CN118540124A - Attack simulation system deployment method, device, equipment and storage medium - Google Patents

Abstract

The present application provides an attack simulation system deployment method, device, equipment and storage medium, which relate to the field of communications. The method includes: obtaining the network topology of the target network; the target network includes multiple subnets; according to the network topology, deploying the server side of the attack simulation system at the exit of the target network; the exit is the physical location or logical location where the target network is connected to other networks; according to the network topology, determining the full verification subnet; the full verification subnet is a subnet of network security equipment in multiple subnets, and the route between the exit and the network security equipment includes; deploying the full verification client of the attack simulation system in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server. The method is applicable to the attack simulation process. It is used to solve the problem of high performance requirements on the server side.

Description

Attack simulation system deployment method, device, equipment and storage medium

Technical Field

The present application relates to the field of communications, and in particular to an attack simulation system deployment method, device, equipment and storage medium.

Background Art

As cyberattack techniques become increasingly sophisticated, enterprise security operations centers are facing tremendous pressure. Attack simulation (or BAS) systems can automatically and continuously verify target networks and promptly detect potential security risks in the network, which has attracted more and more attention.

The attack simulation system consists of two parts: the server and the client. The server is deployed at the exit of the target network that needs to be verified, and a client is deployed in the link corresponding to each subnet of the target network. The server will continue to send full verification data to all clients, and judge whether the security strategy in this link is correct based on the feedback from the client.

However, the current attack simulation system requires a client to be deployed in each subnet, and the server sends full verification messages to all clients, which places high performance requirements on the server.

Summary of the invention

Based on the above technical problems, the present application provides an attack simulation system deployment method, device, equipment and storage medium, which can reduce the number of clients deployed in the subnet by deploying clients only in the subnet where the route between the network exit and the network security device exists, thereby reducing the requirements on the server side.

In the first aspect, the present application provides an attack simulation system deployment method, the method comprising: obtaining the network topology structure of the target network; the target network includes multiple subnets; according to the network topology structure, deploying the server side of the attack simulation system at the exit of the target network; the exit is the physical location or logical location where the target network is connected to other networks; according to the network topology structure, determining the full verification subnet; the full verification subnet is a subnet of multiple subnets, and the route between the exit and the subnet includes a network security device; deploying a full verification client of the attack simulation system in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server side.

It should be understood that the current attack simulation system needs to deploy a client in each subnet to send and receive full verification messages, and has high performance requirements on the server side. The attack simulation system deployment method provided in this application can determine the full verification subnet where the route between the target network and the target network exit has a network security device from the target network according to the network topology of the target network, and only deploy the full verification client in the full verification subnet, without the need to deploy the full verification client in the subnet where the route between the target network exit does not have a network security device, thereby reducing the number of clients deployed in the subnet and the number of full verification messages sent and received by the server side, thereby reducing the requirements on the server side.

In addition, the clients deployed by the attack simulation system deployment method provided in the present application are all deployed in the subnet and will not be directly connected to the network security device, so there is no need to occupy additional ports of the network security device.

Optionally, the method also includes: determining a connectivity verification subnet according to the network topology; the connectivity verification subnet is a subnet among multiple subnets, the route between the subnet and the exit does not include a network security device, and the route is not entirely a subnet of switches; deploying a connectivity verification client of the attack simulation system in the connectivity verification subnet; the connectivity verification client is used to send and receive connectivity verification messages to and from the server.

It should be understood that each client in the current attack simulation system sends and receives full verification messages with the server, and the bandwidth of the target network is occupied when sending and receiving verification messages, which may affect the normal business of users. The attack simulation system deployment method provided in the present application can also be used to determine that the route between the exit and the network security device does not include the connectivity verification subnet according to the network topology structure, and deploy a connectivity verification client that only needs to send and receive connectivity verification messages with the server in the connectivity verification subnet. The connectivity verification client does not need to send and receive full verification messages with the server, which reduces the amount of data sent and received between the client and the server, and can alleviate the problem of large bandwidth occupancy caused by attack simulation.

Optionally, according to the network topology structure, a full verification subnet is determined, including: taking the server end as the root node, traversing the network topology structure, and obtaining a tree structure corresponding to the network topology structure; wherein the tree structure includes a root node, a security node, and a terminal node; the security node corresponds to a network security device in the network topology structure, and the terminal node corresponds to a terminal device in the network topology structure; if all the child nodes of a node are terminal nodes, then the node is determined as a subnet node; traverse each security node in the tree structure, and perform a first operation on each security node; the first operation includes: if the child node of the security node is a subnet node, then the subnet corresponding to the subnet node is determined as a full verification subnet.

Optionally, the first operation further includes: if the child node of the security node is not a subnet node, deleting the child node from the tree structure.

It should be understood that the attack simulation is mainly performed on the subnet. The present application provides an attack simulation system deployment method, and can also delete the child nodes whose parent nodes are security nodes but are not subnet nodes from the tree structure, thereby streamlining the tree structure and avoiding the child nodes that are not subnet nodes from interfering with the deployment.

Optionally, the method further includes: when all safety nodes in the tree structure complete the first operation, deleting the safety node from the tree structure, and setting the parent node of each safety node child node as the parent node of the safety node.

Optionally, the tree structure also includes routing nodes; the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology; the router routing nodes correspond to routers in the network topology; the method also includes: traversing each security node in the tree structure, if the child node of the security node is a subnet node, setting the verification attribute of the subnet node to full verification, and the subnet corresponding to the subnet node is a full verification subnet; setting the verification attribute of the subnet node whose parent node is a non-security node and whose routes with the root node are not all switch routing nodes to connectivity verification, and the subnet corresponding to the subnet node is a connectivity verification subnet; setting the verification attribute of the node whose parent node is a non-security node and is not a subnet node itself to no verification; traversing all For a parent node with leaf nodes, if the number of child nodes of a parent node is greater than 1, the following operations are performed on the parent node: if the verification attributes of all child nodes are "no verification required", a child node is randomly retained and the remaining child nodes are deleted; if the verification attributes of all child nodes are "no verification required" or "connectivity verification", a child node with a verification attribute of "connectivity verification" is randomly retained and the remaining child nodes are deleted; if the verification attributes of some child nodes are "no verification required" or "connectivity verification", and the parent node is a switch routing node, all child nodes with verification attributes of "no verification required" and "connectivity verification" are deleted, and child nodes with verification attributes of "full verification" are retained; if the verification attributes of some child nodes are "no verification required" or "connectivity verification", and the parent node is a router routing node, all child nodes with a verification attribute of "no verification required" are deleted.

Optionally, the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology; the router routing nodes correspond to routers in the network topology; the method further includes: traversing the parent node of each leaf node in the tree structure, if the parent node is a switch routing node, setting the parent node of all child nodes of the switch routing node to the parent node of the switch routing node, and deleting the switch routing node from the tree structure, and looping until the tree structure no longer changes.

In a second aspect, the present application provides an attack simulation system deployment device, which includes an acquisition module and a processing module.

The acquisition module is used to acquire the network topology structure of the target network; the target network includes multiple subnets.

A processing module is used to deploy the server side of the attack simulation system at the exit of the target network according to the network topology; the exit is the physical location or logical location where the target network is connected to other networks; a full verification subnet is determined according to the network topology; the full verification subnet is a subnet of multiple subnets, and the route between the exit and the network security device includes the subnet; a full verification client of the attack simulation system is deployed in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server.

Optionally, the processing module is also used to determine a connectivity verification subnet based on the network topology; the connectivity verification subnet is a subnet among multiple subnets, and the route between the outlet does not include a network security device, and the route is not entirely a subnet of switches; a connectivity verification client of the attack simulation system is deployed in the connectivity verification subnet; the connectivity verification client is used to send and receive connectivity verification messages to and from the server.

Optionally, the processing module is specifically used to traverse the network topology structure with the server side as the root node to obtain a tree structure corresponding to the network topology structure; wherein the tree structure includes a root node, a security node, and a terminal node; the security node corresponds to a network security device in the network topology structure, and the terminal node corresponds to a terminal device in the network topology structure; if all the child nodes of a node are terminal nodes, the node is determined as a subnet node; traverse each security node in the tree structure and perform a first operation on each security node; the first operation includes: if the child node of the security node is a subnet node, the subnet corresponding to the subnet node is determined as a full verification subnet.

Optionally, the first operation further includes: if the child node of the security node is not a subnet node, deleting the child node from the tree structure.

Optionally, the processing module is further configured to, when all safety nodes in the tree structure have completed the first operation, delete the safety node from the tree structure, and set the parent node of each safety node child node as the parent node of the safety node.

Optionally, the tree structure also includes routing nodes; the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology structure; the router routing nodes correspond to routers in the network topology structure; the processing module is also used to traverse each security node in the tree structure, if the child node of the security node is a subnet node, then the verification attribute of the subnet node is set to full verification, and the subnet corresponding to the subnet node is a full verification subnet; the verification attribute of the subnet node whose parent node is a non-security node and whose routes with the root node are not all switch routing nodes is set to connectivity verification, and the subnet corresponding to the subnet node is a connectivity verification subnet; the verification attribute of the node whose parent node is a non-security node and which is not a subnet node itself is set to no verification required; traverse For the parent node of all leaf nodes, if the number of child nodes of a parent node is greater than 1, the following operations are performed on the parent node: if the verification attributes of all child nodes are "no verification required", one child node is randomly retained and the remaining child nodes are deleted; if the verification attributes of all child nodes are "no verification required" or "connectivity verification", one child node with the verification attribute of "connectivity verification" is randomly retained and the remaining child nodes are deleted; if the verification attributes of some child nodes are "no verification required" or "connectivity verification", and the parent node is a switch routing node, all child nodes with the verification attributes of "no verification required" and "connectivity verification" are deleted, and the child nodes with the verification attribute of "full verification" are retained; if the verification attributes of some child nodes are "no verification required" or "connectivity verification", and the parent node is a router routing node, all child nodes with the verification attribute of "no verification required" are deleted.

Optionally, the tree structure also includes routing nodes; the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology structure; the router routing nodes correspond to routers in the network topology structure; the processing module is further used to traverse the parent node of each leaf node in the tree structure, if the parent node is a switch routing node, then the parent node of all child nodes of the switch routing node is set to the parent node of the switch routing node, and the switch routing node is deleted from the tree structure, and the processing is cyclically processed until the tree structure no longer changes.

In a third aspect, the present application provides a computer program product. When the computer program product is executed on an electronic device, the electronic device implements the method described in the first aspect.

In a fourth aspect, the present application provides an electronic device, comprising: a processor and a memory; the memory stores instructions executable by the processor; when the processor is configured to execute the instructions, the electronic device implements the method described in the first aspect above.

In a fifth aspect, the present application provides a computer-readable storage medium, which includes: computer software instructions; when the computer software instructions are executed in an electronic device, the electronic device implements the method described in the first aspect above.

The beneficial effects of the second to fifth aspects mentioned above can be referred to the first aspect and will not be elaborated on again.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

FIG1 is a schematic diagram of a flow chart of an attack simulation system deployment method provided in an embodiment of the present application;

FIG2 is a schematic diagram of a network topology structure provided in an embodiment of the present application;

FIG3 is another schematic diagram of a flow chart of an attack simulation system deployment method provided in an embodiment of the present application;

FIG4 is another schematic diagram of a flow chart of an attack simulation system deployment method provided in an embodiment of the present application;

FIG5 is a schematic diagram of another network topology structure provided in an embodiment of the present application;

FIG6 is a schematic diagram of a tree structure provided in an embodiment of the present application;

FIG7 is a simplified schematic diagram of a security node provided in an embodiment of the present application;

FIG8 is another schematic flow chart of the attack simulation system deployment method provided in an embodiment of the present application;

FIG9 is a schematic diagram of merging provided in an embodiment of the present application;

FIG10 is a simplified schematic diagram of a switch routing node provided in an embodiment of the present application;

FIG11 is a schematic diagram of the composition of an attack simulation system deployment device provided in an embodiment of the present application;

FIG. 12 is a schematic diagram of the composition of an electronic device provided in an embodiment of the present application.

DETAILED DESCRIPTION

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

It should be noted that, in the embodiments of the present application, words such as "exemplarily" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplarily" or "for example" is intended to present related concepts in a specific way.

In order to facilitate the clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical items or similar items with basically the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order.

As cyberattack techniques become increasingly sophisticated, enterprise security operations centers are facing tremendous pressure. Attack simulation (or BAS) systems can automatically and continuously verify target networks and promptly detect potential security risks in the network, which has attracted more and more attention.

The attack simulation system consists of two parts: the server and the client. The server is deployed at the exit of the target network that needs to be verified, and a client is deployed in the link corresponding to each subnet of the target network. The server will continue to send full verification data to all clients, and judge whether the security strategy in this link is correct based on the feedback from the client.

The server side can run on one or more servers, which can be physical servers, virtual machines, or containerized environments.

The client can be a hardware device dedicated to BAS testing, or it can be an ordinary computer with specific software or plug-ins installed.

The server and client in the BAS system can be deployed manually by managers or automatically by automation tools or platforms.

These automation tools or platforms can be specialized deployment management systems (such as Ansible, Chef, or Puppet), or they can be the automated deployment functions that come with the BAS system. They perform deployment tasks (such as installing and configuring operating systems, deploying applications, and configuring network environments) through predefined scripts, configuration files, or scripts.

However, the current attack simulation system requires a client to be deployed in each subnet, and the server sends full verification messages to all clients, which places high performance requirements on the server.

Based on this, the embodiments of the present application provide an attack simulation system deployment method, apparatus, device and storage medium, which can reduce the number of clients deployed in the subnet by deploying the client only in the subnet where the network security device has a route between the network exit, thereby reducing the requirements on the server side.

The execution subject of the attack simulation system deployment method provided in the embodiment of the present application is an attack simulation system deployment device, which can be an electronic device (such as a server or computer, etc.) with the above-mentioned automation tool or platform deployed thereon; or, the attack simulation system deployment device can also be a processor (such as a central processing unit (CPU)) in the aforementioned electronic device; or, the attack simulation system deployment device can also be a functional module in the aforementioned electronic device for executing the attack simulation system deployment method, etc. The embodiment of the present application does not limit this.

The following is an introduction to the attack simulation system deployment method provided in the embodiment of the present application in conjunction with the accompanying drawings.

Fig. 1 is a schematic diagram of a flow chart of an attack simulation system deployment method provided in an embodiment of the present application. As shown in Fig. 1, the method may include S101 to S104.

S101: Obtain the network topology structure of the target network.

The target network includes multiple subnets.

Optionally, a network management device may be configured in the target network, and the attack simulation system deployment device may obtain the network topology structure of the target network from the network management device.

For example, a network management device in the target network may be installed with simple network management protocol (SNMP) monitoring software, and the network management device may query the configuration and status information of the devices in the target network through the SNMP monitoring software, thereby constructing the network topology of the target network.

For another example, a special network topology discovery tool, such as Network Topology Mapper or PRTG, may be installed in the network management device. The network management device may use these network topology discovery tools to automatically scan the target network, discover the network devices in the target network, and build the network topology structure of the target network.

Exemplarily, Figure 2 is a schematic diagram of a network topology structure provided in an embodiment of the present application. As shown in Figure 2, the target network may include a router, a firewall, a switch 1, a switch 2, a terminal 1, a terminal 2, a terminal 3, and a terminal 4. The switch 1, the terminal 1, and the terminal 2 may constitute a subnet 1 in the target network, and the switch 2, the terminal 3, and the terminal 4 may constitute a subnet 2 in the target network.

S102. Deploy the server side of the attack simulation system at the exit of the target network according to the network topology.

The egress is the physical or logical location where the target network connects to other networks.

For example, please continue to refer to the above FIG. 2. As shown in FIG. 2, terminal 1 and terminal 2 in subnet 1 can transmit data with other networks through switch 1, firewall, and router. Terminal 3 and terminal 4 in subnet 2 can transmit data with other networks through switch 2, firewall, and router. In this case, the router (or the link after the router) can be understood as the exit of the target network.

S103. Determine a full verification subnet based on the network topology.

Among them, the full verification subnet is a subnet of a plurality of subnets, and the route between the exit includes a network security device. Network security equipment refers to a network device used to protect the network from various security threats and attacks. For example, network security equipment may include a firewall, an intrusion prevention system (IPS), a security router, a unified threat management (UTM) device, or a virtual private network (VPN) gateway, etc. The embodiments of the present application do not limit the specific types of network security equipment.

For example, please continue to refer to Figure 2 above. As shown in Figure 2, if the route between subnet 1 and the exit (router) includes a firewall, then subnet 1 can be determined as a full verification subnet. If the route between subnet 2 and the exit (router) includes a firewall, then subnet 2 can also be determined as a full verification subnet.

The specific process of S103 can be referred to the description in the following embodiment, which will not be repeated here.

S104. Deploy a full verification client of the attack simulation system in the full verification subnet.

The full verification client is used to send and receive full verification messages with the server. Full verification messages refer to all types of verification messages.

For example, the verification message may include an authentication message, a connectivity verification message, and a simulation task message, etc. The embodiment of the present application does not limit the specific type of the verification message.

It should be understood that the current attack simulation system needs to deploy a client in each subnet to send and receive full verification messages, which places high performance requirements on the server side. The attack simulation system deployment method provided in the embodiment of the present application can determine the full verification subnet where the route between the target network and the target network exit has a network security device from the target network according to the network topology of the target network, and only deploy the full verification client in the full verification subnet, without the need to deploy the full verification client in the subnet where the route between the target network exit does not have a network security device, thereby reducing the number of clients deployed in the subnet, reducing the number of full verification messages sent and received by the server side, and thus reducing the requirements on the server side.

In addition, the clients deployed by the attack simulation system deployment method provided in the embodiment of the present application are all deployed in the subnet and will not be directly connected to the network security device, so there is no need to occupy additional ports of the network security device.

In some possible embodiments, the attack simulation system deployment device may also deploy a connectivity verification client in a subnet where a network security device does not exist in a route between the target network exits. In this case, FIG3 is another flow diagram of the attack simulation system deployment method provided by an embodiment of the present application. As shown in FIG3, the method may also include S201 to S202.

S201. Determine a connectivity verification subnet according to the network topology.

Among them, the connectivity verification subnet is one of multiple subnets, the route between the exit does not include the network security device, and the route is not entirely the subnet of the switch.

S202. Deploy a connectivity verification client of the attack simulation system in the connectivity verification subnet.

The connectivity verification client is used to send and receive connectivity verification messages to and from the server.

For example, the server may generate a ping command, and the server may send an ICMP Echo request message to a connectivity verification client corresponding to the IP address of a connectivity verification client specified in the ping command. After receiving the ICMO Echo request message, the connectivity verification client may send an ICMP Echo reply message to the server according to the IP address of the server in the ICMO Echo request message. The ICMP Echo request message and the ICMP Echo reply message are understood to be the above-mentioned connectivity verification message.

It should be understood that each client in the current attack simulation system sends and receives full verification messages with the server, and the bandwidth of the target network is occupied relatively large when sending and receiving verification messages, which may affect the normal business of users. The attack simulation system deployment method provided in the embodiment of the present application can also be used to determine that the route between the exit and the network security device does not include the connectivity verification subnet according to the network topology structure, and deploy a connectivity verification client that only needs to send and receive connectivity verification messages with the server in the connectivity verification subnet. The connectivity verification client does not need to send and receive full verification messages with the server, which reduces the amount of data sent and received between the client and the server, and can alleviate the problem of large bandwidth occupancy caused by attack simulation.

The specific process of the above S103 is introduced below.

In some possible embodiments, the full verification subnet can be determined from the nodes in the tree structure after the attack simulation system deployment device converts the network topology of the target network into a tree structure. In this case, FIG. 4 is another flow chart of the attack simulation system deployment method provided in an embodiment of the present application. As shown in FIG. 4, the above S103 can specifically include S1031 to S1033.

S1031. Taking the server end as the root node, traverse the network topology structure to obtain a tree structure corresponding to the network topology structure.

Among them, the tree structure includes a root node, a security node, and a terminal node. The security node corresponds to a network security device in the network topology, and the terminal node corresponds to a terminal device in the network topology. The types of network security devices can refer to those described in the above embodiments and will not be repeated here. The terminal device can be, for example, a desktop computer, a laptop computer, a tablet computer, a storage device, a printing device, an intrusion detection system (IDS) device, or a terminal with a monitoring function (such as an endpoint detection and response (EDR) device). The embodiments of the present application do not limit the specific types of terminal devices.

Optionally, the tree structure may further include routing nodes. The routing nodes include switch routing nodes and router routing nodes. The switch routing nodes correspond to switches in the network topology structure; and the router routing nodes correspond to routers in the network topology structure.

Optionally, the attack simulation system deployment device may specifically traverse the network topology structure using a breadth-first approach.

For example, Fig. 5 is another schematic diagram of a network topology structure provided by an embodiment of the present application. As shown in Fig. 5, the target network may include router 1, firewall 1, IPS1, IPS2, switch 1, switch 2, switch 3, switch 4, switch 5, switch 6, switch 7, switch 8, switch 9, terminal 1, terminal 2, terminal 3, terminal 4, terminal 5, terminal 6, terminal 7, terminal 8, terminal 9, terminal 10, terminal 11, terminal 12, and IDS1.

Terminals 1 and 2 in the same subnet can sequentially transmit data to other networks through switch 1, firewall 1, and router 1 (taking the direction of terminal 1 and terminal 2 sending data to other networks as an example). Terminals 3 and 4 in the same subnet can sequentially transmit data to other networks through switch 2, IPS1, and router 1 (taking the direction of terminal 3 and terminal 4 sending data to other networks as an example). Terminals 5 and 6 in the same subnet can sequentially transmit data to other networks through switch 3 and router 1 (taking the direction of terminal 5 and terminal 6 sending data to other networks as an example). Terminals 7 and 8 in the same subnet can sequentially transmit data to other networks through switch 8, IPS2, switch 7, and router 1 (taking the direction of terminal 7 and terminal 8 sending data to other networks as an example). Terminals 9 and 10 in the same subnet can sequentially transmit data to other networks through switch 6, switch 7, and router 1 (taking the direction of terminal 9 and terminal 10 sending data to other networks as an example). The terminal 12 and IDS1 in the same subnet can transmit data to other networks through the switch 9 and the router 1 in turn (taking the direction in which the terminal 12 and IDS1 send data to other networks as an example).

S1032: If all child nodes of a certain node are terminal nodes, determine the node as a subnet node.

Exemplarily, Figure 6 is a schematic diagram of a tree structure provided by an embodiment of the present application. As shown in Figure 6, based on the network topology structure shown in Figure 5 above, after the network topology structure of the target network is converted into a tree structure, the root node is the server end (shown as an example in Figure 6 using server 1), the child nodes of the root node are the router routing nodes corresponding to router 1 (shown as an example in Figure 6 using R1), and the child nodes of R1 include the switch routing nodes corresponding to switch 3 and switch 9, respectively. Since the child nodes of the switch routing nodes corresponding to switch 3 and switch 9 are all terminal nodes, the switch routing nodes corresponding to switch 3 and switch 9 can be understood as subnet nodes (shown as examples in Figure 6 using Net3 and Net9, respectively).

Similarly, the subnet nodes also include the child node Net2 (the switch routing node corresponding to switch 2) of IPS1 (the security node corresponding to IPS1), the child nodes Net1 (the switch routing node corresponding to switch 1) and Net5 (the switch routing node corresponding to switch 5) of F1 (the security node corresponding to firewall 1), the child node Net6 (the switch routing node corresponding to switch 6) of S7 (the switch routing node corresponding to switch 7), and the child node Net8 (the switch routing node corresponding to switch 8) of IPS2 (the security node corresponding to IPS2).

S1033. Traverse each security node in the tree structure, and perform a first operation on each security node.

Among them, the first operation includes: if the child node of the security node is a subnet node, then the subnet corresponding to the subnet node is determined as a full verification subnet.

Exemplarily, please continue to refer to FIG. 6 . Taking the subnet nodes in FIG. 6 as an example, the attack simulation system deployment device can determine the subnets corresponding to Net1, Net2, Net5, and Net8 as full verification subnets.

Optionally, the first operation may further include: if the child node of the security node is not a subnet node, deleting the child node from the tree structure.

It should be understood that the attack simulation is mainly performed on the subnet. In the attack simulation system deployment method provided in the embodiment of the present application, the attack simulation system deployment device can also delete the child nodes whose parent nodes are security nodes but are not subnet nodes from the tree structure, thereby streamlining the tree structure and avoiding the child nodes that are not subnet nodes from interfering with the deployment.

In some possible embodiments, after performing the first operation to determine the full verification subnet, the attack simulation system deployment device may further streamline the traversed security nodes. In this case, the method may further include the following steps:

Step 1a: When all safety nodes in the tree structure have completed the first operation, the safety nodes are deleted from the tree structure, and the parent node of each safety node child node is set as the parent node of the safety node.

Exemplarily, Figure 7 is a simplified schematic diagram of the security nodes provided by the embodiment of the present application. As shown in Figure 7, based on Figure 6 above, after the attack simulation system deployment device performs the first operation on each security node and determines the subnets corresponding to Net1, Net2, Net5, and Net8 as full verification subnets, it can also delete the parent node (security node F1) of Net1 and Net5, and reset the parent nodes of Net1 and Net5 to the parent node R1 of security node F1, delete the parent node (security node IPS1) of Net2, and reset the parent node of Net2 to the parent node R1 of security node IPS1, delete the parent node (security node IPS2) of Net8, and reset the parent node of Net8 to the parent node S7 of security node IPS2.

In this way, the tree structure after streamlining the security nodes is left with the root node (server1), the child node R1 of the root node (server1), the child nodes Net1, Net2, Net3, Net5, Net9, S7 of R1, and the child nodes Net6 and Net8 of S7.

In some possible embodiments, the attack simulation system deployment device can also merge subnodes under the same node according to different verification attributes. In this case, FIG. 8 is another flow chart of the attack simulation system deployment method provided by the embodiment of the present application. As shown in FIG. 8, the method can also include S301 to S308.

S301. Traverse each security node in the tree structure. If the child node of the security node is a subnet node, set the verification attribute of the subnet node to full verification, and the subnet corresponding to the subnet node is a full verification subnet.

S302: Set the verification attribute of a subnet node whose parent node is a non-safe node and whose routes to the root node are not all switch routing nodes to connectivity verification, and the subnet corresponding to the subnet node is a connectivity verification subnet.

S303: Set the verification attribute of a node whose parent node is a non-safe node and which is not a subnet node to "no verification required".

S304: traverse the parent nodes of all leaf nodes. If the number of child nodes of a parent node is greater than 1, perform the following operations on the parent node:

S305: If the verification attributes of all child nodes are that verification is not required, a child node is randomly retained and the remaining child nodes are deleted.

S306: If the verification attributes of all child nodes are "no verification required" or "connectivity verification", a child node whose verification attribute is "connectivity verification" is randomly retained, and the remaining child nodes are deleted.

S307. If the verification attribute of some child nodes is no verification required or connectivity verification, and the parent node is a switch routing node, delete all child nodes whose verification attributes are no verification required and connectivity verification, and retain the child nodes whose verification attribute is full verification.

S308: If the verification attribute of some child nodes is no verification required or connectivity verification, and the parent node is a router routing node, then delete all child nodes whose verification attribute is no verification required.

For example, Fig. 9 is a schematic diagram of merging provided by an embodiment of the present application. As shown in Fig. 9, based on the above 7, the number of child nodes of the switch routing node S7 corresponding to the switch 7 is two (Net6 and Net8), which is greater than 1.

Since Net6's parent node S7 is not a secure node, and the route from Net6 to server 1 includes switch routing nodes and router routing nodes, not all switch routing nodes, the verification attribute of Net6 can be set to connectivity verification, that is, the subnet corresponding to Net6 is a connectivity verification subnet.

Since the parent node of Net8 (before streamlining) is IPS2, and IPS2 is a security node, the verification attribute of Net8 can be set to full verification, that is, the subnet corresponding to Net8 is a full verification subnet.

In this case, the example of S7 in Figure 9 meets the situation of S307 above, so the attack simulation system deployment device can delete all child nodes whose verification attributes are no need for verification and connectivity verification (that is, delete Net6), and retain the child nodes whose verification attributes are full verification (that is, Net8). In this way, the streamlined tree structure only has the root node server 1; the child node R1 of server1; the child nodes S7, Net5, Net1, Net2, Net3, and Net9 of R1; and the child node Net8 of S7.

In some possible embodiments, the attack simulation system deployment device can further simplify the tree structure for the switch routing node. In this case, the method can also include the following steps:

Step 1b, traverse the parent node of each leaf node in the tree structure. If the parent node is a switch routing node, set the parent node of all child nodes of the switch routing node to the parent node of the switch routing node, and delete the switch routing node from the tree structure. Repeat the process until the tree structure no longer changes.

Exemplarily, FIG10 is a simplified schematic diagram of a switch routing node provided in an embodiment of the present application. As shown in FIG10, based on FIG9 above, the leaf nodes include Net8, Net5, Net1, Net2, Net3, and Net9. Among them, the parent node of Net8 is the switch routing node S7 corresponding to switch 7, and the parent node of S7 is R1. Therefore, the attack simulation system deployment device can set the parent node of Net8 to the parent node R1 of S7, and delete S7.

In this way, the simplified tree diagram only has the root node server1; the child node R1 of server1; and the child nodes Net8, Net5, Net1, Net2, Net3, and Net9 of R1.

In some possible embodiments, after the server and client (full verification client and connectivity verification client) are deployed by the attack simulation system deployment device, the server can integrate the feedback information of each client to obtain the verification result of the attack simulation system for the target network.

The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, it includes hardware structures and/or software modules corresponding to the execution of each function. It should be easy to realize that the technical goals in this field are combined with the units and algorithm steps of each example described in the embodiments disclosed in this article, and the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical goals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

In an exemplary embodiment, the present application also provides an attack simulation system deployment device. FIG11 is a schematic diagram of the composition of the attack simulation system deployment device provided in the present application. As shown in FIG11 , the device includes: an acquisition module 1101 and a processing module 1102.

The acquisition module 1101 is used to acquire the network topology structure of the target network; the target network includes multiple subnets.

Processing module 1102 is used to deploy the server side of the attack simulation system at the exit of the target network according to the network topology; the exit is the physical location or logical location where the target network is connected to other networks; the full verification subnet is determined according to the network topology; the full verification subnet is a subnet of multiple subnets, and the route between the exit and the network security device includes the subnet; the full verification client of the attack simulation system is deployed in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server.

In some possible embodiments, the processing module 1102 is further used to determine a connectivity verification subnet based on a network topology; the connectivity verification subnet is a subnet in which the route between the multiple subnets and the exit does not include a network security device, and the route is not entirely a switch subnet; a connectivity verification client of the attack simulation system is deployed in the connectivity verification subnet; the connectivity verification client is used to send and receive connectivity verification messages to and from the server.

In some other possible embodiments, the processing module 1102 is specifically used to traverse the network topology structure with the server side as the root node to obtain a tree structure corresponding to the network topology structure; wherein the tree structure includes a root node, a security node, and a terminal node; the security node corresponds to a network security device in the network topology structure, and the terminal node corresponds to a terminal device in the network topology structure; if all the child nodes of a node are terminal nodes, the node is determined to be a subnet node; each security node in the tree structure is traversed, and a first operation is performed on each security node; the first operation includes: if the child node of the security node is a subnet node, the subnet corresponding to the subnet node is determined to be a full verification subnet.

In some other possible embodiments, the first operation further includes: if the child node of the security node is not a subnet node, deleting the child node from the tree structure.

In some other possible embodiments, the processing module 1102 is further used to delete the safety node from the tree structure when all safety nodes in the tree structure complete the first operation, and set the parent node of each safety node child node as the parent node of the safety node.

In some other possible embodiments, the tree structure also includes routing nodes; the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology structure; the router routing nodes correspond to routers in the network topology structure; the processing module 1102 is also used to traverse each security node in the tree structure, and if the child node of the security node is a subnet node, the verification attribute of the subnet node is set to full verification, and the subnet corresponding to the subnet node is a full verification subnet; the verification attribute of the subnet node whose parent node is a non-security node and whose routes with the root node are not all switch routing nodes is set to connectivity verification, and the subnet corresponding to the subnet node is a connectivity verification subnet; the verification attribute of the node whose parent node is a non-security node and which is not a subnet node itself is set to no verification required Verification; traverse the parent nodes of all leaf nodes. If the number of child nodes of a parent node is greater than 1, perform the following operations on the parent node: If the verification attributes of all child nodes are no verification required, randomly retain a child node and delete the remaining child nodes; If the verification attributes of all child nodes are no verification required or connectivity verification, randomly retain a child node with a connectivity verification attribute and delete the remaining child nodes; If the verification attributes of some child nodes are no verification required or connectivity verification, and the parent node is a switch routing node, delete all child nodes with verification attributes of no verification and connectivity verification, and retain child nodes with full verification attributes; If the verification attributes of some child nodes are no verification required or connectivity verification, and the parent node is a router routing node, delete all child nodes with verification attributes of no verification required.

In some other possible embodiments, the tree structure also includes routing nodes; the routing nodes include switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology structure; the router routing nodes correspond to routers in the network topology structure; the processing module 1102 is further used to traverse the parent node of each leaf node in the tree structure, and if the parent node is a switch routing node, the parent node of all child nodes of the switch routing node is set to the parent node of the switch routing node, and the switch routing node is deleted from the tree structure, and the processing is cyclically performed until the tree structure no longer changes.

In an exemplary embodiment, the embodiment of the present application further provides an electronic device, which can be applied to the above-mentioned attack simulation system deployment device. Figure 12 is a schematic diagram of the composition of the electronic device provided in the embodiment of the present application. As shown in Figure 12, the electronic device may include: a processor 1201 and a memory 1202; the memory 1202 stores instructions executable by the processor 1201; when the processor 1201 is configured to execute instructions, the electronic device implements the method described in the above-mentioned method embodiment.

In an exemplary embodiment, the embodiment of the present application further provides a computer program product, which, when executed in an electronic device, enables the electronic device to implement the method in the aforementioned method embodiment.

In an exemplary embodiment, the present application also provides a computer-readable storage medium on which computer program instructions are stored; when the computer program instructions are executed by an electronic device, the electronic device implements the method described in the aforementioned embodiment. The computer-readable storage medium may be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using a software program, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer-executable instructions. When loading and executing the computer-executable instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable devices. The computer-executable instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer-executable instructions can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

Although the present application is described herein in conjunction with various embodiments, in the process of implementing the present application for which protection is claimed, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the term "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple components. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

Although the present application has been described in conjunction with specific features and embodiments thereof, it is obvious that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the drawings are merely exemplary illustrations of the present application as defined by the appended claims, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, those skilled in the art may make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (11)

1. A method for deploying an attack simulation system, characterized in that the method comprises: Acquire a network topology structure of a target network; the target network includes a plurality of subnets; According to the network topology, deploying a server end of the attack simulation system at the exit of the target network; the exit is the physical location or logical location where the target network is connected to other networks; Determine a full verification subnet according to the network topology; the full verification subnet is a subnet of the multiple subnets, the route between which and the exit includes a network security device; A full verification client of the attack simulation system is deployed in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server. 2. The method according to claim 1, characterized in that the method further comprises: Determine a connectivity verification subnet according to the network topology; the connectivity verification subnet is a subnet in the multiple subnets, the route between the subnet and the exit does not include the network security device, and the route is not entirely a subnet of switches; A connectivity verification client of the attack simulation system is deployed in the connectivity verification subnet; the connectivity verification client is used to send and receive connectivity verification messages with the server. 3. The method according to claim 1, characterized in that the determining of the full verification subnet according to the network topology structure comprises: Taking the server end as a root node, traversing the network topology structure to obtain a tree structure corresponding to the network topology structure; The tree structure includes the root node, the security node, and the terminal node; the security node corresponds to the network security device in the network topology structure, and the terminal node corresponds to the terminal device in the network topology structure; If all the child nodes of a certain node are the terminal nodes, the node is determined as a subnet node; Traversing each security node in the tree structure, and performing a first operation on each security node; The first operation includes: if the child node of the security node is the subnet node, determining the subnet corresponding to the subnet node as the full verification subnet. 4. The method according to claim 3, characterized in that the first operation further comprises: If the child node of the safety node is not the subnet node, the child node is deleted from the tree structure. 5. The method according to claim 4, characterized in that the method further comprises: When all safety nodes in the tree structure complete the first operation, the safety nodes are deleted from the tree structure, and the parent node of each safety node child node is set as the parent node of the safety node. 6. The method according to any one of claims 3 to 5, characterized in that the tree structure further comprises routing nodes; the routing nodes comprise switch routing nodes and router routing nodes; the switch routing nodes correspond to switches in the network topology structure; the router routing nodes correspond to routers in the network topology structure; the method further comprises: Traversing each security node in the tree structure, if the child node of the security node is a subnet node, setting the verification attribute of the subnet node to full verification, and the subnet corresponding to the subnet node is the full verification subnet; The verification attribute of a subnet node whose parent node is a non-safe node and whose routes to the root node are not all the switch routing nodes is set to connectivity verification, and the subnet corresponding to the subnet node is a connectivity verification subnet; Setting the verification attribute of a node whose parent node is a non-safe node and which is not a subnet node to not requiring verification; Traverse the parent nodes of all leaf nodes. If the number of child nodes of a parent node is greater than 1, perform the following operations on the parent node: If the verification attributes of all child nodes are not required to be verified, a child node is randomly retained and the rest are deleted; If the verification attributes of all child nodes are no verification or connectivity verification, then a child node with the verification attribute of connectivity verification is randomly retained and the remaining child nodes are deleted; If the verification attribute of some child nodes is "no verification required" or "connectivity verification", and the parent node is a switch routing node, delete all child nodes whose verification attributes are "no verification required" and "connectivity verification", and keep the child nodes whose verification attributes are "full verification"; If the verification attributes of some child nodes are "no verification required" or "connectivity verification required", and the parent node is a router routing node, then all child nodes whose verification attributes are "no verification required" will be deleted. 7. The method according to any one of claims 3 to 5, characterized in that the routing node comprises a switch routing node and a router routing node; the switch routing node corresponds to a switch in the network topology structure; the router routing node corresponds to a router in the network topology structure; the method further comprises: Traverse the parent node of each leaf node in the tree structure. If the parent node is a switch routing node, set the parent node of all child nodes of the switch routing node as the parent node of the switch routing node, and delete the switch routing node from the tree structure. Repeat the process until the tree structure does not change any more. 8. An attack simulation system deployment device, characterized in that the device includes an acquisition module and a processing module; The acquisition module is used to acquire the network topology of the target network; the target network includes multiple subnets; The processing module is used to deploy the server side of the attack simulation system at the exit of the target network according to the network topology; the exit is the physical location or logical location where the target network is connected to other networks; determine the full verification subnet according to the network topology; the full verification subnet is a subnet among the multiple subnets, and the route between the exit and the subnet includes a network security device; deploy the full verification client of the attack simulation system in the full verification subnet; the full verification client is used to send and receive full verification messages to and from the server. 9. An electronic device, characterized in that the electronic device comprises: a processor and a memory; The memory stores instructions executable by the processor; When the processor is configured to execute the instructions, the electronic device implements the method according to any one of claims 1 to 7. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises: computer software instructions; When the computer software instructions are executed in an electronic device, the electronic device implements the method according to any one of claims 1 to 7. 11. A computer program product, characterized in that when the computer program product is run in an electronic device, the electronic device is enabled to implement the method according to any one of claims 1 to 7.