A scene template-based BAS attack task rapid creation method and system

Abstract

The application relates to the technical field of network security, and discloses a BAS attack task rapid creation method and system based on a scene template, wherein the method comprises the following steps: constructing scene template data records, solidifying an attack case set and scene configuration information to a scene template library; scanning global parameter requirements of the scene template, guiding an operator to complete necessary parameter configuration; configuring a verification node and generating a task record; and deriving a new self-defined scene template based on an existing scene template. The application also proposes a corresponding system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for rapidly creating BAS attack tasks based on scenario templates. Background Technology

[0002] Intrusion and Attack Simulation (BAS) systems automatically verify the security defense system of a target environment by simulating real attack behaviors, and are an important tool in network security operations.

[0003] When creating an attack test task, the existing BAS system requires operators to filter test cases one by one from the attack test case library and fill in all configuration items such as global parameters, verification nodes, and execution cycles. There is a lack of automatic association and pre-filling between the configuration items.

[0004] The above approach has the following drawbacks: When it is necessary to repeatedly verify the same type of attack scenario, operators must repeatedly execute the full configuration process, which is time-consuming; inconsistencies in manual operation can easily introduce configuration omissions and errors, leading to deviations in task execution results; in addition, the existing system lacks the ability to solidify the configuration of verified attack scenarios into reusable templates, and the configuration experience accumulated by operators cannot be stored in the system in a structured form. Similar test scenarios still need to be configured from scratch, resulting in low efficiency in attack task creation and difficulty in ensuring configuration consistency. Summary of the Invention

[0005] This invention provides a method and system for rapidly creating BAS attack tasks based on scene templates, solving the technical problems of lacking standardized scene template management methods, cumbersome attack task creation processes, and large amounts of repetitive configuration work in related technologies.

[0006] This invention discloses a method for rapidly creating BAS attack tasks based on scene templates, comprising the following steps: Obtain the selected set of attack cases from the attack case library, organize the selected cases according to the scenario template data structure, generate a scenario template record containing a template unique identifier, template type, category label, security device type list and attack case identifier list, and persist the scenario template record to the scenario template library; Iterate through the parameter metadata of each use case in the attack use case identifier list in the scenario template record, identify parameters with global scope, required parameter flag set to true and empty default value, generate a global parameter requirement set, and store the configuration result in the session creation context; The scenario template identifier, global parameter configuration, and node configuration information are read from the session creation context. The attack case identifier list and security device type list are extracted from the scenario template library. A task record object is constructed and persisted to the task record library to generate an attack task record.

[0007] Furthermore, the template type includes a normal type and an orchestration type; when the template type is an orchestration type, the scenario template record also includes an orchestration process structure field, which includes a card list and a connection list; each element of the card list includes a card identifier, a card name, a list of attack use case identifiers under that card, and the card's coordinate position on the canvas; each element of the connection list includes a source card identifier, a target card identifier, and a trigger condition, wherein the trigger condition describes the state that the execution result of the preceding card meets to activate the execution of the target card.

[0008] Furthermore, when the template type is an orchestration type, the generation scope of the global parameter requirement set is the union of the attack use case identifier lists of all cards, and after deduplication and merging, a unified global parameter requirement set is generated; the task record object also includes a process snapshot field, a task type field, and a node configuration mapping table field. The process snapshot field stores a complete copy of the orchestration process structure field, and the node configuration mapping table field stores the node configuration information of each card with the card identifier as the key.

[0009] Furthermore, when the template type is an orchestration type, the verification node is configured at the card level; when the verification node of a card is not configured or there is a parameter in the card whose required field is true and whose current value is empty, the status flag of the card is displayed as pending; when the status flags of all cards are in the completed state, the submission operation switches from the disabled state to the executable state.

[0010] Furthermore, it also includes a scene template derivation step: obtaining an existing scene template record as the derivation basis, performing a uniqueness check on the new scene template name, constructing a new scene template record using the current configuration information as the data source after the uniqueness check passes, fixing the category label of the new scene template record to a custom type, assigning a newly generated template unique identifier to the new scene template record, and persisting the new scene template record to the scene template library; during the entire derivation operation, the original scene template record does not perform any write operations.

[0011] Furthermore, the category tags include built-in types and custom types; the scene template library intercepts update and deletion requests for built-in type scene templates at the backend interface layer and returns a rejection status code.

[0012] Furthermore, the scenario template library supports multi-condition queries based on template name, category tag, security device type, and attack tactic classification. Multiple filtering conditions are combined using logical AND relationships to filter the template list.

[0013] Furthermore, the system increments the version number field and updates the update time field during each save operation; when a reset operation is triggered, the system reads the last saved version of the scene template from the scene template library, and re-renders all configuration items on the page with this version data, discarding all unsaved modifications in the current editing session; before performing a deletion operation, the system queries the number of records in the task record library whose source template identifier is equal to the scene template identifier, and if there are reference records, it displays a secondary confirmation prompt to the operator.

[0014] This invention discloses a rapid creation system for BAS attack tasks based on scene templates, comprising: The scenario template management module is used to obtain a set of attack cases, generate scenario template records containing a unique template identifier, template type, category label, security device type list and attack case identifier list according to the scenario template data structure, and persist the scenario template records to the scenario template library. The global parameter scanning module is used to traverse the parameter metadata of each use case in the attack use case identifier list in the scenario template record, identify parameters whose scope is global, whose parameter required flag is true and whose default value is empty, generate a global parameter requirement set and store the configuration result in the creation session context; The task record generation module is used to read the scenario template identifier, global parameter configuration and node configuration information from the creation session context, extract the attack case identifier list and security device type list from the scenario template library, construct a task record object and persist it to the task record library; The template derivation module is used to perform a save-as operation based on the existing scene template record, perform a uniqueness check on the name of the new scene template, construct a new scene template record with a fixed category label of a custom type and persist it to the scene template library, and does not perform any write operation on the original scene template record during the entire derivation operation.

[0015] Furthermore, the task record object includes a unique task identifier, task name, task description, task type, source template identifier, attack case identifier list, security device type list, global parameters, attacker node identifier, victim node identifier, execution cycle, execution timeout duration, and task status fields. When the task type is an orchestration type, the task record object also includes a process snapshot field and a node configuration mapping table field, but does not include attacker node identifier and victim node identifier fields.

[0016] The beneficial effects of this invention are as follows: This invention pre-embeds attack test case sets and scenario configuration information into the scenario template record. When a task is created, the system automatically inherits this information. Operators only need to supplement two types of runtime configurations: verification node selection and basic task information. This solves the technical problem of low creation efficiency caused by repeatedly executing the full configuration process, and achieves the technical effect of reducing the number of configuration operations required for each attack task creation. The global parameter requirement scanning step automatically identifies parameters that need to be supplemented during the task creation process, solving the technical problem of operators missing necessary configurations due to a lack of understanding of the test case parameter structure, and achieving the technical effect of reducing task execution failures due to missing parameters. Real-time integrity verification of card status flags in orchestration type scenarios allows configuration deficiencies to be identified before submission, achieving the technical effect of preventing incompletely configured task records from entering the execution engine. The process snapshot field completely copies the orchestration process definition to the task record, solving the technical problem that subsequent modifications to the scenario template affect the execution behavior of already created tasks, and achieving the technical effect of isolating task execution semantics from scenario template update operations. The "Save As Derivative" operation ensures that modifications to the scene template content do not overwrite the original record, solving the technical problem of mutual interference when multiple operators configure the same basic scene. It achieves the technical effect of supporting tree-like reuse management of scene configurations and ensuring that each derived variant is independent of the others. Attached Figure Description

[0017] Figure 1 This is a flowchart of a method for rapidly creating BAS attack tasks based on scene templates, provided in an embodiment of the present invention. Detailed Implementation

[0018] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, some features described in the examples may be combined in other examples.

[0019] At least one embodiment of the present invention discloses a method for rapid creation of BAS attack tasks based on scene templates, see [link to relevant documentation]. Figure 1 This includes the following steps: Step 1: Construct scene template data records.

[0020] Obtain the set of attack cases selected by the operator from the attack case library, organize the selected cases according to the scenario template data structure, generate scenario template records and persist them to the scenario template library.

[0021] The scene template record contains the following core fields: Template Unique Identifier ( Template Name () Template type () ), category tags ( Scene description () Scene Logo Resource Path ( List of safety device types ( ), storage type ( ), list of attack use case identifiers ( Creation time () ), Update time ( ) and version number ( ).

[0022] It should be noted that, The values ​​are divided into two categories: Normal and Orchestration. Normal templates encapsulate several attack cases into a single batch; during task execution, each case attacks the target node concurrently, with no execution order dependency between the cases. Orchestration templates, in addition to the above fields, also include an orchestration flow structure field. (), used to describe the execution order and conditional branching relationships of attack test cases. Stored in JSON format, containing a list of cards ( ) and connection list ( The card list has two substructures. Each element of the card list includes a card identifier ( ), Card Name ( The list of attack use case identifiers under this card ( ) and the coordinates of the card on the canvas ( , Each element in the connection list includes the source card identifier (); ), target card identifier ( ) and triggering conditions ( The trigger condition describes the state (full success, partial success, or full failure) that the execution result of the preceding card must meet to activate the execution of the target card.

[0023] It should be noted that, Values ​​are categorized into two types: BUILTIN and CUSTOM. BUILTIN scenarios are pre-defined by the system, and modifications or deletions to persistent data within them are not permitted. CUSTOM scenarios are derived from or created from BUILTIN scenarios by users, and support modifications, saving, resetting, and deletion. The system intercepts UPDATE and DELETE requests for BUILTIN scenarios at the backend API layer and returns a 403 status code. This, along with the disabled status of the frontend buttons, provides dual protection to ensure the integrity of BUILTIN scenario data.

[0024] In this embodiment, the scene template library uses a relational database as its underlying storage and a RESTful API as its external interface. It supports multi-condition queries based on template name, category tag, security device type, and MITRE ATT&CK tactical classification. Multiple filtering conditions are combined using logical AND relationships to filter the template list. The query results are returned to the front end with keyword highlighting, enabling operators to quickly retrieve and locate scene templates.

[0025] Step 2: Scan the global parameter requirements of the scene template.

[0026] Retrieve scene template records List, traversal Each test case identifier in the list reads the corresponding test case's parameter metadata from the attack test case library. ), check if there exists a parameter that simultaneously satisfies all of the following conditions: parameter scope ( The flag is set to global (GLOBAL), and the parameter is required. The value is true, and this parameter has not yet been set to a default value in the scene template record. (Empty). If parameters that meet the above conditions exist, a global parameter requirement set is generated, and the user is redirected to the global attribute configuration page to complete the configuration; otherwise, the global parameter configuration stage is skipped, and the process proceeds directly to step 3.

[0027] It should be noted that for orchestration-type scenario templates, the global parameter requirement scans all cards. The union of all cards, traversing the parameter metadata of all use cases ( After deduplication and merging, a unified global parameter requirement set is generated, replacing the repeated configuration of each card with a one-time configuration.

[0028] In this embodiment, the global attribute configuration page presents a set of global parameter requirements in form. Each parameter input field includes a format validation rule based on regular expressions, and the system performs real-time format validation on the operator's input at the front end. Typical examples of global parameters include target domain, credentials, and proxy settings. After the operator completes and confirms the form, the global parameters are stored as key-value pairs in the current session context.

[0029] Step 3: Configure the verification node and generate task records.

[0030] The system retrieves a list of registered and available nodes in the BAS system. Operators then select the attacker and victim nodes for the current task. The system temporarily stores the node selection information in the session creation context. After operators complete the basic task information (including task name, task description, execution period, and execution timeout), the system reads the scene template identifier, global parameter configuration, and node configuration information from the session creation context. It also reads the complete scene template record from the scene template library and extracts... Lists and The list is used to construct task record objects and persist them to the task record library, generating the final attack task record.

[0031] The task record object contains the following fields: Task Unique Identifier ( The system automatically generated UUID), task name ( ), Task Description ( ), Task type ( (fixed as NORMAL), source template identifier ( ), list of attack use case identifiers ( (inherited from template), list of security device types ( (inherited from template), global parameters () Attacker node identifier () ), the identifier of the attacked node ( ), execution cycle ( ), execution timeout duration ( (Default value is 60 minutes), Task status ( (Initial value is PENDING) and .

[0032] It should be noted that, The constraints are: string type, length limited to 1 to 64 characters, and cannot be the same as the task name already existing under the same operator's account. It supports both single execution and periodic execution modes. When selecting the periodic execution mode, a Cron expression needs to be further configured to determine the execution frequency.

[0033] It should be noted that for orchestration-type scenario templates, verification node configuration is done at the card level. Operators independently select attacker and victim nodes for each card, and the node configuration for each card is based on... Configure a mapping table for the key storage node ( It supports multi-stage attack simulation across network regions. The orchestration task record object, based on the fields of a regular task record, uses... Field storage scenario template record A complete copy is used as a snapshot of the task's workflow. The ORCHESTRATION field value distinguishes the task type. The field stores the node configuration mapping for each card, but does not contain regular task records. and Field.

[0034] In this embodiment, for real-time status feedback during the orchestration scenario configuration process, the system uses the status badge in the upper left corner of the card to reflect the configuration completion status of each card in real time. When the verification node of a card has not yet been configured, or if the card contains... When a required parameter is true and currently empty, the status flag is displayed as "Pending Completion." When all required configuration fields for a card are filled in, the status flag switches to "Completion." Status flag updates are driven by front-end reactive data binding. Whenever an operator completes a configuration operation, the system immediately performs an integrity check on all required fields for that card and updates the status flag. When all cards in the orchestration canvas have a "Completion" status flag, the "Run" button switches from disabled to clickable to prevent incomplete orchestration tasks from being submitted to the execution engine.

[0035] Step 4: Derive new custom scene templates based on existing scene templates.

[0036] The system retrieves existing scenario template records (either built-in or custom scenarios) as the basis for creation. Operators can edit and modify configuration items such as scenario name, scenario description, security device type, storage type, and use case list on the scenario configuration page. After modification, a "Save As" operation is triggered. The system performs a uniqueness check on the new scenario name: querying all available scenario templates in the scenario template library. If a record with the same name already exists, an error message will be returned and submission will be blocked. After the uniqueness check passes, a new scene template record will be constructed using the full configuration information of the current page as the data source, and a newly generated [database name] will be assigned to the new scene template record. ,Will The field is fixed at CUSTOM, while the other configuration fields are taken from the current page's configuration values. The new scene template record is persisted to the scene template library, generating an independent custom scene template record. Throughout the entire derivation process, the system does not perform any write operations on the original scene template record, and the content and version status of the original scene template remain unchanged.

[0037] In this embodiment of the application, the system will perform a save operation each time. Increment the field by 1 and update Fields. When an operator triggers a reset operation, the system re-reads the last saved version of the scene template from the database and re-renders all configuration items on the page with this version of data. All unsaved modifications made by the operator during this editing session are discarded. Before executing a delete operation, the system checks whether the scene template is referenced by any task records (by querying the task record database). (equal to the number of records identified by the scene template). If there are referenced records, a secondary confirmation prompt will be displayed to the operator, who will then decide whether to continue the deletion operation.

[0038] On the other hand, this invention also proposes a rapid creation system for BAS attack tasks based on scene templates, including: The scenario template management module is used to obtain a set of attack cases and generate a set of attack cases according to the scenario template data structure. , , , , and The system records scene templates with fields such as [field name], persists these scene template records to the scene template library, and provides multi-condition combined query, dual-mode view display, and category tag filtering functions. The global parameter scanning module is used to traverse the scene template records. Parameter metadata for each use case in the list ( ), identification For GLOBAL and is true and For empty parameters, generate a global parameter requirement set and guide the operator to complete the configuration, and store the configuration result in the session creation context; The task record generation module is used to read the scene template identifier, global parameter configuration, and node configuration information from the session creation context, and extract them from the scene template library. Lists and The list is used to construct task record objects and persist them to the task record library, generating attack task records; The template derivation module is used to perform a "Save As" operation based on an existing scene template record, perform uniqueness checks on the new scene name, and construct... A new scene template record is fixed as a CUSTOM and persisted to the scene template library, ensuring that the original scene template record is not written during the entire derivation process.

[0039] By way of example, the system proposed in this invention may also include various features and combinations thereof in the method embodiments, which will not be elaborated here.

[0040] This invention pre-defines scenario configuration information, such as attack test case combinations and security device type constraints, into a scenario template record. During the task creation process, the system automatically inherits this information from the scenario template. Operators only need to supplement two types of runtime configurations: verification node selection and basic task information, thereby reducing the number of configuration operations required for each attack task creation. Step 2's global parameter requirement scan automatically identifies parameters that need supplementary configuration when the task creation process starts, preventing operators from overlooking necessary configurations due to a lack of understanding of the parameter structure of each test case, thus reducing the likelihood of task execution failure due to missing parameters. In Step 3, for orchestration-type scenarios, real-time integrity verification of card status flags ensures that missing configuration items can be identified before submission, preventing incomplete task records from entering the execution engine. Completely copied as The task record is stored to ensure that the execution semantics of the attack chain (card order, connection logic, and conditional branch definitions) remain unchanged during the conversion from the scene template to the task record, and is isolated from subsequent modifications to the scene template, preventing updates to the scene template from affecting the execution behavior of already created tasks. Step 4, "Save As Derivative," ensures that modifications to the scene template content by operators do not overwrite the original scene template record. The configuration of the original built-in or custom scene remains complete after the derivation operation, supporting multiple operators to derive differentiated scene variants from the same basic scene template. Each variant is independent of the others, achieving tree-like reuse management of scene configurations.

[0041] The embodiments of the present invention have been described above. However, the embodiments are not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make more equivalent embodiments under the guidance of the present embodiments, and all of them are within the protection scope of the present embodiments.

Claims

1. A method for quickly creating a BAS attack task based on a scene template, characterized in that, Includes the following steps: Obtain the selected set of attack cases from the attack case library, organize the selected cases according to the scenario template data structure, generate a scenario template record containing a template unique identifier, template type, category label, security device type list and attack case identifier list, and persist the scenario template record to the scenario template library; Iterate through the parameter metadata of each use case in the attack use case identifier list in the scenario template record, identify parameters with global scope, required parameter flag set to true and empty default value, generate a global parameter requirement set, and store the configuration result in the session creation context; The scenario template identifier, global parameter configuration, and node configuration information are read from the session creation context. The attack case identifier list and security device type list are extracted from the scenario template library. A task record object is constructed and persisted to the task record library to generate an attack task record.

2. The method for rapid creation of BAS attack tasks based on scene templates according to claim 1, wherein, The template types include standard types and layout types; When the template type is an orchestration type, the scenario template record also includes an orchestration process structure field, which includes a card list and a connection list. Each element of the card list includes a card identifier, a card name, a list of attack use case identifiers under that card, and the card's coordinate position on the canvas. Each element of the connection list includes a source card identifier, a target card identifier, and a trigger condition. The trigger condition describes the state that the execution result of the preceding card must satisfy to activate the execution of the target card.

3. The method for rapid creation of BAS attack tasks based on scene templates according to claim 2, wherein, When the template type is an orchestration type, the global parameter requirement set is generated by the union of the attack case identifier lists of all cards, and after deduplication and merging, a unified global parameter requirement set is generated. The task record object also includes a process snapshot field, a task type field, and a node configuration mapping table field. The process snapshot field stores a complete copy of the orchestration process structure field, and the node configuration mapping table field stores the node configuration information of each card with the card identifier as the key.

4. The method for rapid creation of BAS attack tasks based on scene templates according to claim 2 or 3, wherein, When the template type is an orchestration type, the verification node configuration is performed at the card level. When the verification node of a card is not configured or there is a parameter in the card whose required field is true and whose current value is empty, the status flag of the card is displayed as pending completion. When the status flags of all cards are in the completed state, the submission operation switches from the disabled state to the executable state.

5. The method for rapid creation of BAS attack tasks based on scene templates according to claim 1, wherein, It also includes a scene template derivation step: obtaining an existing scene template record as the basis for derivation, performing a uniqueness check on the name of the new scene template, constructing a new scene template record using the current configuration information as the data source after the uniqueness check passes, fixing the category label of the new scene template record to a custom type, assigning a newly generated template unique identifier to the new scene template record, and persisting the new scene template record to the scene template library; during the entire derivation operation, the original scene template record does not perform any write operations.

6. The method for rapid creation of BAS attack tasks based on scene templates according to claim 1, wherein, The category tags include built-in types and custom types; the scene template library intercepts update and deletion requests for built-in type scene templates at the backend interface layer and returns a rejection status code.

7. The method for rapid creation of BAS attack tasks based on scene templates according to claim 1, wherein, The scenario template library supports multi-condition queries based on template name, category tag, security device type, and attack tactic classification. Multiple filtering conditions can be combined with logical AND relationships to filter the template list.

8. The method for rapid creation of BAS attack tasks based on scene templates according to claim 5, wherein, The system increments the version number field and updates the update time field during each save operation; when a reset operation is triggered, the system reads the last saved version of the scene template from the scene template library, and re-renders all configuration items on the page with this version data, and all unsaved modifications in the current editing session are discarded. Before performing the deletion operation, the system queries the number of records in the task record library whose source template identifier is equal to the scene template identifier. If a reference record exists, a secondary confirmation prompt is displayed to the operator.

9. A system for rapidly creating BAS attack tasks based on scene templates, characterized in that, include: The scenario template management module is used to obtain a set of attack cases, generate scenario template records containing a unique template identifier, template type, category label, security device type list and attack case identifier list according to the scenario template data structure, and persist the scenario template records to the scenario template library. The global parameter scanning module is used to traverse the parameter metadata of each use case in the attack use case identifier list in the scenario template record, identify parameters whose scope is global, whose parameter required flag is true and whose default value is empty, generate a global parameter requirement set and store the configuration result in the creation session context; The task record generation module is used to read the scenario template identifier, global parameter configuration and node configuration information from the creation session context, extract the attack case identifier list and security device type list from the scenario template library, construct a task record object and persist it to the task record library; The template derivation module is used to perform a save-as operation based on the existing scene template record, perform a uniqueness check on the name of the new scene template, construct a new scene template record with a fixed category label of a custom type and persist it to the scene template library, and does not perform any write operation on the original scene template record during the entire derivation operation.

10. The BAS attack task rapid creation system based on scene templates according to claim 9, wherein, The task record object includes a unique task identifier, task name, task description, task type, source template identifier, attack case identifier list, security device type list, global parameters, attacker node identifier, victim node identifier, execution cycle, execution timeout duration, and task status fields. When the task type is an orchestration type, the task record object also includes a process snapshot field and a node configuration mapping table field, but does not include attacker node identifier and victim node identifier fields.

Images