CN115622911A - A performance test method of network security detection equipment - Google Patents

Abstract

The present application provides a performance testing method of a network security detection device, wherein the network security detection device is side-by-side deployed in a test environment, and the performance testing method includes: generating a test file; using a network device to download the test file from the first terminal The device is transmitted to the second terminal device to generate mirrored traffic; use the security detection device to detect the mirrored traffic and generate a detection log; obtain the transmitted file received by the second terminal device; if the transmitted file is consistent with the test file, and the detection log includes For the log information corresponding to the test file, the remaining virus file is obtained from the detection log; if the remaining virus file is consistent with the virus sample file, the test result is output as successful. The performance test method uses mirrored traffic of network equipment as test data without grabbing and replaying messages, and confirms test results based on transmitted files, test files, detection logs, and virus retention files to improve test accuracy.

Description

A performance test method of network security detection equipment

technical field

The application relates to the field of computer network security, in particular to a performance testing method of network security testing equipment.

Background technique

The network security detection equipment deployed in the bypass, such as the total flow forensics system (TFS), is an important component of network security protection, and the virus detection function is an essential business module. As a device deployed in a bypass, TFS is characterized by only receiving traffic and not forwarding traffic, so TFS cannot be directly connected in series between the client and server for testing.

At present, the test of the virus detection performance of TFS mainly relies on the replay of packets. First, the tester needs to simulate the client to send or download the test file including the virus sample file from the server, and then collect the complete data packets generated during the above transmission process. Input the above-mentioned complete data message into TFS for virus detection, and obtain the test result according to the result of the detection log. However, if the above-mentioned packets are captured incompletely, it may lead to false positives or undetected reports by TFS, resulting in inaccurate test results. Therefore, the accuracy of the test results using the above test method is low.

Contents of the invention

In order to solve the problem that in the current performance test method of network security testing equipment, if the message capture is incomplete, it may cause TFS false positives or undetected reports, which may lead to inaccurate test results. This application provides a solution through the following aspects: A performance testing method of network security testing equipment, a terminal device, and a computer-readable storage medium.

The first aspect of the present application provides a method for testing the performance of a network security detection device. The network security detection device is side-by-side deployed in a test environment, and the test environment includes a first terminal device, a network device, and a second terminal device. The performance testing methods mentioned above include:

Generate a test file, wherein the test file includes a virus sample file;

Using the network device to transfer the test file from the first terminal device to the second terminal device, generating mirrored traffic and sending it to the network security detection device;

Use network security detection equipment to detect the mirrored traffic of network devices and generate detection logs;

Obtaining the transferred file, where the transferred file is a file received by the second terminal device;

Determine whether the MD5 value of the transferred file is equal to the MD5 value of the test file;

If the MD5 value of the file after transmission is equal to the MD5 value of the test file, then judge whether the log information corresponding to the test file is included in the detection log;

If the detection log includes the log information corresponding to the test file, the virus retention file is obtained from the detection log;

Determine whether the MD5 value of the virus retention file is equal to the MD5 value of the virus sample file;

If the MD5 value of the virus remaining file is equal to the MD5 value of the virus sample file, the output test result is successful.

In some embodiments, the performance testing method also includes:

If the MD5 value of the file after transmission is not equal to the MD5 value of the test file, then add one to the number of invalid times, where the initial value of the number of invalid times is zero;

Judging whether the number of invalidations is less than a preset threshold;

If the number of invalid times is less than the preset threshold, continue to execute the step of generating the test file.

In some embodiments, the performance testing method also includes:

If the number of invalid times is greater than or equal to the preset threshold, the output test result is failure.

In some embodiments, the test file includes a whitelist test file and a blacklist test file, wherein both the whitelist test file and the blacklist test file include a virus sample file, the file type of the blacklist test file is a preset type, and the whitelist test file The file type of the file is different from the preset type;

The network security detection device is configured to detect files of preset types;

Wherein, it is judged whether the test file is included in the detection log, and if the test file is included in the detection log, the virus retention file is obtained from the detection log, including:

Judging whether the detection log includes log information corresponding to the blacklist test file;

If the detection log includes log information corresponding to the blacklist test file, then it is judged whether the detection log includes log information corresponding to the whitelist test file;

If the detection log does not include log information corresponding to the whitelist test file, then obtain the remaining virus file from the detection log.

In some embodiments, the performance testing method also includes:

If the detection log does not include the log information corresponding to the blacklist test file, the output test result is failure.

In some embodiments, the performance testing method also includes:

If the detection log includes log information corresponding to the whitelist test file, the output test result is failure.

In some embodiments, the performance testing method also includes:

If the MD5 value of the virus remaining file is not equal to the MD5 value of the virus sample file, the output test result is failure.

In some embodiments, the first terminal device is a client, and the second terminal device is a server; or, the first terminal is a server, and the second terminal device is a client.

The second aspect of the present application provides a terminal device, including: at least one processor and a memory; the memory is used to store program instructions; the processor is used to call and execute the program instructions stored in the memory to The terminal device is made to execute the performance testing method of a network security testing device as described in the first aspect of the present application.

The third aspect of the present application provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when the computer-readable storage medium is run on a computer, the computer executes a A performance test method for network security testing equipment.

The present application provides a method for testing the performance of a network security detection device. The network security detection device is side-by-side deployed in a test environment, and the test environment includes a first terminal device, a network device, and a second terminal device. The performance The test method includes: generating a test file; using the network device to transmit the test file from the first terminal device to the second terminal device, generating mirrored traffic and sending it to the network security detection device; using the network security detection device to The mirrored traffic of the network device is detected, and a detection log is generated; the file after transmission received by the second terminal is obtained; if the MD5 value of the file after the transmission is equal to the MD5 value of the test file, then it is judged that in the detection log Whether to include the log information corresponding to the test file; if the virus retention file is obtained from the detection log, compare it with the MD5 value of the virus sample file; if the MD5 value of the virus retention file is equal to the virus sample The MD5 value of the file, the output test result is success. The performance testing method uses mirrored traffic of network devices as test data without grabbing and replaying messages, and jointly confirms test results based on transmitted files, test files, detection logs, and virus retention files to improve test accuracy.

Description of drawings

Fig. 1 exemplarily provides a kind of test environment applicable to the embodiment of the present application;

FIG. 2 exemplarily shows a schematic interface diagram of various function switches of a network security detection device applicable to the embodiment of the present application;

FIG. 3 exemplarily shows a schematic workflow diagram of a performance testing method for a network security detection device provided in an embodiment of the present application;

FIG. 4 exemplarily shows a test environment applicable to the embodiment of the present application.

detailed description

In order to solve the problem that in the current performance test method of network security testing equipment, if the replay message capture is incomplete, it may lead to false positives of the network security testing equipment, and then lead to inaccurate test results, the application adopts the following embodiments A performance testing method of network security testing equipment is provided.

The performance testing method provided in the embodiment of the present application is used to test the virus detection performance of the network security detection device, and the network security detection device is deployed in a test environment in a bypass, wherein the test environment includes a first terminal device, a network Road equipment and the second terminal equipment. In this application, a total flow forensics system (TFS) is taken as an example of a network security detection device to illustrate the implementation of the provided testing method. Referring to FIG. 1 , a schematic structural diagram of a test environment applicable to an embodiment of the present application is exemplarily given. As shown in FIG. 1 , the network device may be a SW (Switch, switch). In this embodiment, port mirroring is configured in the SW, and the packet mirroring transmitted between the client and the server is sent to the TFS to be tested, so as to test the virus detection performance of the TFS.

In some embodiments, the first terminal device may be a PC (client), and correspondingly, the second terminal device may be a server, and the corresponding message transmission process may be file uploading. In some embodiments, the first terminal device may be a server, and correspondingly, the second terminal device may be a client, and the corresponding message transmission process may be file downloading. In some embodiments, the test environment also includes a management PC, which controls the device under test TFS, client and server through SSH (Secure Shell, secure protocol shell) connection. Only as an example and not a limitation, the first terminal device and the second terminal device may be at least one of a server, a personal computer, a smart phone, and a tablet computer. For the first terminal device and the second terminal device, what kind of devices are they? The embodiment of the present application does not make specific limitations, as long as a complete message transmission process can be realized between the two.

When configuring the test environment, deploy HTTP, FTP, mailbox, and Samba services on the server to provide relevant services externally to ensure that the client can normally use the services provided on the server; the virus sample files to be tested (including multiple virus-containing and virus-free samples) are respectively stored in the pre-designated directory of the server and the client, for example, the upload_virus directory. Add the general switch of the virus detection strategy on TFS, enable service (protocol or application), service action (upload, download), and file type as configuration parameters into the parameter pool; see Figure 2, which is an example of each function switch on TFS schematic diagram.

Referring to FIG. 3 , the performance testing method provided in this application includes steps 101-109.

Step 101, generating a test file, wherein the test file includes a virus sample file. In some embodiments, a set of test cases is obtained by combining parameter configurations in the parameter pool, each test case is executed sequentially, and virus sample files are compressed according to file types in the test cases to generate corresponding test files. Correspondingly, the network security detection device is configured according to the configuration parameters in the test case.

Step 102, using the network device to transmit the test file from the first terminal device to the second terminal device, generating mirrored traffic and sending it to the network security detection device. The control test PC client uploads or downloads the test sample file according to the service (HTTP, FTP, mailbox (SMTP, IMAP, POP3), SMB) and service action in the test case.

Step 103, using the network security detection device to detect the mirrored traffic of the network device, and generate a detection log. In the embodiment of the present application, the security detection device detects the mirrored traffic of the network device without capturing and replaying packets.

Step 104, acquire a file after transmission, where the file after transmission is a file received by the second terminal device.

Step 105, judging whether the MD5 value of the transmitted file is equal to the MD5 value of the test file. In the embodiment of the present application, firstly ask your MD5 value and the MD5 value of the test file after transmission to determine whether the file received by the second terminal device is complete, so as to determine whether the transmission process is normal.

Step 106, if the MD5 value of the transmitted file is equal to the MD5 value of the test file, then judge whether the detection log includes the log information corresponding to the test file. In the embodiment of the present application, only when the MD5 value of the file after the transmission is equal to the MD5 value of the test file, that is, the transmission process is normal, then it is judged that in the detection log generated by the network security detection device Whether to include the log information corresponding to the test file.

In an implementation manner, it may be determined whether the detection log includes the log information corresponding to the test file by comparing whether the file name and the MD5 value of the file recorded in the detection log are consistent with the test file.

Step 107, if the detection log includes the log information corresponding to the test file, obtain the remaining virus file from the detection log. In the current test method, generally only the detection log of the network security detection equipment is used as the judgment basis of the test result, but the log is often only one aspect of the visual projection result, and it is relatively one-sided to take the log as the final judgment result. In the embodiment of the present application, not only the detection log is used as the basis for determination, but also the remaining virus files in the detection log are further downloaded for analysis. Exemplarily, the query of the detection log and the download of the remaining virus file can be performed by calling the full traffic aggregation device log API interface.

In some embodiments, it may occur that the detection log includes the log information corresponding to the test file, but the corresponding virus retention file cannot be obtained in the detection log, at this time, the test is also considered to have failed, and the output test result is failure .

Step 108, judging whether the MD5 value of the virus remaining file is equal to the MD5 value of the virus sample file.

Step 109, if the MD5 value of the virus remaining file is equal to the MD5 value of the virus sample file, output the test result as success.

In some embodiments, the performance testing method includes: if the MD5 value of the retained virus file is not equal to the MD5 value of the virus sample file, perform step 110: output the test result as failure.

In this embodiment of the application, if the MD5 value of the transmitted file is not equal to the MD5 value of the test file, it is considered that there is an abnormality in the transmission process, and the corresponding test result is not credible. In some embodiments, for a test file with an abnormality in the transmission process, the file is transmitted again to perform a corresponding test. In these embodiments, the performance testing method further includes steps 111-113.

Step 111, if the MD5 value of the transmitted file is not equal to the MD5 value of the test file, add one to the invalidation count, wherein the initial value of the invalidation count is zero.

Step 112, judging whether the number of times of invalidation is less than a preset threshold.

If the number of times of invalidation is less than the preset threshold, continue to execute step 101 to generate a test file. In some embodiments, the test case corresponding to the test file may be relocated to the set of test cases to be tested and re-executed.

In some embodiments, the performance testing method further includes: if the number of invalidations is greater than or equal to the preset threshold, execute step 110, output the test result as failure, and terminate execution of the current performance testing method. At this time, it may indicate that there are defects in the settings of the test environment or network equipment, and corresponding adjustments are required.

In some embodiments, after step 109 or step 110, that is, after the test result is output, the next test case may be executed, correspondingly generate test files and configure the network security detection device. When all the test cases in the test case collection are executed, a test report is generated according to the test records, which can be automatically sent to the testers by email.

It can be seen from FIG. 2 that the network security detection device can detect different file types. Thus, in some embodiments, blacklist test files and whitelist test files can be set for file types in the test case, and both the whitelist test files and the blacklist test files include virus sample files, and the blacklist test files The file type of the file is a preset type, and the file type of the whitelist test file is different from the preset type; correspondingly, the network security detection device is configured to detect the file of the preset type.

Exemplarily, in the current test case, the preset type is ".exe", then the generated blacklist test file is a ".exe" type file containing a virus sample file, and the generated whitelist test file is a file containing a virus sample file The non-".exe" type file may be a ".7z" type file or a ".com" type file; the network security detection device is configured to detect virus sample files of the ".exe" type.

In these embodiments, steps 106-107 further include:

Step 201, judging whether the detection log includes log information corresponding to the blacklist test file.

Step 202: If the detection log includes log information corresponding to the blacklist test file, determine whether the detection log includes log information corresponding to the whitelist test file.

Step 203, if the detection log does not include the log information corresponding to the whitelist test file, obtain the remaining virus file from the detection log.

In some embodiments, steps 106-107 further include: step 204, if the detection log does not include log information corresponding to the blacklist test file, output the test result as failure.

In some embodiments, steps 106-107 further include: step 205, if the detection log includes log information corresponding to the whitelist test file, output the test result as failure.

An embodiment of the present application provides a method for testing performance of a network security detection device. The network security detection device is side-by-side deployed in a test environment, and the test environment includes a first terminal device, a network device, and a second terminal device. The performance testing method includes: generating a test file; using the network device to transmit the test file from the first terminal device to the second terminal device, generating mirrored traffic and sending it to the network security detection device; using the network security detection device Detecting the mirrored traffic of the network device, generating a detection log; obtaining the transmitted file received by the second terminal; if the MD5 value of the transmitted file is equal to the MD5 value of the test file, then judging the detection log Whether the log information corresponding to the test file is included in the test file; if the virus retention file is obtained from the detection log, compare it with the MD5 value of the virus sample file; if the MD5 value of the virus retention file is equal to the virus The MD5 value of the sample file, the output test result is success. The performance test method uses the mirrored traffic of the network equipment as the test data, without grabbing the replay message, and confirms the test results according to the transmitted files, test files, detection logs and virus retention files, etc., to improve the test accuracy .

Further, the performance test method provided in the above embodiment combines the characteristics of TFS equipment, and uses whether the virus sample file is successfully retained and whether the virus retained file is correct as the basis for judging the success of the test, thereby forming a closed-loop result for the entire test, and user Consider the success or failure of the test results from a different perspective, thereby improving the overall test quality.

The performance testing method provided in the above embodiment can be combined with a set of test cases, use the management PC to execute each test case in turn, liberate manual operations, improve the overall test efficiency, and provide better performance for the daily version test of the network security detection equipment. Escort; effectively increase the number of test samples, the complexity of the combination of test suites, etc. Further, the performance testing method has strong scalability; when the function of the network security detection device is expanded, such as supporting more transmission protocols or file types, it only needs to be properly installed on the first terminal device and the second terminal device. The verification of new functions can be realized by adding the corresponding tool set on the device.

Referring to Fig. 4, in some embodiments, the performance testing method can simultaneously test a plurality of network security detection devices bypass deployed in the test environment, wherein the test environment also includes a distribution device; the distribution device will The mirror traffic generated by the network device (SW) is distributed to each network security detection device. Each network security detection device performs security detection according to the received mirrored traffic, and generates corresponding detection logs.

The embodiment of the present application also provides a terminal device, including: at least one processor and a memory; the memory is used to store program instructions; the processor is used to call and execute the program instructions stored in the memory to The terminal device is made to execute the performance testing method of the network security testing equipment provided in the foregoing embodiments.

In the specific implementation, the embodiment of the present application also provides a computer-readable storage medium, the computer-readable storage medium stores instructions, and when it is run on a computer, the computer executes the network A performance test method for safety testing equipment. The storage medium of the computer-readable medium may be a magnetic disk, an optical disk, a read-only memory (English: read-only memory, abbreviated: ROM) or a random access memory (English: random access memory, abbreviated: RAM), etc.

The steps of the performance testing method described in the embodiments of the present application may be directly embedded in hardware, a software unit executed by a processor, or a combination of both. The software unit may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM or any other storage medium in the art. Exemplarily, the storage medium can be connected to the processor, so that the processor can read information from the storage medium, and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be set in the ASIC, and the ASIC can be set in the UE. Optionally, the processor and the storage medium may also be set in different components in the UE.

It should be understood that in various embodiments of the present application, the serial numbers of the processes do not mean the order of execution, and the execution order of the processes should be determined by their functions and internal logic, rather than by the implementation order of the embodiments of the present application. The implementation process constitutes no limitation.

In the above embodiments, all or part of them may be implemented by software, hardware, firmware or any combination thereof. When implemented using software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server, or data center by wired (eg, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media. The available medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, a Solid State Disk (SSD)).

The same and similar parts of the various embodiments in this specification can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the related parts, please refer to the description of the method embodiment.

Those skilled in the art can clearly understand that the technologies in the embodiments of the present invention can be implemented by means of software plus a necessary general-purpose hardware platform. Based on this understanding, the essence of the technical solutions in the embodiments of the present invention or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in storage media, such as ROM/RAM , magnetic disk, optical disk, etc., including several instructions to make a computer device (which may be a personal computer, server, or network equipment, etc.) execute the performance testing method described in various embodiments or some parts of the embodiments of the present invention.

Claims (10)

1. A performance test method of a network security detection device is characterized in that the network security detection device is deployed in a test environment by-pass, the test environment comprises a first terminal device, a network device and a second terminal device, and the performance test method comprises the following steps:

generating a test file, wherein the test file comprises a virus sample file;

transmitting the test file from the first terminal equipment to the second terminal equipment by using the network equipment, generating mirror image flow and sending the mirror image flow to the network security detection equipment;

detecting the mirror image flow of the network equipment by using the network security detection equipment to generate a detection log;

acquiring a transmitted file, wherein the transmitted file is a file received by the second terminal device;

judging whether the MD5 value of the transmitted file is equal to the MD5 value of the test file;

if the MD5 value of the transmitted file is equal to the MD5 value of the test file, judging whether the detection log comprises log information corresponding to the test file;

if the detection log comprises log information corresponding to the test file, acquiring a virus retention file from the detection log;

judging whether the MD5 value of the virus retention file is equal to the MD5 value of the virus sample file;

and if the MD5 value of the virus retention file is equal to the MD5 value of the virus sample file, outputting a test result as success.

2. The performance testing method of claim 1, further comprising:

if the MD5 value of the transmitted file is not equal to the MD5 value of the test file, adding one to the invalid times, wherein the initial value of the invalid times is zero;

judging whether the invalid times are smaller than a preset threshold value or not;

and if the invalid times are smaller than the preset threshold value, continuing to execute the step of generating the test file.

3. The performance testing method of claim 2, further comprising:

and if the invalid times are greater than or equal to the preset threshold value, outputting a test result as failure.

4. The performance testing method of claim 1, wherein the test files comprise a white list test file and a black list test file, wherein the white list test file and the black list test file both comprise a virus sample file, the file type of the black list test file is a preset type, and the file type of the white list test file is different from the preset type;

the network security detection device is configured to detect the preset type of file;

judging whether the test file is included in the detection log, and if the test file is included in the detection log, acquiring a virus retention file from the detection log, wherein the method comprises the following steps:

judging whether the detection log comprises log information corresponding to the blacklist test file or not;

if the detection log comprises log information corresponding to the blacklist test file, judging whether the detection log comprises the log information corresponding to the whitelist test file;

and if the detection log does not comprise log information corresponding to the white list test file, acquiring a virus retention file from the detection log.

5. The performance testing method of claim 4, further comprising:

and if the detection log does not comprise the log information corresponding to the blacklist test file, outputting a test result as failure.

6. The performance testing method of claim 4, further comprising:

and if the detection log comprises log information corresponding to the white list test file, outputting a test result as failure.

7. The performance testing method of claim 1, further comprising:

and if the MD5 value of the virus retention file is not equal to the MD5 value of the virus sample file, outputting a test result as failure.

8. The performance testing method according to claim 1, wherein the first terminal device is a client, and the second terminal device is a server;

or,

the first terminal device is a server, and the second terminal device is a client.

9. A terminal device, comprising: at least one processor and a memory;

the memory to store program instructions;

the processor is used for calling and executing the program instructions stored in the memory so as to enable the terminal device to execute the performance testing method of the network security detection equipment according to any one of claims 1-8.

10. A computer-readable storage medium, characterized in that,

the computer-readable storage medium has stored therein instructions that, when executed on a computer, cause the computer to execute the performance testing method of the network security detection apparatus according to any one of claims 1 to 8.

Images