HK40107003A - A method, an apparatus, a device and a storage medium for generating environment snapshots of a networked range - Google Patents

Description

Methods, apparatus, devices, and storage media for generating snapshots of network range environments.

Technical Field

This invention relates to the field of network range technology, and specifically to a method, apparatus, and storage medium for generating snapshots of network range environments.

Background Technology

A cyber range is a platform that comprehensively utilizes virtualization technology to simulate and reproduce network architecture, system equipment, and services in real cyberspace. It can be used for network security testing, scientific research, and other purposes. With the rapid emergence of new technologies, network security issues are becoming increasingly prevalent, especially in the early stages when new technologies are unstable and their resulting network security problems are highly unpredictable. A cyber range is crucial for testing and verifying the network security capabilities of new technologies, capturing their unpredictable states for subsequent in-depth analysis.

The network security testing environment built in network ranges is complex, and the complexity of new technologies further complicates problem-solving. Current technical solutions commonly involve taking snapshots of certain virtual machines, but how to effectively utilize these snapshots and how to take them under specific conditions remain unresolved.

Summary of the Invention

In view of the above problems, the present invention provides a method and apparatus for generating snapshots of network target environments, which solves the existing technical problems.

This invention provides the following technical solutions:

In a first aspect, the present invention provides a method for generating snapshots of a network target environment, the method comprising:

Configure environment snapshot triggering rules for the network test range;

Execute the environment snapshot trigger rules to generate an environment snapshot of the network test range;

Based on the generated environment snapshot, the network target range at a historical moment is reconstructed and the triggering rules for the environment snapshot are re-executed to generate an environment snapshot of the network target range.

In one embodiment, the environment snapshot triggering rule for configuring the network range includes:

Configure how to trigger environment snapshots;

Select an appropriate data source;

Select the data fields and association rules corresponding to the data source;

Matching data collection methods;

Define the scope of the environment snapshot triggered by the rules.

In one embodiment, the triggering method for the environment snapshot includes:

Time-triggered methods and event-triggered methods.

In one embodiment, the data source includes:

Data from the network range testing environment and data from the network range itself;

The data in the network range testing environment includes: testing environment configuration data, testing task description data, resource data required for allocation, and main data constituting the testing environment.

The network test range's own data includes: test environment management data, resource monitoring data, resource scheduling data, and data generated during the data collection and analysis process.

In one embodiment, the matching data acquisition method includes:

Data from the network range testing environment is collected by deploying an agent client and then sending it out, or by sending it out via syslog or SNMP protocol.

Data from the network target range itself is collected using triggers, scripts, or file monitoring methods.

In one embodiment, the generated network range environment snapshot includes an internal environment snapshot and an external environment snapshot:

The internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded.

The external environment snapshot is generated as follows: the database, configuration files and collected data of the network target range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated.

In one embodiment, the step of restoring the network target range at a historical moment based on the generated environment snapshot and re-executing the triggering rules of the environment snapshot, generating an environment snapshot of the network target range, includes:

Select the environment snapshot you want to restore;

Allocate resources according to the environment configuration, call the configuration file of the environment snapshot and the virtual machine image file; build the required network range and load the data files generated by the network range environment;

Based on the restored network range, continue to generate environment snapshots.

Secondly, the present invention provides an apparatus for generating snapshots of a network target environment, the apparatus comprising:

Configuration module: Used to configure the environment snapshot triggering rules for the network range;

Generation module: Used to execute the triggering rules for environment snapshots and generate environment snapshots for the network test range;

Recovery module: Used to restore the network target range at a historical moment based on the generated environment snapshot and re-execute the triggering rules of the environment snapshot to generate an environment snapshot of the network target range.

In one embodiment, the environment snapshot triggering rules for configuring the network target range in the configuration module include:

Configure how to trigger environment snapshots;

Select an appropriate data source;

Select the data fields and association rules corresponding to the data source;

Matching data collection methods;

Define the scope of the environment snapshot triggered by the rules.

In one embodiment, the triggering method for the environment snapshot includes:

Time-triggered methods and event-triggered methods.

In one embodiment, the data source includes:

Data from the network range testing environment and data from the network range itself;

The data in the network range testing environment includes: testing environment configuration data, testing task description data, resource data required for allocation, and main data constituting the testing environment.

The network test range's own data includes: test environment management data, resource monitoring data, resource scheduling data, and data generated during the data collection and analysis process.

In one embodiment, the matching data acquisition method includes:

Data from the network range testing environment is collected by deploying an agent client and then sending it out, or by sending it out via syslog or SNMP protocol.

Data from the network target range itself is collected using triggers, scripts, or file monitoring methods.

In one embodiment, the generated network target environment snapshot in the generation module includes an internal environment snapshot and an external environment snapshot:

The internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded.

The external environment snapshot is generated as follows: the database, configuration files and collected data of the network target range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated.

In one embodiment, the restoration module's method of restoring the network target range at a historical moment based on the generated environment snapshot and re-executing the environment snapshot triggering rules, generating the network target range environment snapshot, includes:

Select the environment snapshot you want to restore;

Allocate resources according to the environment configuration, call the configuration file of the environment snapshot and the virtual machine image file; build the required network range and load the data files generated by the network range environment;

Based on the restored network range, continue to generate environment snapshots.

Thirdly, the present invention provides an electronic device, comprising:

Processor, memory, and interfaces for communication with the gateway;

The memory is used to store programs and data, and the processor calls the programs stored in the memory to execute a method for generating a snapshot of a network range environment provided in any of the first aspects.

Fourthly, the present invention provides a computer-readable storage medium comprising a program, which, when executed by a processor, is used to perform a method for generating a snapshot of a network range environment provided in any of the first aspects.

As described above, this embodiment of the invention generates an environmental snapshot of the network testbed by configuring environmental snapshot triggering rules, executing these rules, and then restoring the network testbed to its historical state based on the generated snapshots. During use, the network testbed is then re-executed based on the generated snapshots to generate more environmental snapshots. By addressing both the environmental snapshot triggering rules and snapshot generation, the invention effectively acquires environmental snapshots of the network testbed and allows for restoration to its historical state, ensuring the smooth operation of testing under complex business applications within the network testbed.

Attached Figure Description

Figure 1 shows a schematic flowchart of a method for generating a snapshot of a network target environment according to an embodiment of the present invention;

Figure 2 shows a schematic diagram of the structure of a network target environment snapshot generation device provided in an embodiment of the present invention;

Figure 3 shows a schematic diagram of the structure of an electronic device according to an embodiment of the present invention.

Detailed Implementation

To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

To address the shortcomings of existing technologies, this invention provides a specific implementation method for generating snapshots of network test environment, as shown in Figure 1. The method specifically includes:

S110: Configure environment snapshot triggering rules for the network test range.

The purpose of this step is to set up the environment snapshot triggering rules for the network target range, mainly to solve how and when the environment snapshot is triggered, how to collect the environment snapshot after it is triggered, and the scope of the collection.

First, configure the environment snapshot triggering method to determine how the environment snapshot is triggered.

Specifically, two triggering methods are proposed in this step:

The first type is time-triggered, such as manually triggering at a specific time; or triggering at a set time; or triggering at a set deadline, etc.

The second method is event-triggered, which involves setting certain conditions and constraints, and automatically triggering the event when the requirements are met.

Then, select the appropriate data source.

Specifically, the data sources include data from the network range testing environment and data from the network range itself; the network range itself refers to the common components or systems involved in building the network range testing environment.

More specifically, the data in the network range testing environment includes: testing environment configuration data, testing task description data, resource allocation data required for request, and main data constituting the testing environment;

The network range's own data includes: test environment management data, resource monitoring data, resource scheduling data, and data generated during the data collection and analysis process.

Among them, the data from the network range itself is applied in multiple network range testing environments, and has global characteristics.

Then, select the data fields and association rules corresponding to the data source.

Specifically, data fields originate from data definitions, which generally have clear requirements and instructions before data integration and storage. These requirements and instructions will not be changed during subsequent data collection and processing. Therefore, data fields, definitions, and content formats have clear or concise descriptions. Data fields for a specific environment or test task can be referenced, and content can be retrieved and queried through interfaces or storage locations. Through the association rule engine, rule matching can be achieved under various conditions such as data source, field, data content, time period, and cumulative number of times.

Next, match the data collection method;

Specifically, data from the network range testing environment is collected by deploying an agent client for collection and then sending it out, or by sending it out via syslog or SNMP protocol.

Data from the network target range itself is collected using triggers, scripts, or file monitoring. Data stored in this way is in a formatted form, such as database files, XML files, and JSON files. The field definitions are relatively clear, enabling fine-grained tracking and analysis.

Finally, define the scope of the environment snapshot triggered by the rule.

Specifically, this could involve taking a global environment snapshot of the current task or test environment, including the task, task scenario description, resource configuration description, core units of the network test range (virtual machines carrying services, virtual machines for client operations, virtual units required for network construction, dedicated/general environment generation units, virtual program execution containers, etc.).

S120: Execute the environment snapshot triggering rules to generate an environment snapshot of the network range.

The purpose of this step is to determine how to obtain a valid environment snapshot after a time-based or event-based environment snapshot is triggered, and to perform environment snapshot processing on the corresponding environment.

Specifically, the generated network target environment snapshots include internal environment snapshots and external environment snapshots.

Internal environment snapshots target components of a specific task environment, such as virtual machines hosting business operations, virtual machines for client operations, virtual units required for network construction, dedicated or general-purpose environment generation units, and virtual program runtime containers. External environment snapshots target external conditions, i.e., the current state of the network test environment.

More specifically, the internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded.

Incremental storage only saves the incremental content compared to the original image (i.e., the data generated after execution can be stored in files or memory), featuring small size and fast snapshot results. Full storage backs up all current content, requiring a complete copy of all content, resulting in large size and long snapshot times.

For example, a network testbed uses KVM virtualization technology, where virtual machines can be used to deploy business applications. Their operating systems are Windows, Linux, or other systems. The machine is started in a specific image state and then used by the business or terminals. Data generated during the process is stored in the system. If the image file system is qcow2 format, incremental backups can be performed, saving only changed data (incremental data stored in the operating system). Simultaneously, full backups can also be performed, saving all current memory data and file data (data written to disk) in its current state. This invention collects information such as program execution, user access, and file access of the virtual machine by deploying an agent client, forming a detailed description of the virtual machine snapshot. Combined with the network testbed platform, it enables the acquisition of virtual machine snapshots under specific conditions and when (i.e., step S110), allowing for effective retrieval and application.

The external environment snapshot is generated as follows: the database, configuration files and collected data of the network range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated.

In practice, MySQL and similar databases do not have the concept of database snapshots. Instead, they use database table cloning/mirroring to back up data stored at the current time. This applies to all data and metadata in the InnoDB storage engine. SQL Server, on the other hand, can implement a function similar to virtual machine incremental snapshots, backing up only newly added data while leaving existing database table content unchanged.

S130: Restore the network target range at a historical moment based on the generated environment snapshot and re-execute the environment snapshot triggering rules to generate an environment snapshot of the network target range.

The purpose of this step is to restore the physical test environment of the network range when problems occur, thereby improving the reliability of the network range. This is thanks to the environment snapshots generated in steps S110 and S120, which can form a unified description of different resources and time periods of the environment snapshot. It allows for the analysis of the changes of a certain content across the timeline, and can also be applied to the retrieval and analysis of the environment snapshot most recent to the current change, or directly select the environment snapshot generated according to the event definition.

Specifically, when restoring an environment snapshot of a network test range:

First, select the environment snapshot you want to restore.

Then, resources are allocated according to the environment configuration, and the configuration file and virtual machine image file of the environment snapshot are called; the required network range is built, and the data files generated by the network range environment are loaded.

Finally, an environment snapshot is generated based on the restored network range.

In this way, when problems occur in the network test range, the above steps can be used to restore/recover the system, thus adapting to complex testing tasks.

As described above, the embodiments of the present invention address both the triggering rules and the generation of environment snapshots, thereby enabling the effective acquisition of environment snapshots in the network test range. Furthermore, the acquired environment snapshots can be used to restore the network test range to its historical state, ensuring the smooth operation of testing under complex business applications in the network test range.

Based on the same inventive concept, this application also provides an apparatus for generating network range environment snapshots, which can be used to implement the method for generating network range environment snapshots described in the above embodiments, as described in the following embodiments. Since the principle of the apparatus for generating network range environment snapshots is similar to that of the method for generating network range environment snapshots, the implementation of the apparatus for generating network range environment snapshots can refer to the method implementation, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and/or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

As shown in Figure 2, the present invention provides a device for generating snapshots of network target environments. In Figure 2, the device includes:

Configuration module 210: Used to configure the environment snapshot triggering rules for the network test range;

Generation module 220: Used to execute the triggering rules for environment snapshots and generate environment snapshots of the network test range;

Recovery module 230: Used to restore the network target range at a historical moment based on the generated environment snapshot and re-execute the triggering rules of the environment snapshot to generate an environment snapshot of the network target range.

In one embodiment of the present invention, the environment snapshot triggering rules for configuring the network target range in the configuration module 210 include:

Configure how to trigger environment snapshots;

Select an appropriate data source;

Select the data fields and association rules corresponding to the data source;

Matching data collection methods;

Define the scope of the environment snapshot triggered by the rules.

In one embodiment of the present invention, the triggering method for environment snapshots includes:

Time-triggered methods and event-triggered methods.

In one embodiment of the present invention, the data sources include:

Data from the network range testing environment and data from the network range itself;

The data for the network range testing environment includes: testing environment configuration data, testing task description data, resource data required for allocation, and main data constituting the testing environment.

The network range's own data includes: management data of the testing environment, resource monitoring data, resource scheduling data, and data generated during the data collection and analysis process.

In one embodiment of the present invention, the matching data acquisition method includes:

Data from the network range testing environment is collected by deploying an agent client and then sending it out, or by sending it out via syslog or SNMP protocol.

Data from the network target range itself is collected using triggers, scripts, or file monitoring methods.

In one embodiment of the present invention, the generated network target environment snapshot in the generation module 220 includes an internal environment snapshot and an external environment snapshot:

The internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded.

The external environment snapshot is generated as follows: the database, configuration files and collected data of the network range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated.

In one embodiment of the present invention, the restoration module 230 restores the network target range at a historical moment based on the generated environment snapshot and re-executes the triggering rules of the environment snapshot. Generating the environment snapshot of the network target range includes:

Select the environment snapshot you want to restore;

Allocate resources according to the environment configuration, call the configuration file of the environment snapshot and the virtual machine image file; build the required network range and load the data files generated by the network range environment;

Based on the restored network range, continue to generate environment snapshots.

The embodiments of this application also provide a specific implementation of an electronic device capable of implementing all the steps in the methods described above. Referring to FIG3, the electronic device 300 specifically includes the following:

Processor 310, memory 320, communication unit 330 and bus 340;

The processor 310, memory 320, and communication unit 330 communicate with each other via bus 340; the communication unit 330 is used to realize information transmission between server-side devices and terminal devices and other related devices.

The processor 310 is used to call the computer program in the memory 320. When the processor executes the computer program, it implements all the steps in the method for generating a snapshot of the network target environment in the above embodiments.

Those skilled in the art will understand that memory can be, but is not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), and Electrically Erasable Programmable Read-Only Memory (EEPROM). The memory stores programs, which are then executed by the processor upon receiving execution instructions. Furthermore, the software programs and modules within the memory may include an operating system, which may include various software components and/or drivers for managing system tasks (e.g., memory management, storage device control, power management), and can communicate with various hardware or software components to provide an operating environment for other software components.

A processor can be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

This application also provides a computer-readable storage medium including a program, which, when executed by a processor, is used to perform the method for generating network range environment snapshots provided in any of the foregoing method embodiments.

Those skilled in the art will understand that all or part of the steps in the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks, and this application does not limit the specific type of media.

The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims (9)

1. A method for generating snapshots of a network target environment, characterized in that the method comprises: Configure environment snapshot triggering rules for the network test range; Execute the environment snapshot trigger rules to generate an environment snapshot of the network test range; Based on the generated environment snapshot, the network target range at a historical moment is reconstructed and the triggering rules for the environment snapshot are re-executed to generate an environment snapshot of the network target range. The generated network target environment snapshots include internal environment snapshots and external environment snapshots: The internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded. The external environment snapshot is generated as follows: the database, configuration files and collected data of the network target range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated. 2. The method for generating a network range environment snapshot as described in claim 1, characterized in that the configuration of the network range environment snapshot triggering rules includes: Configure how to trigger environment snapshots; Select an appropriate data source; Select the data fields and association rules corresponding to the data source; Matching data collection methods; Define the scope of the environment snapshot triggered by the rules. 3. The method for generating a network target environment snapshot as described in claim 2, characterized in that the triggering method for the environment snapshot includes: Time-triggered methods and event-triggered methods. 4. The method for generating a snapshot of a network target environment as described in claim 2, wherein the data sources include: Data from the network range testing environment and data from the network range itself; The data in the network range testing environment includes: testing environment configuration data, testing task description data, resource data required for allocation, and main data constituting the testing environment. The network test range's own data includes: test environment management data, resource monitoring data, resource scheduling data, and data generated during the data collection and analysis process. 5. The method for generating a snapshot of a network target environment as described in claim 3, characterized in that the matching data acquisition method includes: Data from the network range testing environment is collected by deploying an agent client and then sending it out, or by sending it out via syslog or SNMP protocol. Data from the network target range itself is collected using triggers, scripts, or file monitoring methods. 6. The method for generating a network range environment snapshot as described in claim 1, characterized in that, the step of restoring the network range at a historical moment based on the generated environment snapshot and re-executing the environment snapshot triggering rules to generate the network range environment snapshot includes: Select the environment snapshot you want to restore; Allocate resources according to the environment configuration, call the configuration file of the environment snapshot and the virtual machine image file; build the required network range and load the data files generated by the network range environment; Based on the restored network range, continue to generate environment snapshots. 7. An apparatus for generating snapshots of a network target environment, characterized in that the apparatus comprises: Configuration module: Used to configure the environment snapshot triggering rules for the network range; Generation module: Used to execute the triggering rules for environment snapshots and generate environment snapshots for the network test range; Recovery module: Used to restore the network target range at a historical moment based on the generated environment snapshot and re-execute the triggering rules of the environment snapshot to generate an environment snapshot of the network target range; The generated network target environment snapshots include internal environment snapshots and external environment snapshots: The internal environment snapshot is generated as follows: incremental storage is used for virtual machines; full storage is used for containers running virtual programs, and the current container configuration script is saved; for dedicated or general environment generation units, a full snapshot is used or the internal environment snapshot is generated based on the configuration script of the generation unit, and the running time and configuration are recorded. The external environment snapshot is generated as follows: the database, configuration files and collected data of the network target range test environment are backed up and archived to form a new data copy, and an external environment snapshot is generated. 8. An electronic device, characterized in that it comprises: Processor, memory, and interfaces for communication with the gateway; The memory is used to store programs and data, and the processor invokes the programs stored in the memory to execute the method according to any one of claims 1 to 6. 9. A computer-readable storage medium, characterized in that the computer-readable storage medium includes a program, which, when executed by a processor, is used to perform the method according to any one of claims 1 to 6.