding fault events are determined based on the work procedures of the network attack and defense platform and multiple predicted fault events.

8. The fault optimization method for a network attack and defense platform based on fault detection according to claim 1, characterized in that, The process involves determining a fault optimization strategy for the network attack and defense platform based on various fault events and the platform's current operational status, and then determining the current fault optimization content based on this strategy and the platform's current operational procedures. This includes: The current working status of the network attack and defense platform is collected, including network attack status, network defense status, network infiltration status, and integrated attack and defense status. Based on the current working status of the network attack and defense platform and various fault events, multiple fault optimization events are determined.

9. The fault optimization method for a network attack and defense platform based on fault detection according to claim 8, characterized in that, The process of determining the fault optimization strategy for the network attack and defense platform based on various fault events and the current working status of the platform, and determining the current fault optimization content based on the fault optimization strategy and the current working procedure of the platform, further includes: Multiple fault optimization contents are determined based on the analysis of multiple fault optimization events, and the fault optimization strategy of the network attack and defense platform is determined based on the multiple fault optimization contents and the current working status of the network attack and defense platform. In this fault optimization strategy, multiple online optimization projects are determined based on the analysis of the fault optimization strategy, and the current fault optimization content is determined according to the fault optimization content, fault optimization order and the current work process of the network attack and defense platform of the multiple online optimization projects.

10. A fault optimization system for a network attack and defense platform based on fault detection, characterized in that, The fault optimization system of the network attack and defense platform based on fault detection is applied to the fault optimization method of the network attack and defense platform based on fault detection as described in any one of claims 1-9, wherein the fault optimization system of the network attack and defense platform based on fault detection includes: The usage scenario module is used to collect multiple surrounding environmental parameters of the network attack and defense platform, and determine the usage scenario of the network attack and defense platform based on the model of the network attack and defense platform and multiple surrounding environmental parameters. The fault detection module is used to identify multiple sub-test items based on the test sequence list of the network attack and defense platform, and to determine multiple fault detection modes of the network attack and defense platform based on the multiple sub-test items, the usage scenario of the network attack and defense platform, and multiple working parameters. The internal fault feature module is used to determine the multi-dimensional detection system of the network attack and defense platform based on multiple fault detection modes, the external form of the network attack and defense platform, and the model of the network attack and defense platform. It collects fault test data sets of each fault detection dimension and determines multiple internal fault features based on the identification of the fault test data sets of each fault detection dimension. The fault event module is used to identify multiple external fault features based on the recognition of multiple images from the network attack and defense platform, and to determine the corresponding fault events based on the multiple external fault features, multiple internal fault features, and the working procedures of the network attack and defense platform. The fault optimization content module is used to determine the fault optimization strategy of the network attack and defense platform based on various fault events and the current working status of the network attack and defense platform, and to determine the current fault optimization content based on the fault optimization strategy and the current working procedure of the network attack and defense platform.

Images