Defense method and system for satellite network system

Abstract

Provided in the present application are a defense method and system for a satellite network system. The defense method for a satellite network system comprises: using a random function and a timestamp to randomly generate multiple different SQL simulation attack instructions; using the multiple different SQL simulation attack instructions to simulate an attack on a satellite network system, so as to obtain an attack evaluation factor of the satellite network system corresponding to each SQL simulation attack instruction; on the basis of an attack severity scoring function, performing weight score assignment on the attack evaluation factor corresponding to each SQL simulation attack instruction, so as to obtain an attack severity score of each SQL simulation attack instruction; and performing priority ranking on the SQL simulation attack instructions on the basis of the attack severity scores, and verifying the SQL simulation attack instructions according to a priority ranking sequence. The technical solution in the present application can solve the problem in the prior art of it being difficult to meet security and reliability requirements of a satellite network system.

Description

A defense method and system for satellite network system Technical Field

[0001] The present application relates to the field of satellite network technology, and in particular to a defense method and system for a satellite network system. Background Art

[0002] Satellite communications, due to their wide coverage, rapid deployment, and unrestricted geographical location, have become the primary information transmission platform for long-distance communications. With the development of information technology, modern society's reliance on satellite communications has increased, leading to the expansion of satellite network systems.

[0003] As satellite networks expand, attacks and defenses inevitably arise. Satellite communications are inherently vulnerable. A failure in these systems can paralyze the entire network, leading to an increasingly urgent need for satellite network defense systems. These systems are technological systems designed to protect the security of satellite networks. Existing satellite network security primarily relies on traditional security technologies such as cryptography and firewalls. For example, gateway information is encrypted to prevent unauthorized users from understanding it, and identity authentication is used to verify the legitimacy of terminals.

[0004] However, with the continuous development and expansion of satellite network systems, traditional security technologies are no longer able to meet the security and reliability requirements. Intruders can potentially compromise satellite network systems by tampering with SQL statements. Specifically, consider a user login interface where users must enter their username and password. The SQL statement used in this login interface is as follows: SELECT * FROM users WHERE username = '$username' AND password = '$password'; where username and password are the user's username and password. An attacker can inject malicious code into the username or password to bypass authentication. For example, suppose an attacker knows the correct username is "admin" and the password is "123456." An attacker could inject the following code snippet into the username: 'or '1' = '1'. This code snippet would transform the SQL statement into: SELECT * FROM users WHERE username = "or '1' = '1' AND password = '123456'. Because '1' = '1' is always True, this SQL statement would return information for all users, allowing the attacker to successfully log in.

[0005] Therefore, a more advanced satellite network system defense system is needed to regularly scan for security vulnerabilities and conduct security drills to defend against SQL statement attacks in order to ensure the security of the satellite network.

[0006] Application Contents

[0007] The present application provides a defense method and system for a satellite network system, which can solve the problem that existing technologies are difficult to meet the security and reliability requirements of satellite network systems.

[0008] To solve the above problems, according to the first aspect of the present application, the present application proposes a defense method for a satellite network system, comprising:

[0009] Use random functions and timestamps to randomly generate a variety of different SQL simulation attack instructions;

[0010] Use a variety of different SQL simulation attack instructions to simulate attacks on the satellite network system, and obtain the attack evaluation factors of the satellite network system corresponding to each SQL simulation attack instruction;

[0011] The attack assessment factors corresponding to each SQL simulation attack instruction are weighted and scored according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction;

[0012] SQL simulation attack instructions are prioritized according to the attack severity scores and verified in the order of priority ranking.

[0013] Preferably, in the above-mentioned defense method for the satellite network system, the step of using a random function and a timestamp to randomly generate a plurality of different SQL simulation attack instructions includes:

[0014] Select the SQL keywords used in the SQL simulation attack instructions from the SQL language;

[0015] Use the timestamp as a seed for the random number generator;

[0016] Use the seed of the random number generator to generate random table names, random column names, and random values ​​respectively;

[0017] Use a random number generator to construct a SQL instruction generation function;

[0018] Use the SQL command generation function to combine SQL keywords, random table names, random column names, and random values ​​to randomly generate a variety of different SQL simulation attack commands.

[0019] Preferably, in the above-mentioned defense method for the satellite network system, the step of using a random function and a timestamp to randomly generate a plurality of different SQL simulation attack instructions includes:

[0020] Select the SQL keywords used in the SQL simulation attack instructions from the SQL language;

[0021] Use a random number generator to generate random table names and random column names;

[0022] Generate random values ​​using the random function;

[0023] Use a random number generator to construct a SQL instruction generation function;

[0024] Use the SQL command generation function to combine SQL keywords, random table names, random column names, and random values ​​to randomly generate a variety of different SQL simulation attack commands.

[0025] Preferably, in the above-mentioned defense method for the satellite network system, the steps of using a plurality of different SQL simulated attack instructions to simulate attacks on the satellite network system and obtaining attack assessment factors of the satellite network system corresponding to each SQL simulated attack instruction include:

[0026] Use a variety of SQL simulation attack commands to simulate attacks on the satellite network system, and calculate the degree of data leakage, data damage and system availability of the satellite network system;

[0027] Use a variety of SQL simulation attack instructions to simulate attacks on satellite network systems, and count the access rights and security control measures of satellite network systems; and

[0028] Use a variety of SQL simulation attack commands to simulate attacks on satellite network systems, and calculate the technical requirements, time and resources required for each SQL simulation attack command;

[0029] Use the satellite network system's data leakage level, data damage level, and system availability level to determine the impact of each SQL simulated attack command on the satellite network system.

[0030] Using the satellite network system's access rights and security controls, determine the success probability of each SQL attack simulation instruction; and,

[0031] Use the technical requirements corresponding to the SQL simulation attack instructions and the time and resources invested to determine the attack complexity of each SQL simulation attack instruction.

[0032] Preferably, in the above-mentioned defense method for the satellite network system, the step of assigning weights to the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction includes:

[0033] According to the impact range of the satellite network system, the attack success probability and attack complexity of each SQL simulation attack instruction, the weight coefficients of the impact range, attack success probability and attack complexity are established respectively;

[0034] According to the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), the attack severity score of each SQL function simulation attack instruction is obtained by combining the weight coefficients of the impact range, the weight coefficients of the attack success probability, and the weight coefficients of the attack complexity. Among them, Impact, Probability, and Complexity are the impact range of the satellite network system, the attack success probability, and the attack complexity of each SQL simulation attack instruction, respectively. W1, W2, and W3 are the weight coefficients of the impact range, the weight coefficients of the attack success probability, and the weight coefficients of the attack complexity, respectively.

[0035] Preferably, in the above-mentioned defense method for the satellite network system, the step of establishing weight coefficients for the influence range, attack success probability, and attack complexity, respectively, based on the influence range of the satellite network system, the attack success probability, and attack complexity of each SQL simulation attack instruction, includes:

[0036] Calculate the weight coefficient of the impact range according to the first weight coefficient calculation formula: w1 = n * w2; where w1 is the weight coefficient of the impact range, w2 is the weight coefficient of the attack success probability, and n is the range probability impact factor;

[0037] Calculate the weight coefficient of the attack success probability using the second weight coefficient calculation formula: w2 = a*exp(-b*w3); where w3 is the weight coefficient of the attack complexity, a is the curve scaling factor, and b is the curve slope influencing factor;

[0038] as well as,

[0039] The weight coefficient of the attack complexity is calculated according to the third weight coefficient calculation formula: w1=c*exp(d*w3); wherein c is the exponential scaling factor and d is the exponential slope influencing factor.

[0040] Preferably, in the above-mentioned defense method for the satellite network system, the step of using the attack severity score to prioritize the SQL simulation attack instructions, and verifying the SQL simulation attack instructions in the order of priority ranking includes:

[0041] Verify SQL simulation attack instructions according to priority ranking, count and repair defense vulnerabilities and security risks of the satellite network system;

[0042] Store the SQL simulation attack instructions in the instruction database;

[0043] Use the whitelist function to authorize access devices in the satellite network system;

[0044] When the authorized access device passes the verification, the SQL data request of the access device is received;

[0045] Filter and detect SQL data requests sent by access devices, and calculate the similarity between SQL data requests and SQL simulation attack instructions in the instruction database;

[0046] When the similarity is greater than or equal to a predetermined similarity threshold, the security device and the SQL data request are shielded.

[0047] According to a second aspect of the present invention, the present invention further provides a defense system for a satellite network system, comprising:

[0048] The instruction generation module is used to randomly generate a variety of different SQL simulation attack instructions using random functions and timestamps;

[0049] An attack simulation module is used to simulate attacks on satellite network systems using a variety of different SQL simulation attack instructions, and obtain attack assessment factors of the satellite network system corresponding to each SQL simulation attack instruction;

[0050] A weighted scoring module is used to assign weights to the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction;

[0051] The ranking verification module is used to prioritize the SQL simulation attack instructions according to the attack severity scores and verify the SQL simulation attack instructions in the order of priority ranking.

[0052] Preferably, in the defense system of the satellite network system, the attack simulation module includes:

[0053] The first factor statistics submodule is used to simulate attacks on the satellite network system using a variety of different SQL simulation attack instructions, and respectively calculate the data leakage degree, data damage degree and system availability degree of the satellite network system;

[0054] The second factor statistics submodule is used to simulate attacks on the satellite network system using a variety of different SQL simulation attack instructions, and to count the access rights and security control measures of the satellite network system respectively; and

[0055] The third factor, the statistical submodule, is used to simulate attacks on satellite network systems using a variety of SQL simulation attack instructions, and to count the technical requirements, time, and resources invested in each SQL simulation attack instruction.

[0056] The impact scope determination submodule is used to determine the impact scope of the satellite network system caused by each SQL simulated attack instruction using the satellite network system's data leakage degree, data damage degree, and system availability degree;

[0057] A success probability determination submodule is used to determine the attack success probability of each SQL simulation attack instruction using the access rights and security control measures of the satellite network system; and

[0058] The attack complexity determination submodule is used to determine the attack complexity of each SQL simulation attack instruction using the technical requirements corresponding to the SQL simulation attack instruction and the time and resources invested.

[0059] Preferably, in the defense system of the satellite network system, the weight assignment module includes:

[0060] The weight coefficient establishment submodule is used to establish the weight coefficients of the influence range, attack success probability and attack complexity according to the influence range of the satellite network system, the attack success probability and attack complexity of each SQL simulation attack instruction;

[0061] The attack severity assignment submodule is used to obtain the attack severity score of each SQL function simulation attack instruction based on the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), combined with the weight coefficients of the impact range, the weight coefficients of the attack success probability, and the weight coefficients of the attack complexity. Among them, Impact, Probability, and Complexity are the impact range of the satellite network system, the attack success probability, and the attack complexity of each SQL simulation attack instruction, respectively. W1, W2, and W3 are the weight coefficients of the impact range, the weight coefficients of the attack success probability, and the weight coefficients of the attack complexity, respectively.

[0062] In summary, the satellite network system defense method and system provided by the present application can randomly generate a variety of different types of SQL simulation attack instructions by using random functions and timestamps. By using these different types of simulation attack instructions to simulate attacks on the satellite network system, vulnerability scanning and security drills can be regularly performed on the satellite network system through SQL simulation attack technology, thereby ensuring that countermeasures can be taken in real intrusion or attack scenarios. Specifically, a variety of different SQL simulation attack instructions are used to simulate attacks on the satellite network system, and the attack assessment factors of the satellite network system corresponding to each SQL simulation attack instruction are obtained. Then, the attack assessment factors corresponding to each SQL simulation attack instruction are weighted according to the attack severity scoring function to obtain an attack severity score for each SQL simulation attack instruction. The attack severity score is used to prioritize the SQL simulation attack instructions, and the SQL simulation attack instructions with the highest attack success rate can be found. The SQL simulation attack instructions are verified according to the priority ranking, thereby improving the vulnerability detection rate and defense capabilities of the satellite network system. The above method can solve the problem that the existing technology is difficult to meet the security and reliability requirements of the satellite network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying any creative work.

[0064] FIG1 is a schematic flow chart of a defense method for a satellite network system provided in an embodiment of the present application;

[0065] FIG2 is a flow chart of a first method for randomly generating SQL simulated attack instructions in the defense method for the satellite network system provided by the embodiment shown in FIG1 ;

[0066] 3 is a flow chart of a second method for randomly generating SQL simulated attack instructions in the defense method for the satellite network system provided by the embodiment shown in FIG1 ;

[0067] FIG4 is a schematic flow chart of a method for simulating an attack on a satellite network system according to the embodiment shown in FIG1 ;

[0068] FIG5 is a flow chart of a method for assigning weights to attack assessment factors according to the embodiment shown in FIG1 ;

[0069] FIG6 is a flow chart of a method for establishing weight coefficients of attack assessment factors according to the embodiment shown in FIG5 ;

[0070] 7 is a schematic flow chart of a method for ranking priorities of SQL simulation attack instructions according to the embodiment shown in FIG1 ;

[0071] FIG8 is a schematic structural diagram of a defense system for a satellite network system according to an embodiment of the present invention;

[0072] FIG9 is a schematic structural diagram of an instruction generation module provided by the embodiment shown in FIG8 ;

[0073] FIG10 is a schematic structural diagram of an attack simulation module provided by the embodiment shown in FIG8 ;

[0074] FIG11 is a schematic structural diagram of a weight assignment module provided by the embodiment shown in FIG8 ;

[0075] FIG12 is a schematic structural diagram of a ranking verification module provided by the embodiment shown in FIG8 .

[0076] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings.

[0077] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0078] The technical solutions of the prior art have the following technical problems:

[0079] The security of existing satellite network systems primarily relies on traditional security technologies such as cryptography and firewalls. However, with the continuous development and expansion of satellite network systems, traditional security technologies are no longer able to meet the security and reliability requirements. Intruders can potentially infiltrate satellite network systems by tampering with SQL statements, making it difficult for existing technologies to meet the security and reliability requirements of satellite network systems.

[0080] The following embodiments of the present invention utilize the following two points to promptly detect abnormal situations and take measures to ensure the stability and security of the satellite network:

[0081] First, the whitelist function. This application uses the whitelist function to authorize devices and users in the satellite network. Only authorized devices and users can access the satellite network, which effectively prevents unauthorized devices and users from invading the satellite network. At the same time, this application can also set up an underlying filtering system to filter and detect data packets in the satellite network image to prevent malicious attacks and virus intrusions.

[0082] The second point is the filtering function. This application also monitors and analyzes the communication traffic in the satellite network, detects abnormal situations in a timely manner and takes measures, such as real-time interception of abnormal traffic to prevent network congestion and attacks.

[0083] In summary, the present invention can effectively ensure the security of satellite networks and provide reliable protection for satellite communications through the combination of multiple security functions.

[0084] Among them, the focus is on the research and development of the second point. Only by optimizing the underlying filtering function can the reliability of satellite communications be truly ensured. Therefore, the following embodiments of this application optimize the underlying filtering function to ensure satellite network security through the following scheme.

[0085] The specific plan is as follows:

[0086] 1. Strengthen the underlying filtering function: The underlying filtering function requires filtering and detecting data packets in the satellite network. Therefore, customized filtering rules are required for different types of attacks and viruses to improve the accuracy and efficiency of filtering.

[0087] 2. Strengthen monitoring and analysis capabilities: The monitoring and analysis capabilities of the satellite network system are crucial for timely detection of abnormal situations. Therefore, it is necessary to strengthen monitoring and analysis capabilities, such as using technologies such as traffic statistics and behavioral analysis to promptly detect and handle abnormal situations.

[0088] 3. Adopt a multi-layer defense strategy: For different types of attacks and threats, a multi-layer defense strategy needs to be adopted, such as network isolation, encryption and identity authentication to improve the security of satellite networks.

[0089] 4. Regular vulnerability scanning and security drills: In order to promptly discover and fix vulnerabilities and security issues in the satellite network, regular vulnerability scanning and security drills are required to continuously improve the security and reliability of the satellite network.

[0090] The fourth point above, regular vulnerability scanning and security drills, is the most important. Therefore, the following embodiment of this application provides a solution: SQL simulated attack technology is introduced to conduct regular vulnerability scanning and security drills to ensure that timely and accurate countermeasures can be taken in the event of a real intrusion or attack scenario. This allows for early detection of defense system vulnerabilities.

[0091] Specifically, the following embodiment of the present invention provides a defense method for a satellite network system. By using random functions and timestamps, a variety of different types of SQL simulation attack instructions are randomly generated. The SQL simulation attack instructions are used to simulate attacks on the satellite network system, thereby obtaining an attack evaluation factor for each SQL simulation attack instruction and an attack severity score for each SQL simulation attack instruction. The SQL simulation attack instructions are prioritized using the simulated attack severity score, thereby verifying the SQL simulation attack instructions and detecting vulnerabilities and security risks of the satellite network system, so as to ensure that the satellite network system can take countermeasures when encountering real intrusion or attack scenarios, so as to discover defense system vulnerabilities in advance and meet the security and reliability requirements of the satellite network system.

[0092] To achieve the above objectives, see Figure 1, which is a flow chart of a satellite network system defense method provided by an embodiment of the present application. As shown in Figure 1, the satellite network system defense method (or the satellite network system defense method based on SQL attack simulation) includes:

[0093] S110: Use random functions and timestamps to randomly generate multiple different SQL simulation attack instructions.

[0094] SQL stands for Structured Query Language. It is a database query and programming language used to access data, query, update, and manage relational database systems. It is also the extension for database script files. Because satellite network system data is stored in a database, SQL injection attacks can easily extract this data.

[0095] Specifically, in the field of satellite-to-ground communications, SQL injection attacks may lead to very serious consequences, such as damaging satellite communication systems and leaking confidential information. The following is an example of a possible SQL injection attack:

[0096] Suppose there is a satellite-to-ground communication system that uses a database to store information about satellites and ground stations, for example:

[0097] Satellite information table: satellite (id, name, orbit, status)

[0098] Ground station information table: ground_station (id, name, location, status)

[0099] Communication record table: communication(id,satellite_id,ground_station_id,timestamp,status)

[0100] The communication record table contains four fields: satellite_id, ground_station_id, timestamp, and status. When a satellite and a ground station communicate, a communication record is inserted into the communication record table. To prevent SQL injection attacks, the system uses precompiled statements, for example:

[0101] INSERT INTO communication. (satellite_id,ground_station_id,timestamp)VALUES(?,?,?);

[0102] The question mark in the SQL statement indicates the parameter to be inserted, which can prevent SQL injection attacks. However, attackers can bypass this limitation through various means, such as:

[0103] Case 1:

[0104] Attackers can inject multiple SQL queries into the satellite_id or ground_station_id fields to obtain more data. For example: satellite_id=1; DROPTABLE ground_station; SELECT * FROM satellite WHERE id=1;

[0105] This injection statement contains three SQL queries. The first SQL query will modify the value of satellite_id to 1, the second SQL query will delete all data in the ground station information table, and the third SQL query will query the record with id 1 in the satellite information table. The attacker can use these methods to obtain more data or even destroy data in the database.

[0106] Case 2:

[0107] Attackers can inject through union query: Attackers can inject union query statements in the satellite_id or ground_station_id fields to obtain data from other tables. For example: ground_station_id=1; SELECT*FROM satellite UNION SELECT*FROM ground_station WHERE id=1;

[0108] This injection statement contains two SQL queries. The first, SELECT * FROM satellite, will query all records in the satellite information table. The second, SELECT * FROM ground_station WHERE id = 1, will query the ground station information table for the record with id 1. This allows attackers to obtain data from other tables or even destroy data in the database.

[0109] These are relatively complex SQL injection attacks, requiring attackers to possess knowledge of databases and the SQL language. Therefore, when developing satellite network defense systems, more stringent defense measures should be implemented, such as input filtering, error message suppression, the use of secure programming languages, and restricted database user permissions, to reduce the risk of SQL injection attacks. Regular system security audits and vulnerability scans should also be conducted to promptly identify and address potential security vulnerabilities.

[0110] Because SQL attacks are difficult to detect, in order to carry out targeted defense against the above SQL attacks, it is necessary to simulate the above SQL attack instructions.

[0111] The generation scheme of the SQL simulation attack instruction in the embodiment of this application is as follows:

[0112] The formula for randomly generating SQL simulated attack instructions can be adjusted according to actual needs. The following are some commonly used formulas:

[0113] Randomly generate numbers: python importrandom #Generate random numbers num=rand.randint(1,100)

[0114] Randomly generate letters: python importrandom #Generate random letters letter=chr(random.randint(65,90)) #Uppercase letters letter=chr(random.randint(97,122)) #Lowercase letters

[0115] Randomly generate a string: python importrandom import string #Generate a random string letters = string.ascii_letters + string.digits #Letters and numbers string = ".join(random.sample(letters,8)) #Generate a random string of length 8

[0116] Randomly generate SQL simulation attack instructions: python importrandom import string #Generate random SQL simulation attack instructions keywords=['SELECT','FROM','WHERE','AND','OR']#Keywords letters=string.ascii_letters+string.digits #Letters and numbers table=”.join(random.sample(letters,8)) #Random table name column=”.join(random.sample(letters,8)) #Random column name value=”.join(random.sample(letters,8)) #Random value sql=f"{random.choice(keywords)}{column}{random.choice(keywords)} {table}{random.choice(keywords)}{column}='{value}'"

[0117] The above formula is for reference only and should be adjusted and optimized based on specific circumstances in actual use. It's important to note that when generating random SQL simulation attack commands, the legality and security of the commands must be guaranteed to avoid damage to the satellite network. Therefore, when using a random number generator to generate random SQL simulation attack commands, security principles must be adhered to to ensure the legality and security of the commands. Furthermore, after generating random SQL simulation attack commands, detailed vulnerability screening and security assessments are required to identify and address vulnerabilities and security risks within the satellite network.

[0118] The embodiment of the present application can use the timestamp as the seed of the random number generator to generate random SQL simulation attack instructions. This can ensure that each generated instruction is unique, avoiding repeated testing and false positives.

[0119] The method for using timestamps to randomly generate SQL simulation attack instructions is as follows:

[0120] Specifically, as a preferred embodiment, referring to FIG. 2 , the above step S110: using a random function and a timestamp to randomly generate an SQL simulation attack instruction specifically includes:

[0121] S111: Select SQL keywords used in the SQL simulation attack instruction from the SQL language. Specifically, the SQL keywords selected from the SQL language can be: "'SELECT', 'FROM', 'WHERE', 'AND', 'OR', and the corresponding SQL codes are as follows:

[0122] keywords = ['SELECT', 'FROM', 'WHERE', 'AND', 'OR'] #keywords

[0123] S112: Use the timestamp as the seed of the random number generator. The timestamp function is defined as follows: python importrandom importtime The corresponding SQL code is as follows: #Use the timestamp as the seed of the random number generator random.seed(time.time())

[0124] S113: Use the seed of the random number generator to generate random table names, random column names, and random values. The codes for generating random table names, random column names, and random values ​​using the seed of the random number generator are as follows: letters = string.ascii_letters + string.digits # letters and numbers table = ".join(random.sample(letters,8)) # Random table name column = ".join(random.sample(letters,8)) # Random column name value = ".join(random.sample(letters,8)) # Random value

[0125] S114: Constructing a SQL instruction generation function using a random number generator. In the embodiment of the present application, the SQL instruction generation function can be defined using an f function.

[0126] S115: Use the SQL command generation function to combine SQL keywords, random table names, random column names, and random values ​​to randomly generate multiple different SQL simulation attack commands. Among them, an SQL simulation attack command is as follows: sql = f"{random.choice(keywords)}{column}{random.choice(keywords)} {table}{random.choice(keywords)}{column} = '{value}'"

[0127] For example: The code for randomly generating SQL simulated attack instructions using timestamps is as follows: python importrandom importtime #Use timestamp as the seed of the random number generator random.seed(time.time()) #Generate random SQL simulated attack instructions keywords=['SELECT','FROM','WHERE','AND','OR'] #Keywords letters=string.ascii_letters+string.digits #Letters and numbers table=”.join(random.sample(letters,8)) #Random table name column=”.join(random.sample(letters,8)) #Random column name value=”.join(random.sample(letters,8)) #Random value sql=f"{random.choice(keywords)}{column}{random.choice(keywords)} {table}{random.choice(keywords)}{column}='{value}'"

[0128] In addition, embodiments of the present application can also use random functions to randomly generate SQL simulation attack instructions. Specifically, embodiments of the present application can use random functions to generate random values, such as using the RAND() function to generate random numbers, and using the UUID() function to generate unique identifiers. This can simulate more realistic SQL injection attacks and improve the accuracy of vulnerability screening. If random functions are not used to generate SQL simulation attack instructions, problems such as repeated testing, missed vulnerabilities, and patterned testing may occur, resulting in reduced test efficiency and reduced vulnerability screening accuracy. Therefore, using random functions to generate SQL simulation attack instructions is an effective method to avoid these problems.

[0129] Specifically, as a preferred embodiment, as shown in FIG3 , in the above-mentioned defense method for the satellite network system, step S110: using a random function and a timestamp to randomly generate a plurality of different SQL simulation attack instructions includes:

[0130] S116: Select SQL keywords used in the SQL simulation attack instruction from the SQL language. The SQL keywords used in the SQL simulation attack instruction selected in the SQL language can include: 'SELECT', 'FROM', 'WHERE', 'AND', 'OR'. The corresponding SQL code is as follows: keywords = ['SELECT', 'FROM', 'WHERE', 'AND', 'OR'] # keywords

[0131] S117: Generate random table names and random column names using a random number generator. In the embodiment of the present application, the SQL code for generating random table names and random column names using a random number generator is as follows: letters = string.ascii_letters + string.digits # letters and numbers table = ".join(random.sample(letters,8)) # random table name column = ".join(random.sample(letters,8)) # random column name

[0132] S118: Generate random values ​​using a random function. This application uses the RAND() function to generate random values, replacing the original value function.

[0133] S119: Use the random number generator to construct an SQL instruction generation function.

[0134] S1110: Use the SQL command generation function to combine SQL keywords, random table names, random column names, and random values ​​to randomly generate multiple different SQL attack simulation commands. The randomly generated SQL attack simulation commands are as follows: sql = f"{random.choice(keywords)}{column}{random.choice(keywords)} {table}{random.choice(keywords)}{column} = RAND()"

[0135] Specifically, as a preferred embodiment, the above-mentioned random function is used to generate random values, a random number generator is used to construct an SQL instruction generation function, and then the SQL instruction generation function is used to randomly generate a variety of different SQL simulation attack instructions. The SQL code is as follows: Define a random function python importrandom import string #Generate random SQL simulation attack instructions keywords=['SELECT','FROM','WHERE','AND','OR'] #Keywords letters=string.ascii_letters+string.digits #Letters and numbers table=”.join(random.sample(letters,8)) #Random table name column=”.join(random.sample(letters,8)) #Random column name sql=f"{random.choice(keywords)}{column}{random.choice(keywords)} {table}{random.choice(keywords)}{column}=RAND()"

[0136] The technical solution provided by the embodiment of the present application can improve the accuracy of vulnerability screening by generating SQL simulation attack instructions based on random functions. The technical effects of generating SQL simulation attack instructions based on random functions are as follows:

[0137] Increased test coverage: The SQL attack simulation instructions generated by the random function are random and can simulate different attack methods and parameter combinations, thereby increasing test coverage. This allows for more comprehensive detection of the target system's security and improves the accuracy of vulnerability screening.

[0138] Avoiding patterned testing: Using fixed attack commands can easily lead to patterned testing, which can reduce vulnerability screening accuracy. However, SQL simulated attack commands generated by random functions are random, avoiding patterned testing and improving vulnerability screening accuracy.

[0139] Improve vulnerability discovery rate: SQL simulation attack instructions generated by random functions can simulate different attack methods and parameter combinations, thereby increasing the probability of vulnerability discovery. This can improve the accuracy of vulnerability screening and discover more vulnerabilities.

[0140] In summary, SQL simulation attack instructions generated by random functions can improve the accuracy of vulnerability screening, increase test coverage, avoid patterned testing, and improve the vulnerability discovery rate, thereby more comprehensively detecting the security of the target system.

[0141] In addition, it is important to note that when generating random SQL simulation attack instructions, the legality and security of the instructions must be guaranteed to avoid damage to the satellite network. Therefore, when using a random number generator to generate random SQL simulation attack instructions, it is necessary to follow security principles and ensure the legality and security of the instructions.

[0142] At the same time, after generating random SQL simulated attack instructions, we also need to conduct detailed vulnerability screening and security assessment to discover and repair vulnerabilities and security risks in the satellite network. Therefore, the defense method for the satellite network system provided by the embodiment shown in Figure 1 also includes the following steps:

[0143] S120: Using multiple different SQL simulated attack instructions to simulate attacks on the satellite network system, and obtaining attack assessment factors for the satellite network system corresponding to each SQL simulated attack instruction. When using multiple different SQL simulated attack instructions to simulate attacks on the satellite network system, vulnerabilities and security risks of the satellite network system are scanned, thereby screening and obtaining attack assessment factors for the satellite network system corresponding to each SQL simulated attack instruction.

[0144] Specifically, as a preferred embodiment, as shown in FIG4 , the above step S120: using multiple different SQL simulation attack instructions to simulate an attack on a satellite network system, and obtaining attack assessment factors of the satellite network system corresponding to each SQL simulation attack instruction includes:

[0145] S121: Use various SQL attack simulation commands to simulate attacks on the satellite network system, and calculate the satellite network system's data leakage level, data damage level, and system availability. The data leakage level is used to assess the sensitivity and quantity of leaked data within the satellite network system. The data damage level is used to assess the extent of the damage to data integrity. The system availability level is used to assess the impact of the attack on system availability.

[0146] S122: Use various SQL attack simulation commands to simulate attacks on the satellite network system, and measure the vulnerability exposure, access rights, and security controls of the satellite network system. Vulnerability exposure assesses the extent of vulnerabilities in applications and databases. Access rights assess the ease with which an attacker can obtain the necessary access rights to execute an attack. Security controls assess the effectiveness of security controls in applications and databases.

[0147] as well as,

[0148] S123: Use various SQL simulation attack commands to simulate attacks on satellite network systems, and calculate the technical requirements, time and resources required for each SQL simulation attack command. The technical requirements are used to assess the technical expertise and tool complexity required for the attack, while the time and resources required are used to assess the time and resources required for the attacker to execute the attack.

[0149] After obtaining the attack assessment factors of the satellite network system corresponding to each of the above SQL simulation attack instructions, the following steps are also included:

[0150] S124: Determine the impact of each SQL attack command on the satellite network system, using the satellite network system's data leakage, data damage, and system availability. The impact is used to assess the potential impact of SQL attacks on databases and applications. This impact includes the degree of data leakage, data damage, and system availability.

[0151] S125: Determine the success probability of each SQL attack simulation instruction using the vulnerability exposure, access rights, and security control measures of the satellite network system. This attack success probability is used to assess the probability of an attacker successfully executing a SQL attack, including the vulnerability exposure, access rights, and security control measures mentioned above.

[0152] S126: Determine the attack complexity of each SQL attack simulation instruction using the technical requirements, time, and resources required for the SQL attack simulation instruction. The attack complexity is used to assess the technical difficulty and complexity required to execute the SQL attack. The attack complexity includes the aforementioned technical requirements, time, and resources required.

[0153] The technical solution provided by the embodiments of this application uses multiple different SQL simulation attack instructions to simulate attacks on a satellite network system, obtaining multiple different attack assessment factors. These different attack assessment factors are then combined to determine the impact range of each SQL simulation attack instruction on the satellite network system, the success probability of each SQL simulation attack instruction, and the attack complexity of each SQL simulation attack instruction. This allows for the determination of the impact of different SQL simulation attack instructions on the satellite network system, facilitating targeted prevention measures.

[0154] The various SQL simulation attack commands listed above can be used in any combination depending on the scenario, but the most effective approach is to use all of them. However, if all of these commands are used at full capacity, a large number of SQL simulation attack commands will be generated daily, placing a heavy burden on the network. To address this issue, a scoring system should be introduced to identify the SQL simulation attack commands most likely to succeed, prioritize them, and verify them as quickly as possible.

[0155] In order to achieve the above technical effects, the defense method of the satellite network system provided by the embodiment shown in FIG1 further includes:

[0156] S130: assigning weights to attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain an attack severity score for each SQL simulation attack instruction.

[0157] In the technical solutions provided by the embodiments of this application, assessing the severity of SQL attacks is a complex task, as each system and environment has its own specific context and risks. A comprehensive assessment of attack severity needs to be conducted based on the specific circumstances, and decisions must be made in conjunction with the opinions of security experts and the organization's security policy. Therefore, this application proposes a set of weighting schemes that assign corresponding weights to each attack assessment factor, normalize them to an appropriate range, and then calculate a comprehensive attack severity score, thereby enabling a more accurate calculation of the attack severity score for each SQL attack.

[0158] Specifically, as a preferred embodiment, as shown in FIG5 , in the above-mentioned defense method for the satellite network system, step S130: weighting the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction specifically includes:

[0159] S131: According to the influence range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction, weight coefficients of the influence range, the attack success probability and the attack complexity are established respectively.

[0160] The embodiment of the present application introduces a scoring system into the generation formula of SQL simulation attacks, and the attack impact range, attack success probability, and attack complexity are respectively related. Specifically, the attack impact range is positively correlated with the attack success probability. If the attack impact range is larger, the probability of attack success may increase; the attack success probability and attack complexity are usually negatively correlated; the attack impact range and attack complexity are positively correlated to a certain extent, and some complex attacks may lead to a wider impact range. Therefore, it is necessary to establish weight coefficients for the impact range, attack success probability, and attack complexity based on the relationship between the impact range of the above-mentioned satellite network system, the attack success probability of each SQL simulation attack instruction, and the attack complexity.

[0161] S132: According to the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), combined with the weight coefficient of the impact range, the weight coefficient of the attack success probability, and the weight coefficient of the attack complexity, the attack severity score of each SQL function simulation attack instruction is obtained respectively; among which Impact, Probability, and Complexity are the impact range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction respectively, and W1, W2, and W3 are the weight coefficient of the impact range, the weight coefficient of the attack success probability, and the weight coefficient of the attack complexity respectively.

[0162] The technical solution provided in the embodiment of the present application introduces a scoring system, which can score a large number of generated SQL simulation attack instructions. When the attack severity score is greater than a certain value of the priority test, for example, greater than 80 points, the SQL simulation attack instruction is considered to be a SQL simulation attack instruction with a very high risk level. This means that the probability of this SQL simulation attack instruction being able to break through the defense system is high, and priority testing is required at this time because 1: the number of SQL simulation attack instructions generated every day is very large, and it is necessary to discover defense system vulnerabilities in a timely manner rather than waiting for slow testing. It is possible that the real attack instruction arrives earlier than the simulation attack instruction, which defeats the purpose of introducing SQL simulation attack technology to conduct regular vulnerability scans and security drills. 2: Most defense systems will set the number of SQL queries. Because the above embodiment mentioned that the attacker uses SQL injection attacks using error messages: the attacker triggers the web application to return error information (such as account number or password) by entering specific SQL query statements. The attacker can also obtain sensitive information of the web application, such as database version and table structure, through the error message. Therefore, the number of times SQL instructions are received is generally limited. In actual applications, the number of times SQL instructions are received will not be adjusted due to security scanning (that is, the activation of SQL simulation attack instructions). Therefore, while ensuring that the defense system can work normally, it is necessary to test those with higher scores first to ensure that the normal operation of the system is not affected and that deficiencies can be found and corrected more efficiently, rather than using randomly generated SQL simulation attack instructions to consume the defense system, which in turn increases the burden on the defense system.

[0163] The purpose of the embodiments of the present application is to make SQL scoring more accurate by adjusting the weights. For example, in a satellite network system, it is necessary to continuously and randomly generate SQL attack statements and attack the satellite network system. Due to the large number of randomly generated SQL attacks, it is necessary to prioritize the most aggressive ones for simulation testing. In other words, the highest-scoring SQL attack statements are selected. Currently, the values ​​of Impact, Probability, and Complexity are processed in a manner corresponding to different scales.

[0164] Specifically, as a preferred embodiment, as shown in FIG6 , the above step S131: based on the influence range of the satellite network system, the attack success probability and attack complexity of each SQL simulation attack instruction, respectively establishes weight coefficients of the influence range, attack success probability and attack complexity, including:

[0165] S1311: Calculate the weight coefficient of the impact range according to the first weight coefficient calculation formula: w1=n*w2; wherein w1 is the weight coefficient of the impact range, w2 is the weight coefficient of the attack success probability, and n is the range probability impact factor.

[0166] Research has shown the following relationship between impact range and attack success probability: a larger SQL attack's impact range increases the probability of success. This is because attackers can obtain more sensitive information or cause more severe damage to the system, so w1 and w2 should exhibit a positive correlation. The impact factor, represented by the letter n, determines the degree to which the impact range affects the probability of attack success. Larger n values ​​indicate a more significant impact on the probability, while smaller n values ​​indicate a relatively smaller impact. The value of n (a positive number) can be determined based on actual needs.

[0167] The scoring criteria for the three factors of impact, attack success probability, and attack complexity are divided equally on a scale of 1 to 10. However, it is difficult to ensure the quality of the samples used for each of the three factors. For example, for a SQL statement, the impact score is 10 and the probability score is 1. Theoretically, a larger impact would increase the probability of success. However, the impact and probability scores are already 10 times different. If we do not establish a relationship between the weights and thus link the factors, the resulting scores will inevitably be inaccurate. Therefore, we incorporate the positive correlation between w1 and w2 into the first weight coefficient calculation formula. Assuming n is 2, the impact score multiplied by the weight w1 is 10, and the probability score multiplied by the weight w2 is 2, a 5-fold difference. This, to some extent, avoids distorting the actual SQL aggressiveness score due to over-regularization of factor scores.

[0168] S1312: Calculate the weight coefficient of the attack success probability according to the second weight coefficient calculation formula: w2 = a*exp(-b*w3); where w3 is the weight coefficient of the attack complexity, a is the curve scaling factor, and b is the curve slope influencing factor.

[0169] In the embodiments of this application, the relationship between attack success probability and attack complexity is as follows: Generally, the attack success probability and attack complexity are negatively correlated. If the attack complexity is low, the attacker is more likely to successfully execute the attack; conversely, if the attack complexity is high, the probability of attack success may decrease.

[0170] In the second weight coefficient calculation formula (w2 = a*exp(-b*w3)), the base of the natural logarithm, e, is an important mathematical constant with an approximate value of approximately 2.71828. An exponential function applies exponential powers to e, causing the function's value to grow or decay exponentially.

[0171] In the second weight coefficient calculation formula, exp(-b*w3) represents an exponential function with e as the base and -b*w3 as the exponent. Among them, -b*w3 is the power of the exponent, and the negative sign indicates that the result of the exponential function will decrease as the exponent increases. exp(-b*w3) can be used to represent the degree of influence of attack complexity on the probability of attack success. A larger attack complexity value w3 will result in a smaller result of the exponential function, thereby reducing the probability of attack success. A smaller attack complexity value w3 will result in a larger result of the exponential function, thereby increasing the probability of attack success. By using an exponential function, the embodiment of the present application can more clearly and explicitly express the correlation between attack complexity and attack success probability in the second weight coefficient calculation formula, and present an exponential downward trend.

[0172] Among them, parameters a and b are constants used to adjust the function curve and slope. By adjusting the values ​​of these parameters, the strength and shape of the relationship between probability and complexity can be determined according to the specific situation. Specifically: parameter a controls the overall scaling factor of the curve, which can affect the range and size of the probability of successful attack. Generally speaking, a larger parameter a value will result in a higher initial probability, while a smaller parameter a value will result in a lower initial probability. Different values ​​can be tried and adjusted according to the actual situation to find a suitable range of values. In the embodiment of the present application, a is a scaling factor used to adjust the range and size of the probability. Generally speaking, the value of parameter a can be taken in the interval [0, +∞), where a larger value will result in a higher initial probability, while a smaller value will result in a lower initial probability. In the embodiment of the present invention, it is recommended to take 1, which does not affect the probability of successful attack too much. It is negatively correlated with the attack complexity, so the focus is placed on parameter b.

[0173] Parameter b (curve slope factor): Parameter b affects the slope of the curve. Larger b values ​​result in a steeper curve, indicating a greater sensitivity of attack complexity to probability. Smaller b values ​​result in a flatter curve, indicating a relatively smaller impact of attack complexity on probability. The value of parameter b can be adjusted to suit the specific relationship. b is typically a positive number.

[0174] as well as,

[0175] S1313: Calculate the weight coefficient of the attack complexity according to the third weight coefficient calculation formula: w1=c*exp(d*w3); where c is the exponential scaling factor and d is the exponential slope influencing factor.

[0176] The relationship between impact scope and attack complexity is as follows: Some complex attacks may cause a wider impact scope, so attackers need higher technical skills and more time to execute complex attacks, but if successfully executed, they may have more serious consequences on databases and applications.

[0177] The third weight coefficient calculation formula: w1 = c*exp(d*w3) means that as the complexity of the attack increases, the value of the exponential function also increases, resulting in a larger attack range. In other words, complex attacks tend to have a wider impact. Furthermore, by adjusting the values ​​of parameters c and d, the strength and shape of the relationship between range and complexity can be controlled.

[0178] The parameter d here controls the slope of the exponential function. In this embodiment of the present invention, it can be a positive number, i.e., (0, +∞]. A larger parameter d value causes the exponential function to rise faster, indicating that complexity is more sensitive to the impact of the scope of influence. Generally speaking, in a scoring formula with three factors, the value of the parameter will not be greater than 3, otherwise it will deviate from the scoring rules initially entered by the operator. Our goal is to optimize the scores of each factor of Impact, Probability, and Complexity initially entered by the operator to ensure the accuracy of the calculated scores without excessively interfering with the initial factor scoring criteria. A smaller parameter d value causes the exponential function to rise slower, indicating that complexity has a relatively small impact on the scope of influence.

[0179] Parameter c is a scaling factor used to adjust the size of the impact range. A larger c value results in a larger impact range, while a smaller c value results in a smaller impact range. Generally speaking, in this embodiment, a value of 1 is recommended. To avoid excessive correlation between impact range and attack complexity, we focus on parameter d.

[0180] From the above content, it can be seen that the technical solution provided by the embodiment of the present application and the design of the weight coefficient have the following beneficial effects:

[0181] 1. The first, second, and third weight coefficient calculation formulas establish a correlation between weight coefficients w1, w2, and w3. Even if the initial three-factor scoring criteria are unsatisfactory, the weight relationship can be used to adjust the score to reflect the actual SQL aggressiveness.

[0182] 2. Even if any weight coefficient value of w1, w2 and w3 is provided later, that is to say, the satellite network system pays more attention to a certain aspect of prevention and control, a weight coefficient value will be given first, and the other two weights can be calculated immediately, saving the energy of redesign.

[0183] The defense method for the satellite network system provided by the embodiment shown in FIG1 further includes, after obtaining the attack severity score of each SQL simulated attack instruction:

[0184] S140: Prioritize the SQL simulation attack instructions according to the attack severity scores, and verify the SQL simulation attack instructions in the order of the priority rankings.

[0185] Because random combinations of different keywords can generate a large number of SQL simulation attack commands, excessive SQL simulation attack commands can cause network congestion and overload in the satellite network system. To address this issue, a scoring system is needed to identify the SQL simulation attack commands most likely to succeed. These commands are then prioritized by attack severity score and verified as quickly as possible in order of priority, thereby quickly addressing defense vulnerabilities and security risks in the satellite network system.

[0186] Specifically, as a preferred embodiment, as shown in FIG7 , the above step S140: prioritizing the SQL simulation attack instructions according to the attack severity scores and verifying the SQL simulation attack instructions in the order of the priority rankings specifically includes:

[0187] S141: Verify the SQL simulated attack instructions in order of priority, count and repair the defense loopholes and security risks of the satellite network system. In the embodiment of the present application, the SQL simulated attack instructions are verified in order of priority, so that the more dangerous defense loopholes and security risks can be quickly and accurately resolved.

[0188] S142: Storing the SQL simulation attack instructions in the instruction database. Storing the SQL simulation attack instructions in the instruction database allows for similarity comparison and verification when the satellite network system is attacked, thereby finding solutions and implementing corresponding vulnerability defenses.

[0189] S143: Use the whitelist function to authorize access devices in the satellite network system. The whitelist function ensures satellite network security and prevents attacks. By authorizing devices and users in the satellite network, only authorized devices and users can access the satellite network, effectively preventing unauthorized devices and users from intruding. Furthermore, this embodiment of the present application also enables low-level filtering to filter and detect data packets in the satellite network, preventing malicious attacks and virus intrusions.

[0190] S144: When the authorized access device passes verification, the SQL data request from the access device is received. The satellite network system's communication traffic is monitored and analyzed through filtering functions. The system can receive SQL data requests from access devices, detect abnormalities, and take measures, such as real-time interception of abnormal traffic to prevent network congestion and attacks.

[0191] S145: The SQL data request sent by the access device is filtered and tested, and the similarity between the SQL data request and the SQL attack simulation instructions in the instruction database is calculated. This embodiment extracts the SQL attack simulation instructions from the instruction database and compares the similarity between the SQL attack simulation instructions and the SQL data request. This allows security testing of the filtered SQL data request. If the similarity is greater than or equal to a predetermined similarity threshold, it indicates that the SQL data request presents a security risk, and step S146 is executed.

[0192] S146: When the similarity is greater than or equal to a predetermined similarity threshold, the security device and the SQL data request are blocked. When the similarity between the SQL data request and the SQL attack simulation instruction in the instruction database is greater than or equal to the predetermined similarity threshold, it indicates that the SQL data request is likely a SQL attack instruction. In this case, to ensure data security of the satellite network system, the security device and its data request need to be blocked, and the SQL data request from the security device is no longer accepted.

[0193] In summary, the defense method for a satellite network system provided by the present application can randomly generate a variety of different types of SQL simulated attack instructions by using random functions and timestamps. By using these different types of simulated attack instructions to simulate attacks on the satellite network system, vulnerability scanning and security drills can be regularly performed on the satellite network system through SQL simulated attack technology, thereby ensuring that countermeasures can be taken in real intrusion or attack scenarios. Specifically, a variety of different SQL simulated attack instructions are used to simulate attacks on the satellite network system, and attack assessment factors of the satellite network system corresponding to each SQL simulated attack instruction are obtained. Then, the attack assessment factors corresponding to each SQL simulated attack instruction are weighted and scored according to the attack severity scoring function, thereby obtaining an attack severity score for each SQL simulated attack instruction. The attack severity score is used to prioritize the SQL simulated attack instructions, and the SQL simulated attack instructions with the highest attack success rate can be found. The SQL simulated attack instructions are verified according to the priority ranking, thereby improving the vulnerability detection rate and defense capabilities of the satellite network system. The above method can solve the problem that the existing technology is difficult to meet the security and reliability requirements of the satellite network system.

[0194] In addition, based on the same concept of the above-mentioned method embodiment, the embodiment of the present application also provides a defense system for a satellite network system, which is used to implement the above-mentioned method of the present application. Since the principles and methods of solving the problems in this system embodiment are similar, it at least has all the beneficial effects brought by the technical solutions of the above-mentioned embodiments, and will not be repeated here one by one.

[0195] Referring to FIG8 , FIG8 is a schematic diagram of the structure of a satellite network system defense system provided by an embodiment of the present invention. As shown in FIG8 , the satellite network system defense system includes:

[0196] The instruction generation module 110 is used to randomly generate a variety of different SQL simulation attack instructions using a random function and a timestamp;

[0197] An attack simulation module 120 is configured to simulate an attack on a satellite network system using a plurality of different SQL simulation attack instructions, and obtain attack assessment factors of the satellite network system corresponding to each SQL simulation attack instruction;

[0198] The weighting module 130 is used to weight the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction;

[0199] The ranking verification module 140 is used to prioritize the SQL simulation attack instructions according to the attack severity scores and verify the SQL simulation attack instructions in the order of the priority rankings.

[0200] Among them, as a preferred embodiment, as shown in Figure 9, in the defense system of the above-mentioned satellite network system, the attack instruction generation module 110 includes a first attack instruction generation sub-module 111, which is used to select SQL keywords used by SQL simulation attack instructions from the SQL language; use the timestamp as the seed of the random number generator; use the seed of the random number generator to generate random table names, random column names and random values ​​respectively; use the random number generator to construct an SQL instruction generation function; use the SQL instruction generation function to combine SQL keywords, random table names, random column names and random values ​​to randomly generate a variety of different SQL simulation attack instructions.

[0201] Among them, as a preferred embodiment, as shown in Figure 9, in the defense system of the above-mentioned satellite network system, the attack instruction generation module 110 also includes: a second attack instruction generation sub-module 112, which is used to select SQL keywords used by the SQL simulation attack instruction from the SQL language; use a random number generator to generate random table names and random column names; use the random function to generate random values; use the random number generator to construct an SQL instruction generation function; use the SQL instruction generation function to combine the SQL keywords, the random table names, the random column names and the random values ​​to randomly generate a variety of different SQL simulation attack instructions.

[0202] Among them, as a preferred embodiment, as shown in FIG10 , in the defense system of the satellite network system, the attack simulation module 120 includes:

[0203] The first factor statistics submodule 121 is used to simulate attacks on the satellite network system using a variety of different SQL attack simulation instructions, and respectively calculate the data leakage degree, data damage degree and system availability degree of the satellite network system;

[0204] The second factor statistics submodule 122 is used to simulate attacks on the satellite network system using a variety of different SQL attack simulation instructions, and to count the access rights and security control measures of the satellite network system respectively; and

[0205] The third factor statistics submodule 123 is used to simulate attacks on the satellite network system using a variety of different SQL simulation attack instructions, and to count the technical requirements and the time and resources invested corresponding to the SQL simulation attack instructions;

[0206] The impact scope determination submodule 124 is configured to determine the impact scope of the satellite network system caused by each SQL simulated attack instruction using the satellite network system's data leakage degree, data damage degree, and system availability degree;

[0207] The success probability determination submodule 125 is used to determine the attack success probability of each SQL simulation attack instruction using the access rights and security control measures of the satellite network system; and

[0208] The attack complexity determination submodule 126 is configured to determine the attack complexity of each SQL simulation attack instruction using the technical requirements corresponding to the SQL simulation attack instruction and the time and resources invested.

[0209] Among them, as a preferred embodiment, as shown in FIG11 , in the defense system of the satellite network system, the weight assignment module 130 includes:

[0210] The weight coefficient establishment submodule 131 is used to establish weight coefficients of the influence range, attack success probability and attack complexity according to the influence range of the satellite network system, the attack success probability and attack complexity of each SQL simulation attack instruction;

[0211] The attack severity assignment submodule 132 is used to obtain the attack severity score of each SQL function simulation attack instruction based on the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), combined with the weight coefficients of the impact range, attack success probability, and attack complexity. Among them, Impact, Probability, and Complexity are the impact range of the satellite network system, the attack success probability of each SQL simulation attack instruction, and the attack complexity, respectively. W1, W2, and W3 are the weight coefficients of the impact range, attack success probability, and attack complexity, respectively.

[0212] As a preferred embodiment, as shown in FIG12 , in the defense system of the satellite network system, the ranking verification module 140 includes:

[0213] A statistics and repair submodule 141 is used to verify the SQL simulated attack instructions according to the priority ranking order, count and repair the defense vulnerabilities and security risks of the satellite network system;

[0214] The instruction storage submodule 142 is used to store the SQL simulation attack instruction in the instruction database;

[0215] The device authorization submodule 143 is used to authorize access devices in the satellite network system using a whitelist function;

[0216] The request receiving submodule 144 is configured to receive an SQL data request from the access device when the authorized access device passes the verification;

[0217] A filtering and detecting submodule 145 is configured to filter and detect the SQL data request sent by the access device, and calculate the similarity between the SQL data request and the SQL simulated attack instruction in the instruction database;

[0218] The request shielding submodule 146 is configured to shield the security device and SQL data request when the similarity is greater than or equal to a predetermined similarity threshold.

[0219] In summary, the satellite network system defense system provided by the present application can randomly generate multiple different types of SQL simulation attack instructions through the instruction generation module 110 using a random function and a timestamp. The attack simulation module 120 can then use these multiple types of simulated attack instructions to simulate attacks on the satellite network system. This allows for regular vulnerability scanning and security drills of the satellite network system using SQL simulation attack technology, thereby ensuring that countermeasures can be taken in real-world intrusion or attack scenarios. Specifically, multiple different SQL simulation attack instructions are used to simulate attacks on the satellite network system, and attack assessment factors corresponding to each SQL simulation attack instruction are obtained. The weighting module 130 then weights the attack assessment factors corresponding to each SQL simulation attack instruction according to an attack severity scoring function, thereby obtaining an attack severity score for each SQL simulation attack instruction. The ranking verification module 140 uses the attack severity scores to prioritize the SQL simulation attack instructions, thereby identifying the SQL simulation attack instruction with the highest attack success rate. The SQL simulation attack instructions are then verified according to the priority ranking, thereby improving the vulnerability detection rate and defense capabilities of the satellite network system. This approach can address the problem that existing technologies are unable to meet the security and reliability requirements of satellite network systems.

[0220] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0221] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A defense method for a satellite network system, characterized in that: include: Use random functions and timestamps to randomly generate a variety of different SQL simulation attack instructions; Using the multiple different SQL simulation attack instructions to simulate attacking the satellite network system, and obtaining the attack evaluation factor of the satellite network system corresponding to each SQL simulation attack instruction; According to the attack severity scoring function, the attack assessment factors corresponding to each SQL simulation attack instruction are weighted and scored to obtain the attack severity score of each SQL simulation attack instruction; The SQL simulated attack instructions are prioritized according to the attack severity scores, and the SQL simulated attack instructions are verified in the priority ranking order.

2. The satellite network system defense method according to claim 1, characterized in that: The step of using a random function and a timestamp to randomly generate a variety of different SQL simulation attack instructions includes: selecting SQL keywords used by the SQL simulation attack instructions from the SQL language; using the timestamp as a seed of a random number generator; using the seed of the random number generator to respectively generate a random table name, a random column name and a random value; using the random number generator to construct an SQL instruction generation function; using the SQL instruction generation function to combine the SQL keywords, the random table name, the random column name and the random value to randomly generate a variety of different SQL simulation attack instructions.

3. The defense method of a satellite network system according to claim 1 or 2, characterized in that: The step of using a random function and a timestamp to randomly generate a plurality of different SQL simulated attack instructions comprises: selecting an SQL keyword used by the SQL simulated attack instruction from an SQL language; using a random number generator to generate a random table name and a random column name; using the random function to generate a random value; using the random number generator to construct an SQL instruction generation function; and using the SQL instruction generation function to combine the SQL keyword, the random table name, the random column name and the random value to randomly generate a plurality of different SQL simulated attack instructions.

4. The satellite network system defense method according to claim 1, characterized in that: The step of using the multiple different SQL simulated attack instructions to simulate the attack on the satellite network system and respectively obtaining the attack assessment factors of the satellite network system corresponding to each SQL simulated attack instruction includes: using the multiple different SQL simulated attack instructions to simulate the attack on the satellite network system and respectively counting the data leakage degree, data damage degree and system availability degree of the satellite network system; Use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and respectively count the vulnerability exposure, access rights and security control measures of the satellite network system; and use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and respectively count the technical requirements and investment time and resources corresponding to the SQL simulation attack instructions; use the data leakage degree, data damage degree and system availability degree of the satellite network system to determine the impact scope of the satellite network system caused by each SQL simulation attack instruction; use the vulnerability exposure degree, access rights and security control measures of the satellite network system to determine the attack success probability of each SQL simulation attack instruction; and use the technical requirements and investment time and resources corresponding to the SQL simulation attack instructions Time and resources are used to determine the attack complexity of each SQL simulation attack instruction.

5. The defense method of a satellite network system according to claim 4, characterized in that: The step of weighting the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction includes: According to the influence range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction, weight coefficients of the influence range, the attack success probability and the attack complexity are established respectively; According to the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), combined with the weight coefficient of the impact range, the weight coefficient of the attack success probability and the weight coefficient of the attack complexity, the attack severity score of each SQL function simulation attack instruction is obtained respectively; wherein Impact, Probability and Complexity are respectively the impact range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction, and W1, W2 and W3 are respectively the weight coefficients of the impact range, the attack success probability and the attack complexity.

6. The defense method of a satellite network system according to claim 5, characterized in that: The step of establishing a weight coefficient of the influence range, a weight coefficient of the attack success probability and a weight coefficient of the attack complexity respectively according to the influence range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction comprises: According to the first weight coefficient calculation formula: w1=n*w2, the weight coefficient of the impact range is calculated; wherein w1 is the weight coefficient of the impact range, w2 is the weight coefficient of the attack success probability, and n is the range probability impact factor; According to the second weight coefficient calculation formula: w2=a*exp(-b*w3), the weight coefficient of the attack success probability is calculated; wherein w3 is the weight coefficient of the attack complexity, a is the curve scaling factor, and b is the curve slope influencing factor; and, according to the third weight coefficient calculation formula: w1=c*exp(d*w3), the weight coefficient of the attack complexity is calculated; wherein c is the exponential scaling factor, and d is the exponential slope influencing factor.

7. The defense method of a satellite network system according to claim 1, characterized in that: The step of prioritizing the SQL simulated attack instructions according to the attack severity scores and verifying the SQL simulated attack instructions in the order of the priority rankings includes: verifying the SQL simulated attack instructions in the order of the priority rankings, counting and repairing the defense vulnerabilities and security risks of the satellite network system; The SQL simulation attack instruction is stored in an instruction database; the access device in the satellite network system is authorized using a whitelist function; when the authorized access device passes verification, the SQL data request of the access device is received; the SQL data request sent by the access device is filtered and detected, and the similarity between the SQL data request and the SQL simulation attack instruction in the instruction database is calculated; when the similarity is greater than or equal to a predetermined similarity threshold, the security device and the SQL data request are shielded.

8. A satellite network system defense system, characterized in that: include: Instruction generation module, used to randomly generate a variety of different SQL using random functions and timestamps Simulate attack instructions; An attack simulation module, used to use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and obtain the attack evaluation factor of the satellite network system corresponding to each SQL simulation attack instruction; A weight scoring module is used to weight the attack assessment factors corresponding to each SQL simulation attack instruction according to the attack severity scoring function to obtain the attack severity score of each SQL simulation attack instruction; A ranking verification module is used to prioritize the SQL simulated attack instructions according to the attack severity scores and verify the SQL simulated attack instructions in the priority ranking order.

9. The satellite network system defense system according to claim 8, characterized in that: The attack simulation module comprises: A first factor statistics submodule is used to use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and respectively count the data leakage degree, data damage degree and system availability degree of the satellite network system; The second factor statistics submodule is used to use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and respectively count the access rights and security control measures of the satellite network system; and A third factor statistics submodule is used to use the multiple different SQL simulation attack instructions to simulate the attack on the satellite network system, and to count the technical requirements and investment time and resources corresponding to the SQL simulation attack instructions respectively; An impact range determination submodule, used to determine the impact range of the satellite network system caused by each SQL simulation attack instruction using the data leakage degree, data damage degree and system availability degree of the satellite network system; A success probability determination submodule, used to determine the attack success probability of each SQL simulation attack instruction using the access rights and security control measures of the satellite network system; and The attack complexity determination submodule is used to determine the attack complexity of each SQL simulation attack instruction using the technical requirements corresponding to the SQL simulation attack instruction and the time and resources invested.

10. The satellite network system defense system according to claim 9, characterized in that: The weight scoring module includes: a weight coefficient establishment submodule, which is used to establish the weight coefficients of the influence range, the attack success probability and the attack complexity according to the influence range of the satellite network system, the attack success probability and the attack complexity of each SQL simulation attack instruction; An attack severity assignment submodule, for obtaining the attack severity score of each SQL function simulation attack instruction according to the attack severity scoring function: Severity = (W1*Impact+W2*Probability+W3*Complexity) / (W1+W2+W3), combining the weight coefficient of the impact range, the weight coefficient of the attack success probability and the weight coefficient of the attack complexity; Among them, Impact, Probability and Complexity are respectively the impact range of the satellite network system, the attack success probability and attack complexity of each SQL simulation attack instruction, and W1, W2 and W3 are respectively the weight coefficients of the impact range, the attack success probability and the attack complexity.

Images