Method and device for maximizing attack flow in shooting range environment based on ks detection

Abstract

The invention discloses a method and device for maximizing attack traffic in a shooting range environment based on KS detection. The method counts the response time of each attack traffic and calculates two response times in a specified time window and its nearest sub-time window respectively. distribution, and judge whether it is the same distribution. For the situation that does not belong to the same distribution, first try to increase the attack traffic to determine the direction of traffic adjustment, and then increase or decrease the attack traffic to the target node to make the two response time distributions belong to the same distribution. distribution to maximize attack traffic. Compared with the prior art, the present invention uses the KS detection algorithm to evaluate the load of the target node, and dynamically adjusts the flow rate of the target node, so that the entire shooting range will not cause flow imbalance due to a node overload, or the flow is too small to affect the overall training and verification of the shooting range Effect.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to a method and device for maximizing attack traffic in a shooting range environment based on KS (Kolmogorov-Smirnov) detection. Background technique [0002] The network shooting range is a test platform that simulates the real cyberspace offensive and defensive combat environment through virtualization technology, and can support combat capability research and weapon equipment verification. In order to achieve the above purpose, in the actual training or verification process, it is necessary to apply attack traffic to the target node under study (i.e., the target machine) to simulate various complex scenarios in the real environment. The size of the attack traffic and the robustness of the research results Proportional to sex. [0003] The deployment of the network shooting range is as follows: figure 1 As shown, it is mainly composed of target nodes, attack nodes, co...

AI Technical Summary

Problems solved by technology

[0005] The existing network shooting range traffic attack methods have the following deficiencies: 1. The attack node cannot perceive the load status of the target node, resulting in the traffic of the target node cannot be filled, which affects the final verification effect of the shooting range; 2. When the target node traffic is overloaded, its The response speed will be slower, because the total IO resources are limited, so this type of node will slow down the traffic sending frequency of the attacking node; the lowering of the attacking node's sending frequency will affect its traffic sending efficiency to other attacked nodes in the shooting range, which in turn will cause the entire shooting range The attack traffic is unbalanced, forming an avalanche effect and reducing the experimental effect of the shooting range; 3. The attack node can only send traffic to the target node according to the simple traffic behavior preset in the control node (such as 100 times per minute), and cannot dynamically according to the actual load of the target Adjust the attack traffic; the preset traffic is more empirical data, which is not completely consistent with the actual traffic receiving ability of the target node

Images