TWI726455B - Penetration test case suggestion method and system - Google Patents

Abstract

A penetration test case suggestion system. A network information collection module obtains and stores multiple online attack information from at least one server, and a data preprocessing module filters multiple log files to obtain multiple filters. After the log file, and the data preprocessing module filters the online attack information to obtain multiple filtered online attack information. A data analysis module analyzes the filtered records using a data mining algorithm The relevance of files, obtain and store a log file analysis result, a recommendation module generates based on the log file analysis result, the predetermined attack information, the filtered log files, and the filtered online attack information A recommended test attack information. In addition, the present invention also provides a penetration test case suggestion method.

Description

Penetration test case suggestion method and system

The present invention relates to a penetration testing service, in particular to a penetration testing case suggestion method and system.

With the vigorous development of Internet systems, network security mechanisms have gradually become an important part. Both large and small companies are willing to spend time and money to establish a complete network security mechanism to prevent the company’s own information from being infringed by others. . Factors affecting information security include: unauthorized intrusion into the system, stealing or changing data or even changing the original system settings; data being intercepted or changed during transmission; spreading malicious programs, etc. Faced with various factors that affect information security, website administrators usually adopt a penetration test (Penetration Test).

Penetration testing refers to a technical staff with information security knowledge and experience entrusted by the employer to perform attack tests on the network or the host for the employer’s network devices and hosts, analogous to hackers, in order to discover system vulnerabilities and Propose ways to improve.

However, the testing process of penetration testing consumes manpower and time. At present, it takes about 1 month to execute a standard penetration testing project, including collecting requirements and conducting Testing and report writing, some large projects may take 2 to 3 months, which is very time-consuming and requires a lot of labor costs.

Therefore, the purpose of the present invention is to provide a penetration test case suggestion method that shortens the penetration test time and reduces the labor cost.

Therefore, the penetration test case suggestion method of the present invention is implemented by a penetration test case suggestion system. The penetration test case suggestion system stores multiple predetermined attack information related to multiple attack events and multiple events related to the execution of the webpage. The log file of the penetration test case suggestion method includes one step (A), one step (B), one step (C), one step (D), and one step (E).

In the step (A), the penetration test case suggestion system obtains and stores multiple pieces of online attack information related to multiple attack actions from at least one server corresponding to at least one website that records attack actions via a communication network.

In this step (B), the penetration test case suggests that the system filter these log files to obtain multiple filtered log files. Each filtered log file includes at least multiple files with multiple accesses. Point's access path and multiple syntax parameters.

In this step (C), the penetration test case suggests that the system filter out the online attack information to obtain multiple filtered online attack information.

In this step (D), the penetration test case suggests that the system use data exploration The algorithm analyzes the relevance of the filtered log files, and for each filtered log file, obtains and stores a relevance including the access points included in the filtered log file and multiple related to the filtered log file. The log file analysis result of the relevance of the attack feature grammar of the grammatical parameters included in the log file is removed.

In this step (E), the penetration test case proposal system generates a report that includes the analysis results of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information. The predetermined attack information and the recommended test attack information of at least one of the filtered online attack information.

Another object of the present invention is to provide a penetration test case suggestion system that shortens the penetration test time and reduces labor costs.

Therefore, the penetration test case suggestion system of the present invention includes a storage module, a network information collection module, a data preprocessing module, a data analysis module, and a recommendation module.

The storage module stores a plurality of predetermined attack information related to a plurality of attack events and a plurality of log files related to an event occurring in the execution of the webpage.

The network information collection module is electrically connected to the storage module to obtain and store a plurality of online attack information related to a plurality of attack behaviors from at least one server corresponding to at least one website that records attack behaviors via a communication network The storage module.

The data preprocessing module is electrically connected to the storage module for filtering the log files to obtain multiple filtered log files, and each filtered log file is sent to At least include multiple access paths with multiple access points and multiple grammatical parameters corresponding to the access paths, and filter the online attack information. After filtering, multiple pieces of online attack information are filtered.

The data analysis module is electrically connected to the storage module to analyze the relevance of the filtered log files using data mining algorithms, and for each filtered log file, obtain and store a log file that includes the filtered log file The relevance of the access points included in the file and a plurality of log file analysis results related to the relevance of the attack feature grammar of the grammatical parameters included in the filtered log file are sent to the storage module.

The recommendation module is electrically connected to the storage module to generate a report including the predetermined attack information based on the log file analysis result, the predetermined attack information, the filtered log files, and the filtered online attack information Attack information and recommended test attack information for at least one of the filtered online attack information.

The effect of the present invention is that the data analysis module uses a data mining algorithm to analyze the relevance of the filtered log files, so that the recommendation module recommends the relevance of the recommended test attack information, so as to improve the efficiency of penetration testing .

11: Data input module

12: Storage module

13: Network information collection module

14: Data preprocessing module

15: Data analysis module

16: recommended module

17: Feedback module

100: Communication network

101: server

21~28: Steps

221~225: Steps

241~244: Steps

271~273: Steps

The other features and effects of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: Figure 1 is a block diagram illustrating an implementation of the penetration test case suggestion system of the present invention Example; Figure 2 is a flowchart illustrating an embodiment of the penetration test case suggestion method of the present invention; Figure 3 is a flowchart to assist in explaining the sub-steps of step 23 in Figure 2; Figure 4 is a flowchart to assist in explanatory diagrams 2 sub-steps of step 25; and FIG. 5 is a flowchart to assist in explaining the sub-steps of step 28 in FIG. 2.

Referring to Figure 1, an embodiment of the penetration test case suggestion system of the present invention includes a data input module 11, a storage module 12, a network information collection module 13, a data preprocessing module 14, and a data analysis module. Module 15, a recommendation module 16, and a feedback module 17.

The data input module 11 is electrically connected to the storage module 12 and the feedback module 17.

The storage module 12 is electrically connected to the network information collection module 13, the data preprocessing module 14, the data analysis module 15, the recommendation module 16, and the feedback module 17. The storage module 12 stores Multiple website paths, multiple predetermined attack information related to multiple attack events, and multiple log files related to events that occurred during the execution of the webpage. It is worth noting that in this embodiment, the predetermined attack information and the log files are input by a user through the data input module 11, and each predetermined attack information includes a Date and time, multiple grammatical parameters, a tool used, and a category to which the attack belongs. Each log file includes a user name, a session (Session), a transaction (Transaction), and multiple access points. Multiple access paths, multiple syntax parameters, multiple source addresses corresponding to the access paths, multiple destination addresses corresponding to the access paths, and multiple dates corresponding to the access paths time.

The network information collection module 13 is connected via a communication network 100 to a server 101 corresponding to a website that records attack behaviors. It is worth noting that the communication network 100 is, for example, the Internet. In other embodiments, the network information collection module 13 may also be connected to multiple servers.

Referring to FIGS. 1 and 2, an embodiment of the penetration test case suggestion method of the present invention is implemented by the embodiment of the penetration test case suggestion system of the present invention shown in FIG. 1. The steps of this embodiment of the proposed method of the penetration test case are described in detail below.

In step 21, the network information collection module 13 obtains and stores multiple pieces of online attack information related to multiple attack behaviors to the storage module 12 from the server via the communication network. It is worth noting that the network information collection module 13 uses technologies such as Web Crawler or Application Programming Interface (API) to obtain the online attack information from the server. Each online attack The information includes a data source address, a date and time, multiple grammatical parameters, a screenshot, a type of attack, a repair suggestion, and an event description.

In step 22, the data preprocessing module 14 filters the log files Remove processing to obtain multiple filtered log files. Referring to FIG. 3 in conjunction, step 22 includes sub-steps 221 to 224. The sub-steps included in step 22 are described below.

In step 221, the data preprocessing module 14 removes the log files that meet a predetermined condition from the log files to obtain multiple candidate log files. It is worth noting that, in this embodiment, the predetermined condition is, for example, that the included access path has an access point ending in a multimedia file (such as .jpg, .gif, and .png).

In step 222, the data preprocessing module 14 groups the candidate log files of the same user into the same group according to the user name, communication period, and transaction included in the candidate log files.

In step 223, the data preprocessing module 14 obtains multiple target log files from the candidate log files according to the candidate log files and the website paths. It is worth noting that in this embodiment, there is a match between the access paths of the target log files and the paths of the websites.

In step 224, for each target log file, the data preprocessing module 14 retrieves a plurality of access paths with a plurality of access points, a plurality of grammatical parameters, and a plurality of corresponding to the target log file. Source addresses of the access paths, multiple destination addresses respectively corresponding to the access paths, and multiple dates and times respectively corresponding to the access paths to obtain an intercepted target log file.

In step 225, the data preprocessing module 14 performs encoding conversion on the access paths of the intercepted target log files to obtain the filtered log files. worth it Note that, in this embodiment, the data preprocessing module 14 converts the portion of the access path that belongs to the uniform resource locator (URL) encoding percentage representation into ASCII encoding.

In step 23, the data preprocessing module 14 performs filtering processing on the online attack information to obtain multiple pieces of filtered online attack information. It is worth noting that, in this embodiment, for each online attack information, the data preprocessing module 14 extracts a data source address, a date and time, a plurality of syntax parameters, and a capture from the online attack information. Figure, and a category to which an attack belongs for filtering.

In step 24, the data analysis module 15 uses a data mining algorithm to analyze the relevance of the filtered log files. For each filtered log file, the data analysis module 15 obtains and stores A log file analysis result including the relevance of the access points included in the filtered log file and the relevance of a plurality of attack feature grammars related to the grammatical parameters included in the filtered log file to the storage module 12. Referring to FIG. 4 in conjunction, step 24 includes sub-steps 241 to 244. The sub-steps included in step 24 are described below.

In step 241, for each filtered log file, the data analysis module 15 uses an association-rule-miming-based algorithm according to the access points included in the filtered log file To obtain the relevance of the access points included in the filtered log file. It is worth noting that, in this embodiment, the data analysis module 15 gives each access point a unique code, for example, product gives Code A, car is code B, then /product/car gets code AB. Then, the data analysis module 15 uses the association rule mining algorithm to find the association that meets the requirements of the minimum support (min support) and the minimum confidence (min confidance). For example, since the filtered log files divided into multiple groups are obtained in step 22, the filtered log files of each group correspond to a user. From the filtered log files, for example, 60% of the users' records can be analyzed. Log file access /product (code A) will also access /product/car (code AB).

In step 242, for each filtered log file, the data analysis module 15 uses a sequential-pattern-miming-based algorithm according to the syntax parameters included in the filtered log file. Obtain a plurality of attack characteristic grammars related to the grammatical parameters included in the filtered log file. For example, analyzing the <(a),(c)> string from the log file of the Apache platform, a represents select, and c represents @ @ version, which means that the attack signature syntax of @ @ version will appear after select.

In step 243, the data analysis module 15 uses the association rule exploration algorithm according to the attack characteristic syntax to obtain the relevance of the attack characteristic syntax. For example, after the "../" syntax, the "select,@ @ version" syntax will appear.

In step 244, the data analysis module 15 generates the log file analysis result.

In step 25, the feedback module 17 receives a piece of information related to the predetermined attacks and the information generated by the user using the data input module 11 After filtering the initial score signal of the initial score of the online attack information after filtering, a plurality of initial scores corresponding to the predetermined attack information and the filtered online attack information are generated and stored in the storage module 12. It is worth noting that, in this embodiment, the user refers to the latest version of the OWASP Top Ten Website Security Risk Ranking (OWASP TOP TEN) and CVSS vulnerability risk level for scoring.

In step 26, for each filtered log file, the recommendation module 16 according to the grammatical parameters of the filtered log file, the grammatical parameters of the predetermined attack information, and the grammatical parameters of the filtered online attack information , And at least perform keyword analysis on these initial scores to obtain a pair of attack categories that should be filtered out. For example, those with alert and <script> keywords belong to the A3.XSS category in the grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information. It is worth noting that, in this embodiment, if the recommendation module 16 is unable to perform keyword analysis to find out the attack category corresponding to the filtered log file, it will perform similarity calculation. When the similarity between the grammatical parameters and the grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information is higher than a predetermined threshold (for example, 70%), the attack corresponding to the filtered log file is determined If the category belongs to, and the similarity is not higher than the predetermined threshold, the category of the attack corresponding to the filtered log file is null. It should be noted again that in this embodiment, the recommendation module 16 determines the corresponding grammatical parameters of the predetermined attack information and the grammatical parameters of the filtered online attack information based on the initial scores. Keyword analysis and keyword analysis Priority order for similarity calculation sequence.

In step 27, the recommendation module 16 is based on the analysis result of the log file, the predetermined attack information, the filtered log files, the attack category corresponding to the filtered log files, and the filtered log files. The online attack information generates a recommended test attack information including at least one of the predetermined attack information and the filtered online attack information. With reference to FIG. 5, step 27 includes sub-steps 271 to 273, and the sub-steps included in step 28 are described below.

In step 271, the recommendation module 16 is based on the filtered log files, the attack category corresponding to the filtered log files, and the accesses included in the filtered log files of the log file analysis result. The relevance of points and a screening condition obtain multiple recommended access paths. The filtering conditions are, for example, time interval, website, platform, language type, and the number of required data.

In step 272, the recommendation module 16 performs keyword analysis and similarity calculations on the grammatical parameters corresponding to the recommended access paths, and obtains more information based on the relevance of the attack feature grammars of the log file analysis result. A historical attack feature syntax corresponding to the recommended access paths. For example, the syntax parameter "../../../../etc/passwd" corresponding to a recommended access path can be known from the keyword analysis and similarity calculation that belongs to the "../" type of attack. From the relevance of the attack feature syntax of the log file analysis result, it can be seen that the historical attack feature syntax is "../" and "select @ @ version".

In step 273, the recommendation module 16 is based on the historical attack characteristic words Method, the predetermined attack information, and the filtered online attack information to generate the recommended test attack information. For example, if the historical attack feature syntax is "../" and "select @ @ version", the recommendation module 16 finds out the match from the predetermined attack information and the filtered online attack information. /" and "select @ @ version" information.

In step 28, after the feedback module 17 receives a feedback score signal related to the feedback score of the recommended test attack information generated by the user using the data input module 11, it updates according to the feedback score signal These initial scores. It is worth noting that in this embodiment, the updated initial score is the average of the initial score and the feedback score. In other implementations, it can be adjusted according to the weight, and is not limited to this.

In summary, the penetration test case suggestion method and system of the present invention uses the network information collection module 13 to obtain the online attack information from the server to automatically collect data. The data preprocessing module 14 The predetermined attack information, the log files, and the online attack information are filtered to filter out non-essential content. The data analysis module 15 uses data mining algorithms to analyze the relevance of the filtered log files. The recommendation module 16 recommends the recommended test attack information with relevance to improve the efficiency of penetration testing. In addition, the feedback module 17 updates the initial scores according to the user's feedback, so that the recommendation module 16 improves The efficiency of generating the recommended test attack information can indeed achieve the purpose of the invention.

However, the above are only examples of the present invention. To limit the scope of implementation of the present invention, all simple equivalent changes and modifications made according to the scope of the patent application of the present invention and the content of the patent specification are still within the scope of the patent of the present invention.

11 Data input module 16 Recommended module 12 Storage module 17 Feedback module 13 Network Information Collection Module 100 Communication network 14 Data preprocessing module 101 Server side 15 Data analysis module

Claims (14)

A penetration test case suggestion method implemented by a penetration test case suggestion system. The penetration test case suggestion system stores multiple scheduled attack information related to multiple attack events and multiple log files related to events that occur on the execution webpage The proposed method of the penetration test case includes the following steps: (A) Obtain and store multiple online attack information related to multiple attack behaviors from at least one server corresponding to at least one website that records the attack behavior via a communication network; (B) ) Perform filtering processing on these log files to obtain multiple filtered log files, each filtered log file including at least multiple access paths with multiple access points and multiple grammatical parameters; (C) ) Filter the online attack information to obtain multiple pieces of filtered online attack information; (D) Use a data mining algorithm to analyze the relevance of the filtered log files, and for each filtered record File to obtain and store a log file analysis result including the relevance of the access points included in the filtered log file and the relevance of a plurality of attack feature grammars related to the grammatical parameters included in the filtered log file ; And (E) According to the analysis result of the log file, the scheduled attack information, the filtered log files, and the filtered online attack information, generate a report that includes the scheduled attack information and the filtered ones Recommended test attack information for at least one of the online attack information. For the penetration test case suggestion method described in claim 1, the penetration test case suggestion system also stores multiple website paths, where step (B) includes The following sub-steps: (B-1) from the log files, remove the log files that meet a predetermined condition to obtain multiple candidate log files; (B-2) group the candidate log files into groups; (B-3) ) According to the candidate log files and the website paths, obtain multiple target log files from the candidate log files; (B-4) For each target log file, retrieve the target log files from the target log file Take the path, the grammatical parameters, multiple source addresses corresponding to the access paths, multiple destination addresses corresponding to the access paths, and multiple dates and times corresponding to the access paths, To obtain an intercepted target log file; and (B-5) perform code conversion on the access path of the intercepted target log file to obtain the filtered log file. The penetration test case suggestion method according to claim 1, wherein, for each online attack information in step (C), a data source address, a date and time, a plurality of grammatical parameters, A screenshot and a category of the attack to obtain a filtered online attack information. The penetration test case suggestion method according to claim 1, wherein step (D) includes the following sub-steps: (D-1) for each filtered log file, according to the access included in the filtered log file Point, using an association rule exploration algorithm to obtain the relevance of the access points included in the filtered log file; (D-2) For each filtered log file, according to the filtered log file Grammatical parameters, using a sequential sample exploration algorithm to obtain more An attack feature grammar related to the grammatical parameters included in the filtered log file; (D-3) According to the attack feature grammar, the association rule exploration algorithm is used to obtain the relevance of the attack feature grammar; and (D-4) Generate the analysis result of the log file. The penetration test case suggestion method according to claim 1, wherein step (E) includes the following sub-steps: (E-1) the filtered records based on the filtered log files and the log file analysis results The relevance of the access points included in the file and a filter condition are used to obtain multiple recommended access paths; (E-2) Keyword analysis and similarity calculations are performed on the grammatical parameters corresponding to these recommended access paths, and based on The relevance of the attack feature grammars of the log file analysis result obtains a plurality of historical attack feature grammars corresponding to the recommended access paths; (E-3) According to the historical attack feature grammar and the predetermined attack information, And the online attack information after filtering to generate the recommended test attack information. The penetration test case suggestion method described in claim 1, before step (E), further includes the following steps: (F) for each filtered log file, according to the grammatical parameters of the filtered log file and the predetermined The grammatical parameters of the attack information and the grammatical parameters of the filtered online attack information are at least keyword analyzed to obtain a pair of attack categories that should be filtered out; among them, in step (E), according to the After filtering, the corresponding attack of the log file Click the category to generate the recommended test attack information. The penetration test case suggestion method described in claim 6, before step (F), further includes the following steps: (G) receiving information related to the predetermined attacks and generated by an input operation of a user After the initial scoring signal of the filtered online attack information, a plurality of initial scores corresponding to the predetermined attack information and the filtered online attack information are generated and stored; wherein, in step (F), the The initial score obtains the category of the attack. After step (E), it also includes the following steps: (H) After receiving a feedback score signal related to the recommended test attack information generated by an input operation of the user, according to The feedback score signal updates the initial scores. A penetration test case suggestion system, including: a storage module that stores multiple predetermined attack information related to multiple attack events and multiple log files related to events that occur in the execution of webpages; a network information collection module, The storage module is electrically connected to obtain and store a plurality of online attack information related to a plurality of attack behaviors to the storage module from at least one server corresponding to at least one website that records attack behaviors via a communication network; The preprocessing module is electrically connected to the storage module for filtering the log files to obtain multiple filtered log files. Each filtered log file includes at least multiple files with multiple accesses. The access path of the point and multiple grammatical parameters corresponding to the access path respectively, and the online attack information is filtered out, and the online attack information after multiple filtering is filtered; A data analysis module, electrically connected to the storage module, is used to analyze the relevance of the filtered log files using a data mining algorithm, and for each filtered log file, obtain and store a data including the filtered log file The relevance of the access points included in the log file and the log file analysis results of the relevance of the attack feature grammar related to the syntax parameters included in the filtered log file to the storage module; and a recommendation module , Electrically connected to the storage module, and used to generate a report including the predetermined attack information and information based on the analysis result of the log file, the predetermined attack information, the filtered log files, and the filtered online attack information Recommended test attack information for at least one of the filtered online attack information. The penetration test case suggestion system according to claim 8, wherein the storage module also stores a plurality of website paths, and the data preprocessing module removes the log files that meet a predetermined condition from the log files to obtain Multiple candidate log files, and according to the candidate log files and the website paths, obtain multiple target log files from the candidate log files. For each target log file, the data preprocessing module obtains multiple target log files from the target log file. The log file captures the access paths, the grammatical parameters, multiple source addresses corresponding to the access paths, multiple destination addresses corresponding to the access paths, and multiple corresponding to the The date and time of the access path are used to obtain an intercepted target log file, and the access paths of the intercepted target log file are encoded and converted to obtain the filtered log files. The penetration test case suggestion system according to claim 8, wherein, for each online attack information, the data preprocessing module extracts from the online attack information Take a data source address, a date and time, multiple grammatical parameters, a screenshot, and an attack category to obtain a filtered online attack information. The penetration test case suggestion system according to claim 8, wherein, for each filtered log file, the data analysis module uses an association rule exploration algorithm according to the access points included in the filtered log file , Obtain the relevance of the access points included in the filtered log file, and for each filtered log file, the data analysis module uses a sequential sample based on the syntax parameters included in the filtered log file The exploration algorithm obtains a plurality of attack characteristic grammars related to the grammatical parameters included in the filtered log file, and then according to the attack characteristic grammar, the association rule exploration algorithm is used to obtain the relevance of the attack characteristic grammar , To generate the log analysis result. The penetration test case suggestion system according to claim 8, wherein the recommendation module is based on the filtered log files and the relevance of the access points included in the filtered log files based on the log file analysis results And a filter condition to obtain a plurality of recommended access paths, and the recommendation module performs keyword analysis and similarity calculation on the syntax parameters corresponding to the recommended access paths, and the attack characteristics according to the log file analysis result Based on the correlation of the grammar, multiple historical attack characteristic grammars corresponding to the recommended access paths are obtained, and then the recommended test is generated based on the historical attack characteristic grammar, the predetermined attack information, and the filtered online attack information Attack information. The penetration test case suggestion system according to claim 8, wherein, for each filtered log file, the recommendation module is based on the grammatical parameters of the filtered log file, the grammatical parameters of the predetermined attack information, and the After filtering the grammatical parameters of the online attack information, at least perform keyword analysis to obtain a corresponding response The attack category of the filtered log file is also generated according to the category of the attack corresponding to the filtered log file to generate the recommended test attack information. The penetration test case suggestion system according to claim 13, further comprising a feedback module electrically connected to the data input module, wherein the feedback module is generated by a user using the data input module after receiving After an initial score signal related to the predetermined attack information and the filtered online attack information, a plurality of initial scores corresponding to the predetermined attack information and the filtered online attack information are generated and stored to the storage Module, and after the feedback module receives a feedback score signal related to the recommended test attack information generated by an input operation of the user, the initial scores are updated according to the feedback score signal.

Images