TW202117620A - Penetration test case suggesting method and system utilizes data mining algorithm to analyze th relevance among the filtered log files so as to enhance the efficiency of penetration test - Google Patents

Abstract

A penetration test case suggesting system, includes a network information collecting module acquiring and storing a plurality of online attack information from at least one server side; a data preprocessing module filtering a plurality of log files to obtain a plurality of filtered log files and filtering the online attack information to obtain a plurality of filtered online attack information; a data analysis module analyzing relevance among the filtered log files by using a data exploration algorithm to acquire and store a log file analysis result; a recommendation module generating recommendation test attack information according to the log file analysis result, predetermined attack information, the filtered log files, and the filtered online attack information. In addition, this invention further provides a penetration test case suggesting method.

Description

Penetration test case suggestion method and system

The present invention relates to a penetration testing service, in particular to a penetration testing case suggestion method and system.

With the vigorous development of Internet systems, network security mechanisms have gradually become an important part. Both large and small enterprises are willing to spend time and money to establish a complete network security mechanism to prevent the company’s own information from being infringed by others. . Factors affecting information security include: unauthorized intrusion into the system, stealing or changing data or even changing the original system settings; data being intercepted or changed during transmission; spreading malicious programs, etc. Faced with various factors that affect information security, website administrators usually adopt a penetration test (Penetration Test).

Penetration testing refers to a technical staff with information and security knowledge and experience entrusted by the employer to conduct attack tests on the network or the host for the employer’s network device and host, analogous to hackers, in order to discover system vulnerabilities, and Propose ways to improve.

However, the testing process of penetration testing consumes manpower and time. At present, it takes about 1 month to execute a standard penetration testing project, including requirements collection, testing and report writing. Some large projects may take 2 to 3 months. It is very time-consuming and requires a lot of labor costs.

Therefore, the purpose of the present invention is to provide a penetration test case suggestion method that shortens the penetration test time and reduces the labor cost.

Therefore, the penetration test case suggestion method of the present invention is implemented by a penetration test case suggestion system. The penetration test case suggestion system stores multiple predetermined attack information related to multiple attack events and multiple events related to the execution of the webpage. The log file of the penetration test case proposal method includes one step (A), one step (B), one step (C), one step (D), and one step (E).

In this step (A), the penetration test case suggestion system obtains and stores multiple pieces of online attack information related to multiple attack actions from at least one server corresponding to at least one website that records attack actions via a communication network.

In this step (B), the penetration test case suggests that the system filter these log files to obtain multiple filtered log files. Each filtered log file includes at least multiple files with multiple accesses. Point's access path and multiple syntax parameters.

In this step (C), the penetration test case suggests that the system filter out the online attack information to obtain multiple filtered online attack information.

In this step (D), the penetration test case suggestion system analyzes the relevance of the filtered log files using data mining algorithms, and for each filtered log file, obtains and saves a record that includes the filtered log file The relevance of the access points included in the file and the log file analysis results of the relevance of a plurality of offensive feature grammars related to the grammatical parameters included in the filtered log file.

In this step (E), the penetration test case proposal system generates a report that includes the analysis results of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information. The predetermined attack information and the recommended test attack information of at least one of the filtered online attack information.

Another object of the present invention is to provide a penetration test case suggestion system that shortens the penetration test time and reduces labor costs.

Therefore, the penetration test case suggestion system of the present invention includes a storage module, a network information collection module, a data preprocessing module, a data analysis module, and a recommendation module.

The storage module stores a plurality of predetermined attack information related to a plurality of attack events and a plurality of log files related to an event occurring in the execution of the webpage.

The network information collection module is electrically connected to the storage module for obtaining and storing a plurality of online attack information related to a plurality of attack behaviors from at least one server corresponding to at least one website that records attack behaviors via a communication network The storage module.

The data preprocessing module is electrically connected to the storage module for filtering the log files to obtain multiple filtered log files, and each filtered log file includes at least multiple files with multiple storage files. The access path of the point and a plurality of grammatical parameters corresponding to the access path are taken, and the online attack information is filtered out, and the online attack information after multiple filtering is performed.

The data analysis module is electrically connected to the storage module to analyze the relevance of the filtered log files using data mining algorithms, and for each filtered log file, obtain and store a record including the filtered log file The relevance of the access points included in the file and a plurality of log file analysis results related to the relevance of the attack feature grammar of the grammatical parameters included in the filtered log file are sent to the storage module.

The recommendation module is electrically connected to the storage module to generate a report including the predetermined attack information based on the analysis result of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information Attack information and recommended test attack information for at least one of the filtered online attack information.

The effect of the present invention is that the data analysis module uses a data mining algorithm to analyze the relevance of the filtered log files, so that the recommendation module recommends the relevance of the recommended test attack information, so as to improve the efficiency of penetration testing. .

Referring to Figure 1, an embodiment of the penetration test case suggestion system of the present invention includes a data input module 11, a storage module 12, a network information collection module 13, a data preprocessing module 14, and a data analysis module. Module 15, a recommendation module 16, and a feedback module 17.

The data input module 11 is electrically connected to the storage module 12 and the feedback module 17.

The storage module 12 is electrically connected to the network information collection module 13, the data preprocessing module 14, the data analysis module 15, the recommendation module 16, and the feedback module 17. The storage module 12 stores Multiple log files related to multiple attack events and multiple log files related to events that occurred during the execution of the webpage. It is worth noting that in this embodiment, the predetermined attack information and the log files are input by a user through the data input module 11. Each predetermined attack information includes a date and time, a plurality of grammatical parameters, A tool used, and a category of the attack. Each log file includes a user name, a session (Session), a transaction (Transaction), multiple access paths with multiple access points, and multiple syntaxes. Parameters, multiple source addresses corresponding to the access paths, multiple destination addresses corresponding to the access paths, and multiple dates and times corresponding to the access paths.

The network information collection module 13 is connected via a communication network 100 to a server 101 corresponding to a website that records attack behaviors. It is worth noting that the communication network 100 is, for example, the Internet. In other embodiments, the network information collection module 13 may also be connected to multiple servers.

Referring to FIGS. 1 and 2, an embodiment of the penetration test case suggestion method of the present invention is implemented by the embodiment of the penetration test case suggestion system of the present invention shown in FIG. 1. The steps of this embodiment of the proposed method of the penetration test case are described in detail below.

In step 21, the network information collection module 13 obtains and stores multiple pieces of online attack information related to multiple attack behaviors to the storage module 12 from the server via the communication network. It is worth noting that the network information collection module 13 uses technologies such as Web Crawler or Application Programming Interface (API) to obtain the online attack information from the server. Each online attack The information includes a data source address, a date and time, multiple grammatical parameters, a screenshot, a category of an attack, a repair suggestion, and an event description.

In step 22, the data preprocessing module 14 performs filtering processing on the log files to obtain multiple filtered log files. Referring to FIG. 3 in conjunction, step 22 includes sub-steps 221 to 224. The sub-steps included in step 22 are described below.

In step 221, the data preprocessing module 14 removes the log files that meet a predetermined condition from the log files to obtain multiple candidate log files. It is worth noting that, in this embodiment, the predetermined condition is, for example, that the included access path has an access point ending in a multimedia file (such as .jpg, .gif, and .png).

In step 222, the data preprocessing module 14 groups the candidate log files of the same user into the same group according to the user name, communication period, and transaction included in the candidate log files.

In step 223, the data preprocessing module 14 obtains multiple target log files from the candidate log files according to the candidate log files and the website paths. It is worth noting that, in this embodiment, there is a match between the access paths of the target log files and the paths of the websites.

In step 224, for each target log file, the data preprocessing module 14 retrieves from the target log file a plurality of access paths with a plurality of access points, a plurality of syntax parameters, and a plurality of corresponding ones respectively. Source addresses of the access paths, multiple destination addresses corresponding to the access paths, and multiple dates and times respectively corresponding to the access paths to obtain an intercepted target log file.

In step 225, the data preprocessing module 14 performs encoding conversion on the access paths of the intercepted target log files to obtain the filtered log files. It is worth noting that, in this embodiment, the data preprocessing module 14 converts the portion of the access path that belongs to the uniform resource locator (URL) encoding percentage representation into ASCII encoding.

In step 23, the data preprocessing module 14 performs filtering processing on the online attack information to obtain multiple pieces of filtered online attack information. It is worth noting that, in this embodiment, for each online attack information, the data preprocessing module 14 extracts a data source address, a date and time, multiple syntax parameters, and a capture from the online attack information. Figure, and a category to which an attack belongs for filtering processing.

In step 24, the data analysis module 15 uses a data mining algorithm to analyze the relevance of the filtered log files. For each filtered log file, the data analysis module 15 obtains and stores A log file analysis result including the relevance of the access points included in the filtered log file and the relevance of a plurality of attack feature grammars related to the grammatical parameters included in the filtered log file to the storage module 12. With reference to FIG. 4, step 24 includes sub-steps 241 to 244, and the sub-steps included in step 24 are described below.

In step 241, for each filtered log file, the data analysis module 15 uses an association-rule-miming-based algorithm according to the access points included in the filtered log file To obtain the relevance of the access points included in the filtered log file. It is worth noting that in this embodiment, the data analysis module 15 assigns unique codes to each access point. For example, product gives code A, car is code B, and /product/car gets code AB. Then, the data analysis module 15 uses the association rule exploration algorithm to find the association that meets the requirements of the minimum support (min support) and the minimum confidence (min confidance). For example, since the filtered log files divided into multiple groups are obtained in step 22, the filtered log files of each group correspond to a user. From the filtered log files, for example, 60% of the users’ records can be analyzed. Log file access /product (code A) will also access /product/car (code AB).

In step 242, for each filtered log file, the data analysis module 15 uses a sequential-pattern-miming-based algorithm according to the syntax parameters included in the filtered log file. Obtain a plurality of attack characteristic grammars related to the grammatical parameters included in the filtered log file. For example, analyzing the log files of the apache platform> (a), (c)> string, a represents select, and c represents @@version, which means that the attack signature syntax of @@version will appear after select.

In step 243, the data analysis module 15 uses the association rule exploration algorithm according to the attack characteristic syntax to obtain the relevance of the attack characteristic syntax. For example, after the "../" syntax, the "select, @@version" syntax will appear.

In step 244, the data analysis module 15 generates the log file analysis result.

In step 25, the feedback module 17 receives an initial score related to the predetermined attack information and the filtered online attack information generated by the user using the data input module 11 After the scoring signal, a plurality of initial scores corresponding to the predetermined attack information and the filtered online attack information are generated and stored in the storage module 12. It is worth noting that, in this embodiment, the user refers to the latest version of the OWASP Top Ten Website Security Risk Ranking (OWASP TOP TEN) and CVSS vulnerability risk level for scoring.

In step 26, for each filtered log file, the recommendation module 16 according to the grammatical parameters of the filtered log file, the grammatical parameters of the predetermined attack information, and the grammatical parameters of the filtered online attack information , And at least perform keyword analysis on these initial scores to obtain a pair of attack categories that should be filtered out. For example, those with alert and >script> keywords belong to the A3. XSS category in the grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information. It is worth noting that, in this embodiment, if the recommendation module 16 is unable to perform keyword analysis to find out the attack category corresponding to the filtered log file, it will perform similarity calculation. When the similarity between the grammatical parameters and the grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information is higher than a predetermined threshold (for example, 70%), the attack corresponding to the filtered log is determined The category, when the similarity is not higher than the predetermined threshold, the category of the attack corresponding to the filtered log file is null. It should be noted again that in this embodiment, the recommendation module 16 determines the corresponding grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information according to the initial scores. Keyword analysis and keyword analysis The priority order of similarity calculation.

In step 27, the recommendation module 16 is based on the analysis result of the log file, the predetermined attack information, the filtered log files, the attack category corresponding to the filtered log files, and the filtered log files. The online attack information generates a recommended test attack information including at least one of the predetermined attack information and the filtered online attack information. Referring to FIG. 5 in conjunction, step 27 includes sub-steps 271 to 273. The sub-steps included in step 28 are described below.

In step 271, the recommendation module 16 is based on the filtered log files, the attack category corresponding to the filtered log files, and the access included in the filtered log files of the log file analysis result. The relevance of points and a screening condition can obtain multiple recommended access paths. The filtering conditions are, for example, time interval, website, platform, language type, and the number of required data.

In step 272, the recommendation module 16 performs keyword analysis and similarity calculation on the grammatical parameters corresponding to the recommended access paths, and obtains more information based on the relevance of the attack feature grammars of the log file analysis result. A historical attack feature syntax corresponding to the recommended access paths. For example, the syntax parameter "../../../../etc/passwd" corresponding to a recommended access path can be found to belong to the "../" type of attack through keyword analysis and similarity calculation. From the relevance of the attack feature syntax from the analysis result of the log file, it can be seen that the historical attack feature syntax is "../" and "select @@version".

In step 273, the recommendation module 16 generates the recommended test attack information according to the historical attack feature syntax, the predetermined attack information, and the filtered online attack information. For example, if the historical attack feature syntax is "../" and "select @@version", then the recommendation module 16 finds the match ".." from the predetermined attack information and the filtered online attack information. /" and "select @@version" information.

In step 28, after the feedback module 17 receives a feedback score signal related to the feedback score of the recommended test attack information generated by the user using the data input module 11, it updates according to the feedback score signal These initial scores. It is worth noting that in this embodiment, the updated initial score is the average of the initial score and the feedback score. In other implementations, it can be adjusted according to the weight, and is not limited to this.

In summary, the penetration test case suggestion method and system of the present invention uses the network information collection module 13 to obtain the online attack information from the server to automatically collect data. The data preprocessing module 14 The predetermined attack information, the log files, and the online attack information are filtered to filter out non-necessary content. The data analysis module 15 uses a data mining algorithm to analyze the relevance of the filtered log files. The recommendation module 16 is made to recommend the relevant recommendation test attack information to improve the efficiency of the penetration test. In addition, the feedback module 17 updates the initial scores according to the user's feedback, so that the recommendation module 16 improves The efficiency of generating the recommended test attack information can indeed achieve the purpose of the invention.

However, the foregoing are only examples of the present invention. When the scope of implementation of the present invention cannot be limited by this, all simple equivalent changes and modifications made in accordance with the scope of the patent application of the present invention and the content of the patent specification still belong to Within the scope covered by the patent of the present invention.

11: Data input module 12: Storage module 13: Network information collection module 14: Data preprocessing module 15: Data analysis module 16: recommended module 17: Feedback module 100: Communication network 101: server 21~28: Steps 221~225: Steps 241~244: Steps 271~273: Steps

Other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating an embodiment of the penetration test case suggestion system of the present invention; Figure 2 is a flowchart illustrating an embodiment of the penetration test case suggestion method of the present invention; Figure 3 is a flowchart to assist in explaining the sub-steps of step 23 in Figure 2; Figure 4 is a flowchart to assist in explaining the sub-steps of step 25 in Figure 2; and Fig. 5 is a flowchart to assist in explaining the sub-steps of step 28 in Fig. 2.

11: Data input module

12: Storage module

13: Network information collection module

14: Data preprocessing module

15: Data analysis module

16: recommended module

17: Feedback module

100: Communication network

101: server

Claims (14)

A penetration test case suggestion method implemented by a penetration test case suggestion system. The penetration test case suggestion system stores multiple scheduled attack information related to multiple attack events and multiple log files related to events that occur on the execution webpage , The suggested method for this penetration test case includes the following steps: (A) Obtain and store multiple pieces of online attack information related to multiple attacks from at least one server corresponding to at least one website that records attack behaviors via a communication network; (B) Perform filtering processing on these log files to obtain multiple filtered log files, each filtered log file including at least multiple access paths with multiple access points and multiple grammatical parameters; (C) Filter the online attack information to obtain multiple filtered online attack information; (D) Use data mining algorithms to analyze the relevance of the filtered log files, and for each filtered log file, obtain and store a relevance including the access points included in the filtered log file and A plurality of log file analysis results related to the relevance of the attack feature grammar of the grammatical parameters included in the filtered log file; and (E) Based on the analysis result of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information, generate a report that includes the predetermined attack information and the filtered online attacks Recommended test attack information for at least one of the information. For the penetration test case suggestion method described in claim 1, the penetration test case suggestion system also stores multiple website paths, wherein step (B) includes the following sub-steps: (B-1) From these log files, remove log files that meet a predetermined condition to obtain multiple candidate log files; (B-2) Group these candidate records into groups; (B-3) According to the candidate log files and the website paths, obtain multiple target log files from the candidate log files; (B-4) For each target log file, retrieve the access paths, the syntax parameters, multiple source addresses corresponding to the access paths, and multiple source addresses corresponding to the target log files from the target log file. The destination address of the access path, and multiple dates and times corresponding to the access paths respectively, to obtain an intercepted target log file; and (B-5) Transcoding the access paths of the intercepted target log files to obtain the filtered log files. The penetration test case suggestion method according to claim 1, wherein, for each online attack information in step (C), a data source address, a date and time, a plurality of grammatical parameters, A screenshot and a category of the attack to obtain a filtered online attack information. The penetration test case suggestion method as described in claim 1, wherein step (D) includes the following sub-steps: (D-1) For each filtered log file, based on the access points included in the filtered log file, use an association rule mining algorithm to obtain the access points included in the filtered log file Relevance (D-2) For each filtered log file, according to the grammatical parameters included in the filtered log file, a sequential sample exploration algorithm is used to obtain multiple grammars related to the filtered log file The attack signature syntax of the parameters; (D-3) According to the attack characteristic grammar, use the association rule exploration algorithm to obtain the relevance of the attack characteristic grammar; and (D-4) Generate the log file analysis result. The penetration test case suggestion method as described in claim 1, wherein step (E) includes the following sub-steps: (E-1) Obtain multiple recommended access paths based on the filtered log files, the relevance of the access points included in the filtered log files of the log file analysis result and a filter condition; (E-2) Perform keyword analysis and similarity calculations on the grammatical parameters corresponding to the recommended access paths, and obtain multiple corresponding to the recommended memory according to the relevance of the attack feature grammar of the log file analysis result Take the historical attack characteristic grammar of the route; (E-3) According to the historical attack characteristic syntax, the predetermined attack information, and the filtered online attack information, the recommended test attack information is generated. The proposed method of penetration testing individual cases as described in claim 1, before step (E), also includes the following steps: (F) For each filtered log file, perform at least keyword analysis based on the grammatical parameters of the filtered log file, the grammatical parameters of the predetermined attack information, and the grammatical parameters of the filtered online attack information, Obtain a pair of attack categories that should be filtered out; Wherein, in step (E), the recommended test attack information is also generated according to the category of the attack corresponding to the filtered log files. The proposed method of penetration test case as described in claim 6, before step (F), also includes the following steps: (G) After receiving an initial scoring signal related to the predetermined attack information and the filtered online attack information generated by an input operation of a user, generate and store multiple corresponding predetermined attacks Information and the initial score of the filtered online attack information; Wherein, in step (F), the category of the attack is also obtained according to the initial scores, and after step (E), the following steps are further included: (H) After receiving a feedback score signal related to the recommended test attack information generated by an input operation of the user, update the initial scores according to the feedback score signal. A penetration test case suggestion system, including: A storage module that stores multiple predetermined attack information related to multiple attack events and multiple log files related to events that occurred during the execution of the webpage; A network information collection module, electrically connected to the storage module, for obtaining and storing multiple pieces of online attack information related to multiple attack actions from at least one server corresponding to at least one website that records attack actions via a communication network To the storage module; A data preprocessing module, electrically connected to the storage module, for filtering the log files to obtain multiple filtered log files. Each filtered log file includes at least multiple The access path of the access point and a plurality of grammatical parameters corresponding to the access paths, and the online attack information is filtered out, and the online attack information after multiple filtering is performed; A data analysis module, electrically connected to the storage module, is used to analyze the relevance of the filtered log files using a data mining algorithm, and for each filtered log file, obtain and store a data including the filtered log file The relevance of the access points included in the log file and a plurality of log file analysis results related to the relevance of the attack feature grammar of the grammatical parameters included in the filtered log file to the storage module; and A recommended module, which is electrically connected to the storage module, is used to generate a report including the analysis results of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information The predetermined attack information and the recommended test attack information of at least one of the filtered online attack information. The penetration test case suggestion system according to claim 8, wherein the data preprocessing module removes the log files that meet a predetermined condition from the log files to obtain multiple candidate log files, and based on the candidate log files Log files and the website paths. From the candidate log files, multiple target log files are obtained. For each target log file, the data preprocessing module retrieves the access paths, the Equal grammatical parameters, multiple source addresses corresponding to the access paths, multiple destination addresses corresponding to the access paths, and multiple dates and times corresponding to the access paths to obtain an interception After the target log file, and the access path of the intercepted target log file is encoded and converted to obtain the filtered log file. The penetration test case suggestion system according to claim 8, wherein, for each online attack information, the data preprocessing module extracts a data source address, a date and time, a plurality of grammatical parameters, from the online attack information A screenshot and a category of the attack to obtain a filtered online attack information. The penetration test case suggestion system according to claim 8, wherein, for each filtered log file, the data analysis module uses an association rule exploration algorithm according to the access points included in the filtered log file , Obtain the relevance of the access points included in the filtered log file, and for each filtered log file, the data analysis module uses a sequential sample based on the syntax parameters included in the filtered log file The exploration algorithm obtains a plurality of attack characteristic grammars related to the grammatical parameters included in the filtered log file, and then according to the attack characteristic grammar, the association rule exploration algorithm is used to obtain the relevance of the attack characteristic grammar , To generate the log analysis result. The penetration test case suggestion system according to claim 8, wherein the recommendation module is based on the filtered log files and the relevance of the access points included in the filtered log files based on the log file analysis results And a filter condition to obtain a plurality of recommended access paths, and the recommendation module performs keyword analysis and similarity calculation on the syntax parameters corresponding to the recommended access paths, and the attack characteristics according to the log file analysis result Based on the correlation of the grammar, a plurality of historical attack characteristic grammars corresponding to the recommended access paths are obtained, and the recommended test is generated based on the historical attack characteristic grammar, the predetermined attack information, and the filtered online attack information Attack information. The penetration test case suggestion system according to claim 8, wherein, for each filtered log file, the recommendation module is based on the grammatical parameters of the filtered log file, the grammatical parameters of the predetermined attack information, and the After filtering the grammatical parameters of the online attack information, perform at least keyword analysis to obtain a pair of attack categories that should be filtered out. The recommended test attack information is also generated according to the attack category corresponding to the filtered log files. . The penetration test case suggestion system according to claim 13, wherein the feedback module receives a piece of information related to the predetermined attack and the filtered information generated by the user using the data input module After the initial score signal of the online attack information, a plurality of initial scores corresponding to the predetermined attack information and the filtered online attack information are generated and stored in the storage module, and the feedback module is received by the user After an input operation generates a feedback score signal related to the recommended test attack information, the initial scores are updated according to the feedback score signal.

Images