CN112885175B

CN112885175B - Information security question generation method and device, electronic device and storage medium

Info

Publication number: CN112885175B
Application number: CN202110054026.4A
Authority: CN
Inventors: 丁莹; 冯勇伟
Original assignee: Hangzhou Anheng Information Security Technology Co Ltd
Current assignee: Hangzhou Anheng Information Security Technology Co Ltd
Priority date: 2021-01-15
Filing date: 2021-01-15
Publication date: 2022-10-21
Anticipated expiration: 2041-01-15
Also published as: CN112885175A

Abstract

The application relates to an information security question generation method, an information security question generation device, an electronic device and a storage medium, wherein the information security question generation method comprises the following steps: receiving a request for generating information security competition questions, wherein the request carries competition question requirement information and competitor information; extracting subject title information from the subject demand information, wherein the subject title information comprises subject meaning direction information and preset Flag information, and the subject meaning direction information comprises subject categories and subject items; generating a plurality of target Flag information according to the competitor information and the preset Flag information; and acquiring configuration items corresponding to the theme direction information from a preset resource library, and processing the configuration items and the target Flag information according to preset configuration rules to generate a plurality of information security themes. Through the application, the problem of low efficiency of the problem setting of the information security competition questions in the related technology is solved, the competition questions can be generated quickly according to competition requirements, and the question setting and checking time is saved.

Description

Information security question generation method and device, electronic device and storage medium

Technical Field

The present application relates to the field of information security technologies, and in particular, to a method and an apparatus for generating an information security question, an electronic apparatus, and a storage medium.

Background

With the rapid development of internet technology, the network brings convenience and high efficiency to life generation, and meanwhile, the information security is challenged, and the information security is more and more emphasized. The network security is enhanced, risks brought by the network can be better avoided, the network security is enhanced, professional talents with network security skills are needed, the information security attack and defense competition simulates an confrontation scene in a real network environment, and the method is a mode for efficiently cultivating and selecting related talents with the network security skills.

In the prior art, various information security attacks and defences are organized and have a good job. In the related technology, the problems of the information security attack and defense competition are various, the classification method is not uniform, and the leak utilization ideas are different; in addition, the contest questions of the information security attack and defense contest in the related technology are acquired by adopting a collection contest question mode and then are acquired through an expert question examination mode. Therefore, in the related art, the problems of the information security attack and defense competition are not balanced, the problem solving time is difficult to control, and the problem setting and examination takes a lot of time for repeated labor. Meanwhile, in the related technology, the information security confrontation contests of the two parties of red and blue are related, the contestants have the same contest questions, and the problems of the competition for the generation and the off-line communication question solving method and Flag are easy to occur.

At present, an effective solution is not provided aiming at the problem of low efficiency of the problem of the information security competition in the related technology.

Disclosure of Invention

The embodiment of the application provides an information security question generation method, an information security question generation device, an electronic device and a storage medium, and aims to at least solve the problem of low efficiency of information security question generation in the related art.

In a first aspect, an embodiment of the present application provides an information security question generating method, including:

receiving a request for generating an information security competition question, wherein the request carries competition question requirement information and competitor information;

extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items;

generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition questions and is used for verifying whether the answer is successful;

and acquiring a configuration item corresponding to the theme direction information from a preset resource library, and processing the configuration item and the target Flag information according to a preset configuration rule to generate a plurality of information security themes, wherein the preset configuration rule is determined according to the theme categories corresponding to the information security themes.

In some embodiments, the information of the participants includes a first number of participants, and the generating of the plurality of target Flag information according to the information of the participants and the preset Flag information includes:

randomly generating a plurality of random numbers corresponding to the first contestant number;

and encrypting the preset Flag information and the plurality of random numbers to generate a plurality of target Flag information, wherein the encryption comprises an exclusive-or operation.

In some embodiments, obtaining the configuration item corresponding to the topic intention information in the preset resource library includes:

extracting the game question categories and game question items from the game question intention information;

selecting a corresponding configuration resource set from the preset resource library according to the game question category, wherein the configuration resource set comprises a plurality of preset candidate configuration items, and the candidate configuration items are used for representing the operation executed when the program corresponding to the information security game question runs;

matching the candidate configuration items corresponding to the game question items in the configuration resource set, and determining the candidate configuration items corresponding to the game question items as configuration items corresponding to the game question intention information.

In some embodiments, the event category includes an encryption category, the configuration item includes a preset encryption algorithm, and processing the configuration item and the plurality of target Flag messages according to a preset configuration rule to generate the plurality of information security events includes:

selecting a first configuration rule corresponding to the encryption class from the preset configuration rules, wherein the first configuration rule comprises: encrypting and generating an application program APK file;

encrypting the target Flag information by adopting the preset encryption algorithm to generate a plurality of encrypted ciphertexts;

acquiring an application program code of a production text, generating a plurality of application program APK files by the application program code through a preset compiler, and determining that the information security game question comprises the application program APK files, wherein the text comprises the encrypted ciphertext to be decrypted and the preset encryption algorithm.

In some embodiments, the question categories include an encryption category, the configuration item includes a preset encryption algorithm, and processing the configuration item and the plurality of pieces of target Flag information according to a preset configuration rule to generate the plurality of information security questions includes:

In some embodiments, after processing the configuration item and the plurality of pieces of target Flag information according to a preset configuration rule and generating a plurality of information security questions, the method further includes:

detecting at least a plurality of information security questions to obtain a detection result;

under the condition that a plurality of information security questions are detected, determining that the generation of the information security questions is successful;

and under the condition that a plurality of information security questions are not detected, determining that the generation of the information security questions fails, and generating corresponding prompt information.

In some embodiments, the competitor information includes a second competitor number, the configuration item and the plurality of target Flag information are processed according to a preset configuration rule, and after a plurality of information security competition questions are generated, the method further includes:

acquiring a difficulty coefficient corresponding to the configuration item, and determining the difficulty of each information security question according to the difficulty coefficient;

acquiring the second contestant number corresponding to each group of contestants, and determining the preset total difficulty amount of the contestants according to the second contestant number;

and determining the number of the information safety questions corresponding to each group of competitors based on the total difficulty amount of the questions and the difficulty of the information safety questions.

In a second aspect, an embodiment of the present application provides an information security question generating device, including:

the system comprises a receiving module, a sending module and a receiving module, wherein the receiving module is used for receiving a request for generating an information security competition question, and the request carries competition question requirement information and competitor information;

the extraction module is used for extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items;

the generating module is used for generating a plurality of target Flag messages according to the competitor messages and the preset Flag messages, wherein the target Flag messages are targets obtained after the information security competition questions are solved;

and the processing module is used for acquiring a configuration item corresponding to the theme direction information from a preset resource library, processing the configuration item and the plurality of target Flag information according to a preset configuration rule and generating a plurality of information security themes, wherein the preset configuration rule is determined according to the theme categories corresponding to the information security themes.

In a third aspect, an embodiment of the present application provides an electronic apparatus, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, where the processor implements the method for generating information security contest questions according to the first aspect when executing the computer program.

In a fourth aspect, an embodiment of the present application provides a storage medium, on which a computer program is stored, where the computer program, when executed by a processor, implements the information security game question generating method according to the first aspect.

Compared with the related art, the information security question generation method, the information security question generation device, the electronic device and the storage medium provided by the embodiment of the application receive a request for generating the information security question, wherein the request carries the question requirement information and the information of the competitors; extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items; generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition questions and is used for verifying whether the answer is successful; the method comprises the steps of obtaining configuration items corresponding to theme direction information in a preset resource library, processing the configuration items and a plurality of target Flag information according to preset configuration rules, and generating a plurality of information security game questions, wherein the preset configuration rules are determined according to the game question categories corresponding to the information security game questions, so that the problem of low efficiency of setting the information security game questions in the related technology is solved, the game questions can be quickly generated according to game requirements, and the question setting and checking time is saved.

The details of one or more embodiments of the application are set forth in the accompanying drawings and the description below to provide a more thorough understanding of the application.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:

fig. 1 is a block diagram of a hardware structure of a terminal of an information security topic generation method according to an embodiment of the present application;

FIG. 2 is a flow chart of a method for generating information security questions according to an embodiment of the present application;

FIG. 3 is another flow diagram of a method for generating information security questions in accordance with an embodiment of the present application;

FIG. 4 is a block diagram of a default repository in the present application;

FIG. 5 is a flow chart of a method for generating information security questions in accordance with a preferred embodiment of the present application;

fig. 6 is a block diagram showing the configuration of an information security question generation device according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be described and illustrated below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments provided in the present application without any inventive step are within the scope of protection of the present application. Moreover, it should be appreciated that in the development of any such actual implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developers' specific goals, such as compliance with system-related and business-related constraints, which may vary from one implementation to another.

Reference in the specification to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the specification. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Those of ordinary skill in the art will explicitly and implicitly appreciate that the embodiments described herein may be combined with other embodiments without conflict.

Unless defined otherwise, technical or scientific terms referred to herein shall have the ordinary meaning as understood by those of ordinary skill in the art to which this application belongs. Reference to "a," "an," "the," and similar words throughout this application are not to be construed as limiting in number, and may refer to the singular or the plural. The present application is directed to the use of the terms "including," "comprising," "having," and any variations thereof, which are intended to cover non-exclusive inclusions; for example, a process, method, system, article, or apparatus that comprises a list of steps or modules (elements) is not limited to only those steps or elements but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus. Reference to "connected," "coupled," and the like in this application is not intended to be limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. Reference herein to "a plurality" means greater than or equal to two. "and/or" describes an association relationship of associated objects, meaning that three relationships may exist, for example, "A and/or B" may mean: a exists alone, A and B exist simultaneously, and B exists alone. Reference herein to the terms "first," "second," "third," and the like, are merely to distinguish similar objects and do not denote a particular ordering for the objects.

Various technologies described in the present application may be used for topic generation for information security attack and defense competitions, and ubiquitous CTF competitions.

The embodiment of the method for generating the information security game questions provided by the embodiment can be executed in a terminal, a computer or a similar computing device. Taking the operation on the terminal as an example, fig. 1 is a hardware structure block diagram of the terminal of the information security problem generation method according to the embodiment of the present invention. As shown in fig. 1, the terminal 10 may include one or more processors 102 (only one is shown in fig. 1) (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data, and optionally may also include a transmission device 106 for communication functions and an input-output device 108. It will be understood by those skilled in the art that the structure shown in fig. 1 is only an illustration and is not intended to limit the structure of the terminal. For example, the terminal 10 may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.

The memory 104 may be used to store computer programs, for example, software programs and modules of application software, such as a computer program corresponding to the information security game question generating method in the embodiment of the present invention, and the processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, so as to implement the above-mentioned method. The memory 104 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory located remotely from the processor 102, which may be connected to the terminal 10 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the terminal 10. In one example, the transmission device 106 includes a Network adapter (NIC) that can be connected to other Network devices through a base station to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is used to communicate with the internet in a wireless manner.

The embodiment provides a method for generating an information security question, fig. 2 is a flowchart of the method for generating an information security question according to the embodiment of the present application, and as shown in fig. 2, the flowchart includes the following steps:

step S201, a request for generating an information security competition question is received, wherein the request carries competition question requirement information and competitor information.

In this embodiment, the information security question generation method of this embodiment is performed on an automatic question generation platform, where a request received by the automatic question generation platform is that a platform manager selects a corresponding configuration resource from a resource library of the automatic question generation platform according to a type of a question desired to be examined, and then generates the request by combining information of a competitor, that is, before the automatic question generation platform receives the request, the platform manager needs to perform resource selection operation on the automatic question generation platform, and after the platform manager clicks a key to generate an information security question operation instruction, it indicates that the automatic question generation platform receives the request for generating the information security question.

In this embodiment, the information of the participants at least includes the number of participants, and of course, the number of participants for entry participation and the number of parameters for actual participation may be relative or different.

Step S202, extracting the subject title information from the subject requirement information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items.

In this embodiment, the information of the theme meaning refers to a direction to be assessed in the information security attack and defense game, and also refers to which type of game theme the generated game theme belongs; the topic direction information at least includes a topic category and topic items, and the topic category specifically refers to the topic category of the generated topic, for example: web class, mobile application class, IOT class, reverse class, binary class, encryption class and operating system class; the contest item refers to the target item of examination, for example: sensitive information acquisition based on a Bluetooth protocol, authority improvement based on an operating system of Linux6.04, and decryption based on a weak encryption algorithm of android, wherein the encryption algorithm adopts AES.

In this embodiment, the preset Flag information may be generated by a platform administrator through self-definition, or may be selected from an initial Flag library corresponding to a resource library of an automated question issuing platform; meanwhile, flag refers to a character string which is required to be uploaded and is proved by a competitor to be successful in solving the problem, and can also be understood as a competition answer of an information security attack and defense competition; in the process of solving the information security question, vulnerability, protection software, application programs, encryption algorithms, encryption keys, website frames, operating system image files, simulators, environment configuration instructions, certificates and the like corresponding to configuration items provided in a resource library are required to be adopted to generate corresponding attack means to obtain the hidden flag.

Step S203, generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition question and is used for verifying whether the answer is successful.

In this embodiment, the target Flag information is a target obtained after the contestants solve the questions, and is also an answer submitted by the contestants; in this embodiment, the preset Flag information (initial Flag) is a target answer set for each information security question by the automated question issuing platform, and the preset Flag information may be existing Flag information stored in the repository or may be generated by the platform administrator in a self-defined manner. In the process of generating the contest questions, the random number determined according to the contestant information is subjected to exclusive-or operation with the preset Flag information to generate target Flag information corresponding to the contestants, so that one contestant is guaranteed to correspond to one Flag, and the Flag cannot be analyzed to cheat, namely, even if the preset Flag information given by a platform manager or a contestant is the same, answers required to solve the questions are different for the contestants, and the problem solving is avoided by sharing the solution thought and the attack means under the condition that the same Flag is known.

In this embodiment, when generating the target Flag information, according to the number of parameters selected by the platform administrator, for example: and 3, randomly generating 3 random numbers, then carrying out XOR operation on the 3 random numbers and preset Flag information, and finally generating three different target Flag information.

It should be noted that the preset Flag information set for the competitors by the automation question setting platform may be the same, and different target Flag information is generated by performing encryption operation on the preset Flag information and a plurality of random numbers; the preset Flag information may also be different, and the plurality of different preset Flag information and the plurality of random numbers are subjected to xor operation in a one-to-one correspondence manner, so that a plurality of different target Flag information are generated.

Step S204, obtaining configuration items corresponding to the theme direction information in a preset resource library, processing the configuration items and the target Flag information according to preset configuration rules, and generating a plurality of information security themes, wherein the preset configuration rules are determined according to the theme categories corresponding to the information security themes.

In this embodiment, when the information security game questions are automatically generated, the automatic question generation platform calls the configuration items in the preset resource library, and configures the configuration items according to the corresponding configuration rules by using a plurality of different target Flag information, so as to generate a plurality of information security game questions.

In this embodiment, the preset configuration rule includes an operation of processing the configuration item and the target Flag information to generate an information security question, for example: when the game question category is the operating system category and the game question item is the operating system privilege based on linux6.04, at this time, the operation corresponding to the information security game question generated according to the preset configuration rule is as follows: selecting a mirror image file of Linux16.04 from an operating system library of a preset resource library; and automatically calling a configuration command corresponding to the Docker environment configuration command set of the preset resource library, configuring and building a virtual machine, setting target flag information stored in a root directory to be accessed only if the system authority exists, and generating a virtual machine file, wherein the generated virtual machine file is an information security competition question.

Through the steps S201 to S204, a request for generating the information security competition questions is received, wherein the request carries competition question requirement information and competitor information; extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items; generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition questions and is used for verifying whether the answer questions are successful; the method comprises the steps of obtaining configuration items corresponding to theme direction information in a preset resource library, processing the configuration items and a plurality of target Flag information according to preset configuration rules, and generating a plurality of information security game questions, wherein the preset configuration rules are determined according to the game question categories corresponding to the information security game questions, so that the problem of low efficiency of setting the information security game questions in the related technology is solved, the game questions can be quickly generated according to game requirements, and the question setting and checking time is saved.

In some embodiments, the competitor information comprises a first competitor number, and the generating a plurality of target Flag information according to the competitor information and the preset Flag information comprises the following steps:

step 1, a plurality of random numbers corresponding to the first contestant number are randomly generated.

In the present embodiment, the generated target Flag information is made valid for a single use by randomly generating a random number.

And 2, encrypting the preset Flag information and the plurality of random numbers to generate a plurality of target Flag information, wherein the encryption comprises XOR operation.

In the present embodiment, the encryption process includes, but is not limited to, an exclusive-or operation.

It should be noted that the preset Flag information set for the competitor by the automatic question setting platform may be the same, and different target Flag information is generated by performing encryption operation with a plurality of random numbers; the preset Flag information may also be different, and the plurality of different preset Flag information and the plurality of random numbers are subjected to xor operation in a one-to-one correspondence manner, so that a plurality of different target Flag information are generated.

Generating a plurality of random numbers corresponding to the first participant number by the random generation in the above steps; the preset Flag information and the random numbers are encrypted to generate the target Flag information, so that different Flag information is generated according to the number of the parameter people and the initial Flag information, one Flag of one competitor is ensured, and cheating through Flag sharing is avoided.

In some embodiments, obtaining the configuration items corresponding to the theme intent information in the preset repository includes the following steps:

step 1, extracting the game question category and the game question item from the game question intention information.

In this embodiment, the topic category specifically refers to a topic category of the generated topic, for example: web class, mobile application class, IOT class, reverse class, binary class, encryption class and operating system class; the contest item refers to the target item of examination, for example: sensitive information acquisition based on a Bluetooth protocol, authority improvement based on an operating system of Linux6.04, and decryption based on a weak encryption algorithm of android, wherein the encryption algorithm adopts AES.

And 2, selecting a corresponding configuration resource set from a preset resource library according to the game question category, wherein the configuration resource set comprises a plurality of preset candidate configuration items, and the candidate configuration items are used for representing the operation executed when the program corresponding to the information security game question runs.

In this embodiment, the selected configuration resource set corresponds to a related resource pool in a preset resource pool, for example: when the question category is a mobile application category, the configured resource set corresponds to a universal code library and an operating system library in a preset resource library; in this embodiment, the preset candidate configuration items in the configuration resource set correspond to configuration files collected in the related resource library, for example: a Bluetooth communication implementation program in a general code library and a kali operating system mirror image file in an operating system library; meanwhile, the candidate configuration items are used for responding to or characterizing the operation of the program corresponding to the information security question during running, such as: and when the candidate configuration item is a Bluetooth communication implementation program, when the program corresponding to the information security question runs, the Bluetooth communication implementation program is run when the mobile terminal is started.

And 3, matching candidate configuration items corresponding to the game question items in the configuration resource set, and determining the candidate configuration items corresponding to the game question items as configuration items corresponding to the game question intention information.

In this embodiment, the contest item corresponds to a target item of the contest examination, and at least one corresponding candidate configuration item is selected from a plurality of candidate configuration items of the configuration resource set through the target item of the contest examination, and is used as a target configuration item for generating the contest.

Extracting the game item categories and the game item from the game item intention information in the steps; selecting a corresponding configuration resource set from a preset resource library according to the game question category, wherein the configuration resource set comprises a plurality of preset candidate configuration items; selecting a corresponding configuration resource set from a preset resource library according to the game question category, wherein the configuration resource set comprises a plurality of preset candidate configuration items; the candidate configuration items corresponding to the game question items are matched in the configuration resource set, and the candidate configuration items corresponding to the game question items are determined to be the configuration items corresponding to the game question intention information, so that the configuration items of the information security game questions are determined and generated according to the game question intention information, and the question setting efficiency of the information security game questions is improved.

In some embodiments, the event categories include an encryption category, the configuration items include a preset encryption algorithm, the configuration items and the target Flag information are processed according to a preset configuration rule, and generating the information security events includes the following steps:

step 1, selecting a first configuration rule corresponding to an encryption class from preset configuration rules, wherein the first configuration rule comprises: and encrypting and generating an application program APK file.

And 2, encrypting the target Flag messages by adopting a preset encryption algorithm to generate a plurality of encrypted ciphertexts.

In this embodiment, the encryption algorithm includes, but is not limited to, AES encryption algorithms such as: the encryption algorithm may also select one of the following: DES, 3DES, IDEA, SHA1, SHA256, MD5, twofish, TEA, RSA, elliptic Curve Encryption (ECC), white-Box encryption, digital signature.

And 3, acquiring an application program code of the production text, generating a plurality of application program APK files by the application program code through a preset compiler, and determining that the information security question comprises the application program APK files, wherein the text comprises an encrypted ciphertext to be decrypted and a preset encryption algorithm.

In this embodiment, the obtaining of the application code for generating the text refers to calling a corresponding generated application code in a universal code library of a preset resource library, where the generated application code is used to display an encrypted ciphertext to be decrypted in a text box and store an encryption algorithm; the application program APK file is generated by compiling the acquired program code through a compiler, the application program APK file presents a text when executing and running, and an encrypted ciphertext to be decrypted is displayed in the text and a preset encryption algorithm is stored.

Although the encrypted questions generated by the automatic question setting platform are application APK files, for the competitors, the texts are the contents of the information security questions taken by the competitors, and the competitors answer the questions based on the texts and need to obtain the target Flag information through a certain decryption means based on the texts; meanwhile, the preset encryption algorithm stored in the text does not inform the competitor of the technical means for decrypting the acquired target Flag information, but indicates the initial direction of decryption, for example: when the encryption algorithm adopts the AES encryption algorithm, the competitor can preliminarily know the decryption algorithm and means corresponding to the AES encryption algorithm to answer the information security competition questions when answering the questions.

It should be further noted that the information security game questions generated in this embodiment correspond to an encryption type, and therefore, the assessment items given by the administrator of the automated question setting platform correspond to the resource files that are obtained by a decryption means and are encrypted in advance, for example: and the target Flag information is used as an encrypted plaintext, and an encrypted ciphertext is generated by adopting a preset encryption algorithm.

Selecting a first configuration rule corresponding to the encryption class from preset configuration rules in the steps; encrypting the target Flag information by adopting a preset encryption algorithm to generate a plurality of encrypted ciphertexts; the method comprises the steps of obtaining an application program code of a production text, generating a plurality of application program APK files through the application program code through a preset compiler, and determining that the information security question comprises the application program APK files, wherein the text comprises an encrypted ciphertext to be decrypted and a preset encryption algorithm, so that the generation of the encrypted information security question is at least realized.

In some embodiments, the event categories include a second category, the configuration item and the target Flag information are processed according to a preset configuration rule, and the generating of the information security events includes the following steps:

step 1, obtaining an initial resource file corresponding to the contest item, and generating a plurality of target resource files based on the initial resource file and a plurality of target Flag information, wherein the initial resource file is used for representing an attack and defense operation intention corresponding to the contest item, and the attack and defense operation intention at least comprises one of the following items: and acquiring sensitive information and authorizing an operating system.

In this embodiment, the intent of attack and defense operation includes, but is not limited to, sensitive information acquisition and operating system authorization, for example: exploitation of vulnerabilities and use of protection software.

Step 2, selecting a second configuration rule corresponding to a second category from preset configuration rules, wherein the second category comprises a mobile application category and an operating system category, and the second configuration rule comprises: a Docker environment configuration set.

In this embodiment, the second category may also be: web class, reverse class, binary class, IOT class; the second configuration rule is used for operating the corresponding configuration item, so that a preliminary information security question carrying target Flag information is generated.

And 3, configuring the configuration items through the configuration instruction of the Docker environment configuration set to generate the file of the virtual machine to be selected.

And 4, performing target compound processing on the plurality of target resource files and the corresponding to-be-selected virtual machine files to generate a plurality of target virtual machine files, and determining that the information security questions comprise the target virtual machine files.

In this embodiment, the target resource file is subjected to target compound processing on the to-be-selected virtual machine file, that is, the target resource file set for searching by the competitor is hidden in the generated preliminary information security competition; in other alternative embodiments, the target composition process is: storing target Flag information in a root directory, so that the corresponding solution problem is to acquire the corresponding system authority, namely the authority of the operating system; in other alternative embodiments, the target composition process is: and (3) putting the target Flag information into a Bluetooth sending message, and storing a Bluetooth communication implementation program in a preset operating system, wherein at the moment, the corresponding problem is to acquire the sensitive information, namely to acquire the target Flag information.

Acquiring an initial resource file corresponding to the contest item through the steps, and generating a plurality of target resource files based on the initial resource file and the plurality of target Flag information, wherein the initial resource file is used for representing the attack and defense operation intention corresponding to the contest item; selecting a second configuration rule corresponding to the second category from the preset configuration rules; configuring the configuration items through a configuration instruction of a Docker environment configuration set to generate a virtual machine file to be selected; the target combination processing is carried out on the target resource files and the corresponding to-be-selected virtual machine files to generate a plurality of target virtual machine files, and the information security questions are determined to comprise the target virtual machine files, so that the generation of the information security questions of different question categories is realized.

In some embodiments, after the configuration item and the target Flag information are processed according to a preset configuration rule to generate a plurality of information security questions, the following steps are further implemented:

step 1, at least detecting a plurality of information security questions to obtain a detection result.

In this embodiment, the examination performed by the automatic question setting platform further includes whether the automatic question setting platform crashes during the running process, and whether the preset Flag information and the target Flag information are lost during the generation process of the question.

Step 2, determining that the generation of the information security questions is successful under the condition that a plurality of information security questions are detected; and under the condition that a plurality of information security questions are not detected, determining that the generation of the information security questions fails, and generating corresponding prompt information.

It should be noted that, in the process of generating the game questions, if the automatic question generation platform crashes during the running process, and the preset Flag information and the target Flag information are lost during the process of generating the game questions, it also indicates that the automatic question generation platform fails to generate the information security game questions.

In this embodiment, when the automatic question setting platform determines that the generation of the information security question fails, an error prompt is generated according to an error that has occurred, so that the platform manager modifies the configuration item to regenerate the adapted information security question.

Fig. 3 is another flowchart of an information security topic generation method according to an embodiment of the present application, and as shown in fig. 3, the flowchart includes the following steps:

step S301, a request for generating an information security competition question is received, wherein the request carries competition question requirement information and competitor information.

Step S302, extracting the subject title information from the subject requirement information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items.

Step S303, generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition question and is used for verifying whether the question answering is successful.

Step S304, obtaining configuration items corresponding to the theme direction information in a preset resource library, processing the configuration items and the target Flag information according to preset configuration rules, and generating a plurality of information security themes, wherein the preset configuration rules are determined according to the theme categories corresponding to the information security themes.

Step S305, the difficulty coefficient corresponding to the configuration item is obtained, and the difficulty of each information security competition question is determined according to the difficulty coefficient.

In this embodiment, the difficulty coefficient is associated with the configuration item acquired by the automatic question setting platform, that is, the difficulty degree corresponding to the information security questions is solved, and the difficulty degree corresponding to each generated information security question is determined according to the difficulty coefficient.

It should be noted that, a difficulty coefficient is corresponding to each of a plurality of candidate configuration items of different configuration resource sets stored in a preset resource library, the difficulty coefficient of the information security game question is determined based on the difficulty coefficient corresponding to a configuration item selected from the plurality of candidate configuration items, and the greater the difficulty coefficient corresponding to the configuration item is, the harder the information security game question is generated, and meanwhile, the difficulty degree of the information security game question determines the question solving time of the information security game question, for example: the information security contest questions with difficulty coefficients of 0, 1 and 2 in sequence respectively correspond to the following questions: simple, general and difficult to solve the problems in three grades, wherein the problem solving time is 1 hour, 12 hours and 36 hours in sequence.

And S306, acquiring a second participant number corresponding to each group of participants, and determining the preset total difficulty of the participants in each group according to the second participant number.

In this embodiment, the total difficulty of the contest of each group of contestants is determined by the number of the contestants in each group, so that the same number of contestants is ensured, and the workload of answering questions is the same.

Step S307, determining the number of the information security questions corresponding to each group of competitors based on the total difficulty amount of the competition questions and the difficulty of the information security competition questions.

In this embodiment, the generated information security questions themselves have different levels of difficulty, so for the questions of the same question category, the question data generated for each group of participants may be the same or different; for two groups of participants participating in the same type of questions, when the number of participants is the same, the difficulty level of the generated information security questions is different, so the number of the information security questions received by each participant is different, for example: the total number of questions received by a group of participants with a difficulty factor of 0 is several times the total number of questions received by a group of participants with a difficulty factor of 2.

Through the steps S301 to S307, receiving a request for generating an information security question, where the request carries question requirement information and competitor information; extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items; generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition questions and is used for verifying whether the answer is successful; acquiring configuration items corresponding to the theme direction information of the game questions from a preset resource library, and processing the configuration items and the target Flag information according to preset configuration rules to generate a plurality of information security game questions, wherein the preset configuration rules are determined according to the game question categories corresponding to the information security game questions; acquiring a difficulty coefficient corresponding to the configuration item, and determining the difficulty of each information security question according to the difficulty coefficient; acquiring a second participant number corresponding to each group of participants, and determining the preset total difficulty of the participants in each group according to the second participant number; the number of the information security questions corresponding to each group of competitors is determined based on the total difficulty amount of the questions and the difficulty of the information security questions, the problem of low efficiency of setting out the questions of the information security questions in the related technology is solved, the questions with different answers, different numbers of the questions and the same difficulty are quickly generated according to competition requirements, question setting time is saved, and offline cheating is prevented.

The preset resource pool in the embodiment of the present application is described below, and fig. 4 is a block diagram of the preset resource pool in the present application, and as shown in fig. 4, the preset resource pool includes: the system comprises a vulnerability library, an encryption code library, an application program library, a code library containing vulnerabilities, a certificate library, a protection software library, a general code library, a key management library, a classification rule library, an initial Flag library, an operating system library, a fixed component library, an Android simulator library, a website frame library, a Docker environment configuration command set and a target item corresponding table, wherein:

the vulnerability library stores known vulnerabilities and 0Day vulnerability sets, wherein the difficulty coefficient of existing vulnerability exploitation codes or detection rules is 0; the network opens the loophole, and the difficulty coefficient of the non-loophole utilization code or the detection rule is 1; the 0Day bug difficulty factor is 2.

The protection software library stores various protection software, including: EDR terminal protection software and malicious behavior detection software; defining the difficulty coefficient of the software which is not installed with protection as 0; the difficulty coefficient of installing the self-programming protection software is 1; the difficulty coefficient for installing the online protection software or the enterprise protection software is 2.

An application library storing versions of applications, such as Apache, tomcat, weblogic, thinphp, structs2, JBoss; the corresponding version of the application software has open security loopholes, and the difficulty coefficient is 0; the corresponding version of the application software has open security loopholes, but does not utilize codes, and the difficulty coefficient is 1; the corresponding version of the application software has no open security loophole, and the difficulty coefficient is 2.

The encryption code bank stores codes of various encryption algorithms, and the encryption algorithms comprise: AES, DES, 3DES, IDEA, SHA1, SHA256, MD5, twofish, TEA, RSA, elliptic curve Encryption (ECC), white-box encryption, digital signature; different encryption algorithms are implemented in various languages, such as C/C + +, java/js, android, php,. Net, asp. The encryption mode comprises CBC, ECB, CTR, OCF and CFB; also included are common weak cipher encryption codes, such as CBC mode encryption algorithms, such as initial IV or salt hard coded encryption, such as key hard coded encryption, such as code to generate pseudo-random numbers; if the difficulty coefficient of the encryption code is not used, the difficulty coefficient is 0; the difficulty coefficient of the weak encryption algorithm is 1; using a strong encryption algorithm, the difficulty factor is 2.

And the key management library is used for managing encryption keys used by the encryption code library, and comprises a symmetric key and an asymmetric key.

And the website frame library comprises websites realized by using Angular, node. Js, jQuery and Vue. Js frames.

And various operating system image files are stored in the operating system library, including Windows XP/Vista/7/8/10, macOS full version, reteat/Kali/CentOS/Ubuntu/Debian/Mint, unix, android and other operating systems.

The Android simulator library comprises simulators of Android full-version common equipment, such as simulators corresponding to google, samsung, millet, huashi, motorola, hammers and HTC.

The Docker environment configuration command set comprises a set of corresponding environment configuration commands generated according to user selection.

The certificate library comprises signature certificates which can be used for proposing questions; wherein the certificate difficulty coefficient of use is 0; the certificate difficulty factor of not used is 2.

And the classification rule base is used for storing topic classification rules, such as a topic using an Android simulator is a mobile phone application type topic, a Web type topic using a website frame code, an encryption (Crypto) type topic using an encryption code base, and an IoT type game topic using an embedded Linux operating system image file.

Initial flag library: the flag is a character string which needs to be uploaded and can be understood as a correct answer of the information security attack and defense competition, and the problem solving person proves that the problem solving is successful; an initial flag library is stored, and in the process of generating the questions, the random numbers and the initial flag are subjected to XOR to generate a flag corresponding to the problem solving person, so that one flag of one competitor is guaranteed, and the flag cannot be shared to cheat.

Fig. 5 is a flowchart of an information security topic generation method according to a preferred embodiment of the present application, and as shown in fig. 5, the flowchart includes the following steps:

step S501: the platform manager first selects the topic category, and then performs step S502.

In this embodiment, the topic categories include: web class, mobile application class, ioT class, reverse class, binary class, encryption class, operating system class question.

Step S502: the platform manager selects the question items to be assessed, and then performs step S503.

In a particular embodiment, the contest topic item may be set to one of the following: selecting a Bluetooth protocol, acquiring sensitive information, presetting initial flag information, selecting Linux16.04, setting the right of an operating system, presetting the initial flag information, selecting Android, decoding a weak encryption algorithm, AES and presetting the initial flag information, wherein the initial flag can be defined by a platform user and can also be selected from an initial flag library of a preset resource library.

In step S503, the platform administrator selects the number of participants, such as 3 participants, and then executes step S504.

In step S504, target Flag information corresponding to the number of participants is generated, and then step S505 is executed.

In this embodiment, according to the number of matched persons, a corresponding number of random numbers, for example, 3 random numbers, are generated and subjected to xor operation with the initial flag information, so that three different target flags are finally generated.

Step S505: the platform administrator clicks one key to generate the question, and then executes step S506.

In this embodiment, the automatic question setting platform calls configuration items in a preset resource library, and generates three questions with the same structure and the same solution method by using three different target flags.

Step S506: and judging whether the information security contest question is successfully generated, if so, executing the step S507, otherwise, executing the step S509.

In this embodiment, if the running of the platform runs short, the platform runs without generating a corresponding question file, and the resource file is lost or loses to cause a failure, the generation of the information security question fails.

Step S507: the difficulty coefficient of the questions is automatically generated, and then step S508 is performed.

In this embodiment, if there is an option with a difficulty coefficient of 2 in the configuration items selected by the platform administrator, the problem has a difficulty coefficient of 2; if the difficulty coefficients in the configuration items selected by the platform manager are all 0, the problem difficulty coefficient is 0, and the simple problem is solved; the others are general questions, in which the simple question solving time is predicted to be within 1 hour, the general question solving time is predicted to be within 12 hours, and the problem solving time is predicted to be within 36 hours.

Step S508: and generating a corresponding number of information security questions.

In this embodiment, the platform manager generates a corresponding number of questions according to the number of participants, and if 3 participants are selected, generates 3 questions with the same difficulty.

Step S509: the platform administrator modifies the configuration items according to the error prompt of the platform, and then executes step S504.

The generation process of the specific information security question referred to in step S505 is further described as follows: firstly, setting the generated question items of the information security questions as follows: the method comprises the following steps of 1, selecting a Bluetooth protocol, acquiring sensitive information and presetting initial flag information; the method comprises the following steps of (1) selecting a question item 2, selecting Linux16.04, performing privilege escalation by an operating system, and presetting initial flag information; question item 3, android selection, weak encryption algorithm cracking, AES and initial flag information presetting

The generation process of the information security game question corresponding to the game question item 1 is as follows:

step 1, calling a Bluetooth communication implementation program from a universal code library of a preset resource library, and placing target flag information in a Bluetooth sending message.

And 2, calling an operating system library of a preset resource library, and selecting a kali operating system image file by default.

And 3, automatically calling a configuration command corresponding to the Docker environment configuration command set of the preset resource library, and automatically building a virtual machine file to be selected of the virtual machine, so that the Bluetooth communication implementation program is put into the kali operating system and is set to be started to run the Bluetooth communication implementation program, and finally generating the virtual machine file, wherein the generated virtual machine file corresponds to the information security competition question.

The generation process of the information security game questions corresponding to the game question item 2 is as follows:

step 1, selecting an image file of Linux16.04 from an operating system library of a preset resource library.

And 2, automatically calling a configuration command corresponding to the Docker environment configuration command set of the preset resource library, automatically building a virtual machine to be selected, generating target flag information which can be accessed/stored in a root directory only under the system authority, and generating a virtual machine file, wherein the generated virtual machine file corresponds to an information security competition question.

The generation process of the information security game questions corresponding to the game question item 3 is as follows:

step 1, selecting codes of an AES weak encryption algorithm part realized by an Android Java language from an encryption code library of a preset resource library.

And 2, taking a plurality of different target flag information as encrypted plaintext, and encrypting by using an AES encryption algorithm to generate a ciphertext.

And 3, automatically calling a universal code library of a preset resource library to generate an application program code, displaying a ciphertext to be decrypted and only storing an encryption algorithm in the code in a text box, then calling a compiler in the application program library of the preset resource library to automatically generate an executable application program, generating random numbers of corresponding quantity according to the number of selected participants to perform XOR operation with preset flag information, finally generating a plurality of different target flag information as encrypted plaintext, and automatically compiling to generate a plurality of information security questions, namely APK files, with the same difficulty total quantity.

The embodiment further provides an information security game question generating device, which is used for implementing the foregoing embodiments and preferred embodiments, and the description of the device is omitted. As used hereinafter, the terms "module," "unit," "subunit," and the like may implement a combination of software and/or hardware for a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.

Fig. 6 is a block diagram of an information security topic generation apparatus according to an embodiment of the present application, and as shown in fig. 6, the apparatus includes:

the receiving module 61 is configured to receive a request for generating an information security question, where the request carries question requirement information and contestant information;

the extracting module 62 is coupled to the receiving module 61 and configured to extract the topic target information from the topic demand information, where the topic target information includes topic direction information and preset Flag information, and the topic direction information includes topic categories and topic items;

the generating module 63 is coupled with the extracting module 62 and configured to generate a plurality of target Flag information according to the competitor information and the preset Flag information, where the target Flag information is a target obtained after solving the information security competition;

and the processing module 64 is coupled to the generating module 63 and configured to acquire a configuration item corresponding to the theme direction information from the preset resource library, and process the configuration item and the plurality of target Flag information according to a preset configuration rule to generate a plurality of information security themes, where the preset configuration rule is determined according to the theme categories corresponding to the information security themes.

In some embodiments, the competitor information includes a first number of competitors, and the generating module 63 is configured to randomly generate a plurality of random numbers corresponding to the first number of competitors; and encrypting the preset Flag information and a plurality of random numbers to generate a plurality of target Flag information, wherein the encryption comprises XOR operation.

In some embodiments, the processing module 64 is configured to extract the topic categories and the topic items from the topic intent information; selecting a corresponding configuration resource set from a preset resource library according to the game question category, wherein the configuration resource set comprises a plurality of preset candidate configuration items, and the candidate configuration items are used for representing the operation executed when the program corresponding to the information security game question runs; and matching the candidate configuration items corresponding to the game question items in the configuration resource set, and determining the candidate configuration items corresponding to the game question items as configuration items corresponding to the game question intention information.

In some embodiments, the topic categories include encryption classes, and the processing module 64 is configured to select a first configuration rule corresponding to an encryption class from preset configuration rules, where the first configuration rule includes: encrypting and generating an application program APK file; encrypting the target Flag information by adopting a preset encryption algorithm to generate a plurality of encrypted ciphertexts; the method comprises the steps of obtaining an application program code of a production text, generating a plurality of application program APK files through a preset compiler by the application program code, and determining that an information security question comprises the application program APK files, wherein the text comprises an encrypted ciphertext to be decrypted and a preset encryption algorithm.

In some embodiments, the topic categories include a second category, and the processing module 64 is configured to obtain an initial resource file corresponding to the topic items, and generate a plurality of target resource files based on the initial resource file and a plurality of target Flag information, where the initial resource file is used to represent an attack and defense operation intention corresponding to the topic items, and the attack and defense operation intention at least includes one of the following: acquiring sensitive information and authorizing an operating system; selecting a second configuration rule corresponding to a second category from preset configuration rules, wherein the second category comprises a mobile application category and an operating system category, and the second configuration rule comprises: a Docker environment configuration set; configuring the configuration items through configuration instructions of a Docker environment configuration set to generate a virtual machine file to be selected; and performing target compound processing on the plurality of target resource files and the corresponding to-be-selected virtual machine files to generate a plurality of target virtual machine files, and determining that the information security question comprises the target virtual machine files.

In some embodiments, the information security question generating device is further configured to detect at least a plurality of information security questions to obtain a detection result; under the condition that a plurality of information security questions are detected, determining that the generation of the information security questions is successful; and under the condition that a plurality of information security questions are not detected, determining that the generation of the information security questions fails, and generating corresponding prompt information.

In some embodiments, the information security game question generating device is further configured to obtain a difficulty coefficient corresponding to the configuration item, and determine the difficulty of each information security game question according to the difficulty coefficient; acquiring a second participant number corresponding to each group of participants, and determining the preset total difficulty of the participants in each group according to the second participant number; and determining the number of the information security questions corresponding to each group of competitors based on the total difficulty amount of the questions and the difficulty of the information security questions.

The above modules may be functional modules or program modules, and may be implemented by software or hardware. For a module implemented by hardware, the modules may be located in the same processor; or the modules can be respectively positioned in different processors in any combination.

The present embodiment also provides an electronic device comprising a memory having a computer program stored therein and a processor configured to execute the computer program to perform the steps of any of the above method embodiments.

Optionally, the electronic apparatus may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

Optionally, in this embodiment, the processor may be configured to execute the following steps by a computer program:

s1, receiving a request for generating an information security competition question, wherein the request carries competition question requirement information and competitor information.

And S2, extracting the subject title information from the subject demand information, wherein the subject title information comprises subject title direction information and preset Flag information, and the subject title direction information comprises subject categories and subject items.

And S3, generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the competitor answers the information security competition questions and is used for verifying whether the answer is successful.

And S4, acquiring configuration items corresponding to the theme direction information from a preset resource library, processing the configuration items and the target Flag information according to preset configuration rules, and generating a plurality of information security themes, wherein the preset configuration rules are determined according to the theme categories corresponding to the information security themes.

It should be noted that, for specific examples in this embodiment, reference may be made to examples described in the foregoing embodiments and optional implementations, and details of this embodiment are not described herein again.

In addition, in combination with the information security question generation method in the foregoing embodiment, the embodiment of the present application may provide a storage medium to implement. The storage medium having stored thereon a computer program; the computer program, when executed by a processor, implements any of the information security question generation methods of the above embodiments.

It should be understood by those skilled in the art that various features of the above-described embodiments can be combined in any combination, and for the sake of brevity, all possible combinations of features in the above-described embodiments are not described in detail, but rather, all combinations of features which are not inconsistent with each other should be construed as being within the scope of the present disclosure.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is specific and detailed, but not to be understood as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims

1. An information security question generation method is characterized by comprising the following steps:

acquiring a configuration item corresponding to the theme direction information from a preset resource library, and processing the configuration item and the target Flag information according to a preset configuration rule to generate a plurality of information security themes, wherein the preset configuration rule is determined according to the theme categories corresponding to the information security themes;

the game question categories comprise a second category, the configuration items and the target Flag information are processed according to preset configuration rules, and the generating of the information security game questions comprises the following steps:

acquiring an initial resource file corresponding to the contest item, and generating a plurality of target resource files based on the initial resource file and the plurality of target Flag information, wherein the initial resource file is used for representing an attack and defense operation intention corresponding to the contest item, and the attack and defense operation intention at least comprises one of the following: acquiring sensitive information and authorizing an operating system;

selecting a second configuration rule corresponding to the second category from the preset configuration rules, wherein the second category comprises a mobile application category and an operating system category, and the second configuration rule comprises: a Docker environment configuration set;

configuring the configuration items through configuration instructions of the Docker environment configuration set to generate virtual machine files to be selected;

and performing target compound processing on the target resource files and the corresponding to-be-selected virtual machine files to generate a plurality of target virtual machine files, and determining that the information security question comprises the target virtual machine files.

2. The information security question generating method according to claim 1, wherein the contestant information includes a first number of contestants, and generating a plurality of target Flag information according to the contestant information and the preset Flag information includes:

randomly generating a plurality of random numbers corresponding to the first number of participants;

3. The method for generating information security questions according to claim 1, wherein obtaining configuration items corresponding to the question intention information from a preset resource library comprises:

and matching the candidate configuration items corresponding to the game question items in the configuration resource set, and determining the candidate configuration items corresponding to the game question items as configuration items corresponding to the game question intention information.

4. The method for generating information security questions according to claim 1, wherein the question categories include an encryption category, the configuration items include a preset encryption algorithm, the configuration items and the plurality of target Flag information are processed according to a preset configuration rule, and generating the plurality of information security questions includes:

5. The method for generating information security questions according to claim 1, wherein after the configuration item and the plurality of target Flag information are processed according to a preset configuration rule to generate the plurality of information security questions, the method further comprises:

6. The method as claimed in any one of claims 1 to 5, wherein the contestant information includes a second number of contestants, the configuration item and the plurality of target Flag information are processed according to a preset configuration rule, and after the plurality of information security contests are generated, the method further comprises:

acquiring a difficulty coefficient corresponding to the configuration item, and determining the difficulty of each information security competition question according to the difficulty coefficient;

acquiring the second participants corresponding to each group of participants, and determining the preset total difficulty of the participants in each group according to the second participants;

7. An information security question generation device, comprising:

the generating module is used for generating a plurality of target Flag information according to the competitor information and the preset Flag information, wherein the target Flag information is a target obtained after the information security competition question is solved;

the processing module is used for acquiring a configuration item corresponding to the theme direction information from a preset resource library, processing the configuration item and the target Flag information according to a preset configuration rule and generating a plurality of information security themes, wherein the preset configuration rule is determined according to the theme categories corresponding to the information security themes;

the game item categories include a second category, and the processing module is specifically configured to: acquiring an initial resource file corresponding to the contest item, and generating a plurality of target resource files based on the initial resource file and the plurality of target Flag information, wherein the initial resource file is used for representing an attack and defense operation intention corresponding to the contest item, and the attack and defense operation intention at least comprises one of the following: acquiring sensitive information and authorizing an operating system;

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the information security question generating method according to any one of claims 1 to 6.

9. A storage medium having stored thereon a computer program, wherein the computer program is arranged to execute the information security question generating method of any one of claims 1 to 6 when running.