WO2020019475A1 - 虚拟演练网络的创建方法和装置 - Google Patents

虚拟演练网络的创建方法和装置 Download PDF

Info

Publication number
WO2020019475A1
WO2020019475A1 PCT/CN2018/107633 CN2018107633W WO2020019475A1 WO 2020019475 A1 WO2020019475 A1 WO 2020019475A1 CN 2018107633 W CN2018107633 W CN 2018107633W WO 2020019475 A1 WO2020019475 A1 WO 2020019475A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
virtual
user
host
template
Prior art date
Application number
PCT/CN2018/107633
Other languages
English (en)
French (fr)
Inventor
吴怡晨
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020019475A1 publication Critical patent/WO2020019475A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/14—Network analysis or design
    • H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network

Definitions

  • the present application relates to the field of computer technology, and in particular, to a method and device for creating a virtual exercise network.
  • This application provides a method and device for creating a virtual exercise network, which can solve the problem of lack of simulation of the real network environment and less training that users can perform.
  • a method for creating a virtual exercise network including:
  • the cloud system obtains a first network template created by a first user for a first offensive and defensive course, the first network template includes a network topology and routing parameters corresponding to the network topology, network parameters corresponding to the network topology, and the network topology Corresponding host parameters;
  • the cloud system saves the first network template, and saves the correspondence between the first network template and the first offensive and defensive course in a course template association table;
  • the cloud system obtains the first network template according to the course template association table;
  • the cloud system creates the first in a cloud environment of the cloud system according to the network topology, routing parameters corresponding to the network topology, network parameters corresponding to the network topology, and host parameters corresponding to the network topology.
  • Virtual exercise network corresponding to the network template.
  • a device for creating a virtual exercise network including:
  • a first network template obtaining module is configured to obtain a first network template created by a first user for a first offensive and defensive course, where the first network template includes a network topology and routing parameters corresponding to the network topology, and a network topology corresponding to the network topology. Network parameters and host parameters corresponding to the network topology;
  • a first network template saving module configured to save the first network template, and save a correspondence between the first network template and the first offensive and defensive course in a course first network template association table;
  • a virtual exercise network creation module is configured to obtain the first network template according to the course template association table when a virtual environment activation request initiated by a second user for the first offensive and defensive course is obtained, and the network topology corresponds to The routing parameters, the network parameters corresponding to the network topology, and the host parameters corresponding to the network topology create a virtual exercise network corresponding to the first network template in a cloud environment of a cloud system, and the cloud system includes the device.
  • another apparatus for creating a virtual exercise network which includes a processor, a memory, and a communication interface.
  • the processor, the memory, and the communication interface are connected to each other.
  • the communication interface is used to transmit data.
  • the creating device for storing a virtual exercise network executes application code of the above method, and the processor is configured to execute the method of the first aspect.
  • a computer storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause the processor to execute the foregoing first aspect. method.
  • This technical solution can enable users to train in a complex network that matches the course, and the virtual exercise network created according to the network template can match the course content.
  • FIG. 1 is a schematic architecture diagram of a system deployed with a cloud environment according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a method for creating a virtual exercise network according to an embodiment of the present application
  • FIG. 3 is a schematic diagram of acquiring a first network template created by a first user for a first offensive and defensive course according to an embodiment of the present application
  • FIG. 4 is a schematic diagram of obtaining a virtual environment startup request initiated by a second user for a first offensive and defensive course provided in an embodiment of the present application;
  • FIG. 5 is a schematic flowchart of another method for creating a virtual exercise network according to an embodiment of the present application.
  • FIG. 6 is a schematic flowchart of another method for creating a virtual exercise network according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a device for creating a virtual exercise network according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a device for creating another virtual exercise network according to an embodiment of the present application.
  • the technical solution in the embodiment of the present application may be applicable to a system with a cloud environment (hereinafter referred to as a cloud system).
  • the cloud system may be shown in FIG. 1, and the cloud system may include an external network system 10 and an internal network system 11.
  • the external network system 10 is used to interact with users connected to the public network (Internet), obtain relevant requirements of the user and forward them to the internal network system 11, and the internal network system 11 is used to create a virtual exercise network for the user according to their needs .
  • the extranet system 10 may include a web request processing subsystem 101 and a Virtual Private Server (VPS) subsystem 102.
  • the intranet subsystem 11 may include an OpenStack cloud group 111 and an auxiliary system 112.
  • the web request processing system 101 is used to receive and identify user requests submitted by users on the user system, and to complete the distribution and logical processing of user requests.
  • the VPS system 102 is configured to map a user's operation request to a virtual host in a virtual exercise network in a cloud environment after the user is connected to the VPS system 102.
  • OpenStack cloud group 111 is a cloud computing management platform based on the open source cloud computing management project OpenStack. It can include a control node, a network node, and multiple computing nodes. These nodes form the cloud environment in the cloud system.
  • the cloud environment includes the various virtual resources needed to create a virtual exercise network.
  • the OpenStack cloud group 111 is used to receive a request submitted by the web request processing subsystem 101 and complete the creation of a virtual exercise network environment in the cloud environment according to the web request processing subsystem request.
  • the OpenStack cloud group 111 is also used to maintain cloud service resources such as virtual hosts, virtual exercise networks, and images in a cloud environment.
  • the auxiliary system 112 is configured to receive network traffic data related to user operations sent by network nodes in the OpenStack cloud group, and save and analyze these network traffic data.
  • FIG. 2 is a schematic flowchart of a method for creating a virtual exercise network according to an embodiment of the present application. As shown in the figure, the method includes:
  • the cloud system obtains a first network template created by the first user for the first offensive and defensive course.
  • the first network template includes a network topology, routing parameters corresponding to the network topology, network parameters corresponding to the network topology, and host parameters corresponding to the network topology.
  • the first user may be the user who created the first offensive and defensive course in the cloud system, that is, the creator of the first offensive and defensive course; the first user may also be an administrator who manages all users and courses in the cloud system The user is the manager of the first offensive and defensive course.
  • the routing parameters are parameters related to the routing configuration, such as the Internet Protocol (IP) address and the outbound interface of each topology node in the network topology.
  • Network parameters are network configuration-related parameters such as the network segment, subnet mask, and gateway where each topology node in the network topology is located.
  • the host parameters are parameters related to the host configuration such as the system configuration (such as the Linux system) and storage capacity of each topology node in the network topology. In some embodiments, some host parameters of the topology node may be determined by acquiring an image uploaded by the first user.
  • the cloud system may obtain the first network template created by the first user for the first offensive and defensive course by acquiring the first user's operation on the visual graphical interface of the user system.
  • the user system is a user-oriented system that can be operated by the user, and the user system is used to establish a connection between the user and the cloud system. The following describes the specific process of obtaining the first network template created by the first user for the first offensive and defensive course:
  • the first user logs in to the user system through the first host.
  • the first host initiates a login request to the web request processing subsystem, and the web request processing subsystem passes the identity verification of the first user.
  • the relevant data of the visual graphical interface of the user system is returned to the first host, and the first host displays the visual graphical interface of the user system according to these data.
  • the visual graphical interface of the user system is shown as A in FIG. 3.
  • the first user selects the first offensive and defensive course on the visual graphical interface of the user system.
  • the first host initiates the web request processing subsystem to enter the visual graphical interface corresponding to the first offensive and defensive course.
  • the web processing subsystem responds to the request, and returns the relevant data of the visual graphical interface corresponding to the first offensive and defensive course to the first host, and the first host displays the visual graphical interface corresponding to the first offensive and defensive course based on these data, as shown in FIG. 3
  • C As shown in C.
  • the first user chooses to create a network template on the visual graphic interface corresponding to the first offensive and defensive course.
  • the first host initiates the concept of creating a network template to the web request processing subsystem.
  • the request processing subsystem responds to the request, and returns relevant data of the visual graphic interface for creating the network template to the first host, and the first host displays the visual view interface for creating the network template according to these data, as shown in E in FIG. 3.
  • the first user selects topology nodes (such as servers, switches, firewalls, hosts, etc.) on the visual view interface of the created network template and connects these topology nodes to form a network topology.
  • topology nodes such as servers, switches, firewalls, hosts, etc.
  • Set the parameters of the topology node After the first user creates the network topology on the visual view interface of the network template creation and sets the parameters of the topology node in the network topology, click Submit, and the first host will set the content with the user. Submit it to the web request processing subsystem, and the web request processing subsystem obtains the first network template created for the first offensive and defensive course.
  • the cloud system saves the first network template, and saves the correspondence between the first network template and the first offensive and defensive course in a course template association table.
  • the course template association table may specifically include an identifier association table and a network template parameter identifier. You can set an identifier for each offensive and defensive course and its corresponding network template, and identify the corresponding offensive and defensive course and network template.
  • a network template parameter table can be created for each network template, the parameters of the network template are saved in the network template parameter table, and the association between the identity association table and the network template parameter table is established by the identity of the network template. relationship.
  • Saving the first network template, and saving the correspondence between the first network template and the first offensive and defensive course in the course template association table may specifically include the following process: allocating a template to the first network template according to the course identifier of the first offensive and defensive course Identification; establish the correspondence between the course identification of the first offensive and defensive course and the template identification of the first network template, and save the correspondence between the course identification of the first offensive and defensive course and the template identification of the first network template in the identification association table; create The template identification table corresponding to the first network template identifies the course template parameter table, stores the network topology corresponding to the first network template in a file for storing the network topology, and saves the path topology and network topology of the network topology corresponding to the first network template. Parameters are stored in the course template parameter table corresponding to the template identifier of the first network template.
  • the network template ID of the network template is set to 3
  • the ID association table can be shown in Table 1:
  • the course template parameter table corresponding to the template identifier of the first network template can be shown in Table 3:
  • course template association table corresponding to each course saves the network topology corresponding to the first network template in a file for storing the network topology, and save the first network
  • the save path of the network topology corresponding to the template and the parameters of the network topology are stored in the course template association table corresponding to the first offensive and defensive course. Since the course template association table corresponding to the first offensive and defensive course corresponds to the first offense and defense course, and the course template association table corresponding to the first offensive and defensive course stores the related information of the first network template, the course template corresponding to the first offense and defense course also substantially The correspondence between the first offensive and defensive course and the first network template is saved.
  • the cloud system obtains the first network template according to the course template association table.
  • the second user is a student user studying the first offensive and defensive course.
  • the virtual environment activation request initiated for the first offensive and defensive course may carry a course identifier of the first offensive and defensive course.
  • the cloud system may obtain a virtual environment startup request initiated by the second user for the first offensive and defensive course by acquiring a second user ’s operation on the visual graphical interface of the user system. The following describes the specific process of obtaining a virtual environment startup request initiated by a second user for the first offensive and defensive course:
  • the second user logs in to the user system through the second host.
  • the process for the second user to log in to the user system is similar to the process for the first host to log in to the user system, and reference may be made to the foregoing description.
  • the visual graphical interface of the user system is shown as A in FIG. 4.
  • the second user selects the first offensive and defensive course on the visual graphical interface of the user system.
  • the first host sends a request to the web request processing subsystem to enter the visual graphical interface corresponding to the first offensive and defensive course.
  • Request the web processing subsystem responds to the request, and returns the relevant data of the visual graphical interface corresponding to the first offensive and defensive course to the first host, and the first host displays the visual graphical interface corresponding to the first offensive and defensive course according to these data, as shown in FIG. 4
  • C As shown in C.
  • the second user chooses to start the experimental environment on the visual graphical interface corresponding to the second offensive and defensive course.
  • the first host initiates a request to start the experimental environment to the web request processing subsystem, and the web request The processing subsystem obtains a virtual environment start request initiated by the second user for the first offensive and defensive course.
  • the cloud system determines the network template identification of the first network template according to the course identification of the first attack and defense course, and then according to the network of the first network template
  • the template identifier finds a network template parameter table corresponding to the template identifier of the first network template, and then obtains the save path of the network topology corresponding to the first network template and the parameters of the network topology from the network template parameter table, and finally according to the network topology Save the path to obtain the network topology corresponding to the first network template.
  • the cloud system finds the course corresponding to the first course template according to the course ID of the first offense and defense course The template association table, and then obtains the save path of the network topology corresponding to the first network template and the parameters of the network topology from the course template association table, and finally obtains the network topology corresponding to the first network template according to the save path of the network topology.
  • the cloud system creates a virtual exercise network corresponding to the first network template in the cloud environment of the cloud system according to the network topology, the routing parameters corresponding to the network topology, the network parameters corresponding to the network topology, and the host parameters corresponding to the network topology.
  • creating the virtual exercise network corresponding to the first network template in the cloud environment may include the following steps: generating VPS configuration parameters according to the host parameters, writing the VPS configuration parameters to the VPS configuration file, and creating a virtual in the cloud environment according to the VPS configuration file A host, wherein the virtual host created in the cloud environment according to the VPS configuration file includes the first virtual host created for the second user; the virtual network is created in the cloud environment according to the network topology and network parameters; and the cloud environment is according to the routing parameters in the cloud environment Create virtual routes between virtual hosts.
  • the process of creating a virtual host In the process of creating a virtual host, first, the computing resources and storage resources required by each host node in the network topology are determined according to the VPS configuration parameters in the VPS configuration file, where the computing resources include processor resources and memory resources. Then, each host node is allocated a corresponding virtual computing resource and virtual storage resource according to the computing resource and the storage resource. Finally, a virtual host corresponding to each host node is created by using a mirror image corresponding to each host node in the virtual computing resources and virtual storage resources allocated to each host node. The host node refers to each computer in the network topology. The configuration of the virtual host is the same as that of its corresponding computer.
  • the configuration of the virtual host includes the operating system of the virtual host, the memory of the virtual host, the storage capacity of the virtual host, and so on.
  • the created virtual host includes a first virtual host created for a second user, and the first virtual host is a user host, that is, a host for operation or use by a user in a virtual exercise network.
  • the process of creating a virtual network In the process of creating a virtual network, first, the network resources required to create the virtual network corresponding to the network topology are allocated according to the network parameters.
  • the network resources include a virtual local area network (VLAN) number, and a scalable virtual local area network (Virtual eXtensible). Local area network (VXLAN) numbers, Open Virtual Switch (OVS) rule tables, namespaces and other network resources.
  • Virtual hosts are configured into network resources corresponding to the configuration of virtual hosts according to the network topology.
  • a security policy rule of the virtual network corresponding to the network topology is created according to the network parameters, where the security policy rule refers to the access control rules of each virtual host in the virtual network, for example, the access control rule is from denying an IP address Network traffic.
  • routing resources are allocated to each virtual host in the virtual exercise network according to routing parameters.
  • the routing resources include the underlying resources required to configure the virtual route, such as virtual network adapters and virtual interfaces.
  • the underlying resources allocated by the virtual host create virtual routes corresponding to each node.
  • a virtual network corresponding to the network topology can be created for the first user in the cloud environment.
  • a virtual exercise network is created for the user according to the first network template corresponding to the course.
  • the network simulates the real network environment. Users can experiment in the virtual exercise network and get more training.
  • different courses correspond to different network templates. Creating a virtual exercise network based on the network template enables the virtual exercise network to be created. Matching with the course content, so that users can get exercises that match the course content after learning the course content, which helps improve the user's ability.
  • FIG. 5 is a schematic flowchart of another method for creating a virtual exercise network according to an embodiment of the present application. The method may be executed after the foregoing step S204. As shown in the figure, the method includes:
  • the cloud system determines a first virtual host created for the second user.
  • the first virtual host is a user host in the virtual exercise network, that is, a virtual host for operation by a second user.
  • the cloud system returns the network topology of the virtual exercise network and the virtual host access method of the first virtual host to the second user.
  • the virtual host access method of the first host refers to a method of accessing the VPS corresponding to the first virtual host, and the second user can connect to the VPS corresponding to the first virtual host through the virtual access method of the first virtual host.
  • the virtual host access method of the first virtual host may be the IP address of the VPS corresponding to the first virtual host; the virtual host access method of the first virtual host may also be the VPS address corresponding to the first virtual host.
  • the corresponding Uniform Resource Locator (URL); the virtual host access method of the first virtual host may also be any other connection method that enables the second user to connect to the VPS corresponding to the first virtual host.
  • the cloud system may also connect to the VPS corresponding to the first virtual host.
  • Data such as a password, a key, or a token with verification function is sent to the second user, so that the second user can log in to the VPS corresponding to the first virtual host through the password, key, or token.
  • the cloud system obtains an attack and defense experiment operation request initiated by the second user according to the virtual host access mode of the first virtual host.
  • the second user may access and log in to the VPS corresponding to the first virtual host according to the virtual host access method of the first virtual host.
  • the cloud system may An operation on the VPS corresponding to a virtual host obtains an attack and defense experiment operation request initiated by the second user.
  • the offensive and defensive experiment operation request refers to requests corresponding to various offensive and defensive operations.
  • the offensive and defensive experimental operation request may be an offensive and defensive experimental operation request corresponding to an operation of accessing another virtual host in the virtual exercise network.
  • the cloud system maps the attack and defense experiment request to the first virtual host, so that the first virtual host performs the experiment operation corresponding to the attack and defense experiment operation request in the virtual drill network.
  • the attack and defense experiment request may carry the user information of the second user.
  • the user information of the second user may be, for example, the user identification of the second user.
  • the VPS in the cloud system may determine the first virtual host according to the user information of the second user. Then, the offensive and defensive experiment operation request is mapped to the first virtual host, and the virtual host can perform the experimental operation corresponding to the offensive and defensive experiment operation request according to the offensive and defensive experiment operation request.
  • the user host can be placed in the virtual exercise environment by sending a connection method of the user host created by the cloud system to the user and obtaining an operation request initiated by the user according to the connection method.
  • Executing the operation request corresponds to an experimental operation, that is, a user's operation is simulated in a virtual exercise environment, so that the user can perform an experiment in the virtual exercise environment.
  • the cloud system may release virtual resources occupied by the virtual exercise network.
  • the cloud system releasing the virtual resources occupied by the virtual exercise network may include the following steps: releasing the computing resources and storage resources allocated to each host in the virtual exercise network; releasing the network resources corresponding to the virtual exercise network; deleting the security policy rules of the virtual exercise network ; Release the routing resources allocated by each host in the virtual exercise network.
  • the virtual resources corresponding to the virtual exercise network are essentially useless virtual resources.
  • the virtual resources are recovered, which is helpful to the realization of the virtual resources. Recycling.
  • the cloud system may also record and save the network traffic generated by the virtual exercise network during the offensive and defensive experiment operation performed by the second user in the virtual exercise network; Analysis of offensive and defensive experimental operations in the virtual exercise network.
  • the cloud system can obtain the network traffic generated by the virtual drill network during the offensive and defensive experiment operation of the second user in the virtual drill network through the network node, and the network node sends the network traffic to the auxiliary subsystem in the cloud system. Then, the auxiliary subsystem is used to classify the network traffic according to the IP address, the data packet type, etc. in the network traffic, and finally determine the experimental operations corresponding to the classified network traffic and analyze these operations.
  • FIG. 6 is a schematic flowchart of another method for creating a virtual exercise network according to an embodiment of the present application. The method is performed after the foregoing step S202, as shown in the figure. The method includes:
  • the cloud system obtains a third user's first virtual environment activation request for the first offensive and defensive course.
  • the first host is a host of a third user
  • the third user is a student user studying the first offensive and defensive course.
  • step S203 For the implementation manner of the cloud system acquiring the first virtual environment activation request of the third user for the first offensive and defensive course, refer to the process of acquiring the virtual environment activation request initiated by the second user for the first offensive and defensive course from the cloud system in step S203. More details.
  • the cloud system creates a first virtual exercise network for a third user in the cloud environment according to the first network template.
  • the cloud system obtains a first attack and defense experiment operation request initiated by a third user.
  • the process for the cloud system to obtain the first attack and defense experiment operation request initiated by the third user is similar to the foregoing embodiment corresponding to FIG. 5.
  • the cloud system determines a third virtual host created by the third user, and then corresponds to the third virtual host.
  • the virtual host access method is returned to the third user.
  • the third user initiates a first attack and defense experiment operation request to the VPS corresponding to the third virtual host according to the virtual host access method corresponding to the third virtual host.
  • the cloud system uses the third virtual
  • the VPS corresponding to the host obtains the first attack and defense experiment operation request initiated by the third user.
  • the cloud system maps the first attack and defense experiment operation request to the third virtual host, so that the third virtual host performs the attack and defense operation corresponding to the first attack and defense experiment operation request in the first virtual exercise network.
  • step S304 maps the first offensive and defensive experiment request to the third virtual host.
  • the cloud system obtains a request for starting the second virtual environment of the first offensive and defensive course by the fourth user.
  • the cloud system creates a second virtual exercise network for the fourth user in the cloud environment according to the first network template.
  • the first virtual exercise network and the second virtual exercise network can be isolated through VXLAN.
  • different VXLAN numbers can be assigned to the first virtual exercise network and the second virtual exercise network to isolate the first virtual exercise network from the second virtual exercise network.
  • the cloud system obtains a second attack and defense experiment operation request initiated by a fourth user.
  • the cloud system obtains the second attack and defense experiment operation request initiated by the fourth user is similar to the foregoing embodiment corresponding to FIG. 5.
  • the cloud system determines a fourth virtual host created by the fourth user, and then The host access method is returned to the fourth user.
  • the fourth user initiates a second offensive and defensive experiment operation request to the VPS corresponding to the fourth virtual host according to the virtual host access method corresponding to the fourth virtual host.
  • the cloud system corresponds to the fourth virtual host.
  • VPS obtains the second attack and defense experiment operation request initiated by the fourth user.
  • the cloud system maps the second offensive and defensive experiment operation request to the fourth virtual host, so that the fourth virtual host performs the offensive and defensive operation corresponding to the second offensive and defensive experiment operation request in the second virtual exercise network.
  • the cloud system obtains a first user's course experiment viewing request for the first offensive and defensive course.
  • the cloud system can obtain the first user's course experiment viewing request for the first offensive and defensive course by acquiring the first user's operation on the visual graphical interface of the user system.
  • the visual graphical interface corresponding to the first user entering the first offensive and defensive course is shown as C in FIG. 3.
  • the cloud The system obtains the first user's course experiment viewing request for the first offensive and defensive course.
  • S410 The cloud system returns the experiment conditions of the third user and the fourth user to the first user according to the course experiment viewing request.
  • the cloud system can integrate the current experimental progress of the third user and the fourth user (such as the duration of the experiment, where the experiment went, etc.) and the third user and the fourth user in their respective virtual exercise networks.
  • a record of the operations performed is returned to the first user.
  • the first offensive and defensive course is a course about vulnerability detection and repair
  • the cloud system can analyze the vulnerability situation found by the third and fourth users, the vulnerability situation repaired by the third and fourth users, and the third A record of the operations currently performed by the user and the fourth user and the operations performed by the third user and the fourth user in the process of finding and repairing the vulnerability are returned to the first user.
  • the vulnerability situations and bug fixes found by the third user and the fourth user can be shown in Table 4 and Table 5, respectively:
  • Vulnerability name Vulnerability level Whether to repair SQL injection high no Leak of sensitive information high Yes ... ... ...
  • Vulnerability name Vulnerability level Whether to repair SQL injection high no html injection in Yes ... ... ...
  • the information in Tables 4 and 5 can be returned to the first user.
  • the cloud system obtains a network entry request initiated by the first user.
  • the cloud system executes step S412; if the network entry request initiated by the first user is a request to enter the second virtual exercise network, the cloud system Go to step S413.
  • the cloud system maps the network request to the third virtual host to control the third virtual host.
  • S413 The cloud system maps the network request to the fourth virtual host to control the fourth virtual host.
  • the first user by returning the experiments of the third user and the fourth user experimenting in the first virtual exercise network and the second virtual exercise network corresponding to the first offensive and defensive course to the first user, the first user The user can understand the mastery of the course by the third user and the third user according to the experimental situation of the third user and the fourth user.
  • the first user can enter the virtual Guiding the third or fourth user in the exercise network can help users of the experiment to grasp the content of the experiment faster.
  • FIG. 7 is a schematic structural diagram of a device for creating a virtual exercise network provided by an embodiment of the present application.
  • the device may be the cloud system shown in FIG. 1 or a part of the cloud system, as shown in the figure.
  • the device 50 includes:
  • a network template obtaining module 501 is configured to obtain a first network template created by a first user for a first offensive and defensive course, where the first network template includes a network topology and routing parameters corresponding to the network topology and a network corresponding to the network topology Parameters and host parameters corresponding to the network topology;
  • a network template saving module 502 configured to save the first network template, and save a correspondence between the first network template and the first offensive and defensive course in a course first network template association table;
  • a virtual network creation module 503 configured to obtain the first network template according to the course template association table when a virtual environment activation request initiated by a second user for the first offensive and defensive course is obtained, the network topology, The routing parameters corresponding to the network topology, the network parameters corresponding to the network topology, and the host parameters corresponding to the network topology create a virtual exercise network corresponding to the first network template in a cloud environment.
  • the parameters of the network topology include routing parameters, network parameters, and host parameters.
  • the virtual network creation module 503 is specifically configured to:
  • Generate a virtual private server configuration parameter according to the host parameter write the virtual private server configuration parameter into a virtual private server configuration file, and create a virtual host in the cloud environment according to the virtual private server configuration file, the virtual host
  • the host includes a first virtual host created for the second user
  • the device 50 further includes:
  • the connection mode return module 504 is configured to return the network topology and a target connection mode to the second user, where the target connection mode is a first created by the device for the second user in the cloud environment.
  • the device 50 further includes:
  • a first request receiving module 505, configured to obtain an attack and defense experiment operation request initiated by the second user according to the target connection mode
  • a first request mapping module 506, configured to map the attack and defense experiment operation request to the first virtual host, so that the first virtual host performs an experiment corresponding to the attack and defense experiment operation request in the virtual exercise network. operating.
  • the device 50 further includes:
  • a virtual resource release module 507 is configured to release a virtual resource occupied by the virtual exercise network in the cloud environment when it is determined that the second user ends an experimental operation in the virtual exercise network.
  • the device 50 further includes:
  • a traffic saving module 508, configured to record and save network traffic generated by the virtual exercise network during the second user's experimental operation in the virtual exercise network;
  • An operation analysis module 509 is configured to analyze an experimental operation of the second user in the virtual exercise network according to the network traffic.
  • the device 50 further includes:
  • a second request receiving module 510 configured to obtain a course experiment viewing request initiated by the first user for the first offensive and defensive course
  • the experiment situation returning module 511 is configured to return to the first user an experiment situation of a user who performs an experiment operation in a virtual exercise network corresponding to the first offensive and defensive course according to the course experiment viewing request;
  • a request obtaining module 512 configured to obtain a network access request initiated by the first user according to the experimental situation
  • a second request mapping module 513 is configured to map the network entry request to a second virtual host corresponding to the network entry request to control the second virtual host.
  • the user can perform experiments in the virtual exercise network to obtain more training; after the user has learned the course content, the user can get exercises that match the course content, which helps to improve the user's ability.
  • FIG. 8 is a schematic structural diagram of another device for creating a virtual exercise network according to an embodiment of the present application.
  • the device may be a cloud system or a part of a cloud system.
  • the device 60 includes a processor. 601, a memory 602, and an input-output interface 603.
  • the processor 601 is connected to the memory 602 and the communication interface 603.
  • the processor 601 may be connected to the memory 602 and the communication interface 603 through a bus.
  • the processor 601 is configured to support the device for saving a server log to perform a corresponding function in the method for saving a server log described in FIGS. 3 to 6.
  • the processor 601 may be a Central Processing Unit (CPU), a Network Processor (NP), a hardware chip, or any combination thereof.
  • the above-mentioned hardware chip may be an Application-Specific Integrated Circuit (ASIC), a Programmable Logic Device (PLD), or a combination thereof.
  • the PLD may be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field programmable logic gate array (Field-Programmable Gate Array, FPGA), a universal array logic (Generic Array logic, GAL), or any combination thereof.
  • the memory 602 is used to store program code and the like.
  • the memory 602 may include volatile memory (Volatile Memory, VM), such as Random Access Memory (RAM); the memory 602 may also include non-volatile memory (Non-Volatile Memory, NVM), such as read-only Memory (Read-Only Memory, ROM), flash memory (Hard Disk Drive, HDD), or solid state drive (SSD); the memory 602 may also include a combination of the above types of memories.
  • the memory 602 is configured to store an application program that saves a server log.
  • the communication interface 603 is used for inputting or outputting data.
  • the processor 601 may call the program code to perform the following operations:
  • a first network template created by a first user for a first offensive and defensive course is obtained, where the first network template includes a network topology, routing parameters corresponding to the network topology, network parameters corresponding to the network topology, and Host parameters
  • Creating a virtual exercise corresponding to the first network template in a cloud environment of a cloud system according to the network topology, the routing parameters corresponding to the network topology, the network parameters corresponding to the network topology, and the host parameters corresponding to the network topology The internet. It should be noted that the implementation of each operation may also correspond to the corresponding description of the method embodiments shown in FIG. 2 to FIG. 6; the processor 601 may also cooperate with the communication interface 603 to perform other operations in the foregoing method embodiments.
  • An embodiment of the present application further provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by the computer, cause the computer to execute as described above.
  • the computer may be part of the creation device of the virtual exercise network mentioned above. For example, it is the processor 601 described above.
  • the program can be stored in a computer-readable storage medium.
  • the program When executed, the processes of the embodiments of the methods described above may be included.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请提供虚拟演练网络的创建方法和装置，该方法包括：云系统获取第一用户针对第一攻防课程创建的第一网络模板，第一网络模板包括网络拓扑、网络拓扑对应的路由参数、网络拓扑对应的网络参数以及网络拓扑对应的主机参数；云系统保存第一网络模板，并将第一网络模板与第一攻防课程的对应关系保存在课程模板关联表中；当获取到第二用户针对第一攻防课程发起的虚拟环境启动请求时，云系统根据课程模板关联表获取第一网络模板；云系统根据网络拓扑、网络拓扑对应的路由参数、网络拓扑对应的网络参数以及网络拓扑对应的主机参数在云系统的云环境中创建第一网络模板对应的虚拟演练网络。该技术方案可模拟真实的网络环境，使用户得到更好的攻防训练。

Description

虚拟演练网络的创建方法和装置
本申请要求于2018年07月26日提交中国专利局、申请号为2018108522671、申请名称为“虚拟演练网络的创建方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机技术领域，尤其涉及虚拟演练网络的创建方法和装置。
背景技术
随着计算机网络技术的快速发展及其在各领域的广泛应用，社会各界越来越重视信息网络安全问题，不断投入资源进行网络攻防演练和信息安全研究。
目前市场上有一些用于对安全人员、维护人员等进行培训的攻防培训系统，这些攻防培训系统可以为相关用户提供安全培训课程以及提供一些虚拟环境供用户进行练习，以便于用户对安全知识进行学习并练习。但是，在目前的这些提供安全培训课程的系统中，提供给用户的虚拟练习环境主要是单机形式，缺乏对真实网络环境的模拟，用户能够进行的训练较少。
发明内容
本申请提供虚拟演练网络的创建方法和装置，可以解决缺乏对真实网络环境的模拟，用户能够进行的训练较少的问题。
第一方面，提供一种虚拟演练网络的创建方法，包括：
云系统获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑以及所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
所述云系统保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程模板关联表中；
当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，所述云系统根据所述课程模板关联表获取所述第一网络模板；
所述云系统根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云系统的云环境中创建所述第一网络模板对应的虚拟演练网络。
第二方面，提供一种虚拟演练网络的创建装置，包括：
第一网络模板获取模块，用于获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑以及所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
第一网络模板保存模块，用于保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程第一网络模板关联表中；
虚拟演练网络创建模块，用于当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，根据所述课程模板关联表获取所述第一网络模板，所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在云系统的云环境中创建所述第一网络模板对应的虚拟演练网络，所述云系统包括所述装置。
第三方面，提供另一种虚拟演练网络的创建装置，包括处理器、存储器以及通信接口，所述处理器、存储器和通信接口相互连接，其中，所述通信接口用于传输数据，所述存储器用于存储虚拟演练网络的创建装置执行上述方法的应用程序代码，所述处理器被配置用于执行上述第一方面的方法。
第四方面，提供一种计算机存储介质，所述计算机存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行上述第一方面的方法。
本技术方案可以使得用户在与课程相匹配的复杂网络中进行训练，并且根据网络模板创建的虚拟演练网络能够匹配于课程内容。
附图说明
图1是本申请实施例提供的部署有云环境的系统的架构示意图；
图2是本申请实施例提供的一种虚拟演练网络的创建方法的流程示意图；
图3是本申请实施例提供的获取第一用户针对第一攻防课程创建的第一网络模板的示意图；
图4是本申请实施例提供的获取第二用户针对第一攻防课程发起的虚拟环境启动请求的示意图；
图5是本申请实施例提供的另一种虚拟演练网络的创建方法的流程示意图；
图6是本申请实施例提供的又一种虚拟演练网络的创建方法的流程示意图；
图7是本申请实施例提供的一种虚拟演练网络的创建装置的组成结构示意图；
图8是本申请实施例提供的另一种虚拟演练网络的创建装置的组成结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例的技术方案可适用于部署有云环境的系统(以下简称云系统)，示例性地，云系统可以如图1所示，云系统可包括外网系统10和内网系统11，其中，外网系统10用于与连接到公网(互联网)上的用户交互，获取用户的相关需求并转发至内网系统11，内网系统11用于根据用户的需求为其创建虚拟演练网络。外网系统10可包括web请求处理子系统101和虚拟专用服务器(Virtual Private Server，VPS)子系统102，内网子系统11可包括OpenStack云组群111和辅助系统112。web请求处理系统101用于接收 并识别用户在用户系统上提交的用户请求，完成对用户请求的分发和逻辑处理。VPS系统102用于在用户连接至该VPS系统102后，将用户的操作请求映射到云环境中的虚拟演练网络中的虚拟主机上。OpenStack云组群111是基于开源的云计算管理项目OpenStack建立的云计算管理平台，其可以包括1个控制节点、1个网络节点以及多个计算节点，这些节点组成了云系统中的云环境，云环境包括创建虚拟演练网络所需的各种虚拟资源。OpenStack云组群111用于接收web请求处理子系统101提交的请求，根据web请求处理子系统请求在云环境中完成对虚拟演练网络环境的创建。OpenStack云组群111还用于维护云环境中的虚拟主机、虚拟演练网络以及镜像等云服务资源。辅助系统112用于接收OpenStack云组群中的网络节点发送的与用户的操作有关的网络流量数据以及对这些网络流量数据进行保存以及分析。
基于图1所示的云系统，可以实现本申请实施例的技术方案。
参见图2，图2是本申请实施例提供的一种虚拟演练网络的创建方法的流程示意图，如图所示，所述方法包括：
S201，云系统获取第一用户针对第一攻防课程创建的第一网络模板，第一网络模板包括网络拓扑、网络拓扑对应的路由参数、网络拓扑对应的网络参数以及网络拓扑对应的主机参数。
这里，第一用户可以为在云系统中创建该第一攻防课程的用户，即该第一攻防课程的创建者；第一用户也可以为在云系统中对所有用户和课程进行管理的管理员用户，即该第一攻防课程的管理者。
路由参数为网络拓扑中的各个拓扑节点的互联网协议(Internet Protocol，IP)地址、出接口等与路由配置有关的参数。网络参数为网络拓扑中的各个拓扑节点所处的网段、子网掩码、网关等与网络配置有关的参数。主机参数为网络拓扑中的各个拓扑节点的系统配置(如Linux系统)、存储容量等与主机配置有关的参数。在一些实施例中，可以通过获取第一用户上传的镜像确定拓扑节点的部分主机参数。
具体实现中，云系统可以通过获取第一用户在用户系统的可视化图形界面上的操作获取第一用户针对第一攻防课程创建的第一网络模板。其中，用户系统是面向用户的可供用户进行操作的系统，用户系统用于建立用户与云系统之间的联系。以下介绍获取第一用户针对第一攻防课程创建的第一网络模板的具体过程：
第一步，第一用户通过第一主机登录用户系统，在登录用户系统的过程中，第一主机向web请求处理子系统发起登录请求，web请求处理子系统在对第一用户的身份验证通过之后，将用户系统的可视化图形界面的有关数据返回给第一主机，第一主机根据这些数据显示用户系统的可视化图形界面。用户系统的可视化图形界面如图3中的A所示。
第二步，第一用户在用户系统的可视化图形界面上选择第一攻防课程，如图3中的B所示，第一主机向web请求处理子系统发起进入第一攻防课程对应的可视化图形界面的请求，web处理子系统响应该请求，将第一攻防课程对应的可视化图形界面的有关数据返回给第一主机，第一主机根据这些数据显示第一攻防课程对应的可视化图形界面，如图3中的C所示。
第三步，第一用户在第一攻防课程对应的可视化图形界面上选择创建网络模板，如 图3中的D所示，第一主机向web请求处理子系统发起进入创建网络模板的概念，web请求处理子系统响应该请求，将创建网络模板的可视化图形界面的有关数据返回给第一主机，第一主机根据这些数据显示创建网络模板的可视化视图界面，如图3中的E所示。
第四步，第一用户在创建网络模板的可视化视图界面上选取拓扑节点(如服务器、交换机、防火墙、主机等)并连接这些拓扑节点以形成网络拓扑；第一用户分别对网络拓扑中的各个拓扑节点的参数进行设置，当第一用户在创建网络模板的可视化视图界面上创建好网络拓扑并设置好该网络拓扑中的拓扑节点的参数后，点击提交，第一主机则与用户设置的内容提交给web请求处理子系统，web请求处理子系统获取到针对第一攻防课程创建的第一网络模板。
S202，云系统保存第一网络模板，并将第一网络模板与第一攻防课程的对应关系保存在课程模板关联表中。
在一种可能的实现方式中，课程模板关联表具体可包括标识关联表和网络模板参数标识，可以为各个攻防课程和其对应的网络模板设置标识并将相对应的攻防课程和网络模板的标识对应保存在标识关联表中，可以分别为每个网络模板创建网络模板参数表，将网络模板的参数保存在网络模板参数表中，通过网络模板的标识建立标识关联表与网络模板参数表的关联关系。保存所述第一网络模板，并将第一网络模板与第一攻防课程的对应关系保存在课程模板关联表中具体可以包括以下流程：根据第一攻防课程的课程标识为第一网络模板分配模板标识；建立第一攻防课程的课程标识与第一网络模板的模板标识的对应关系，并将第一攻防课程的课程标识与第一网络模板的模板标识的对应关系保存在标识关联表中；创建第一网络模板的模板标识对应的课程模板参数表，将第一网络模板对应的网络拓扑保存在用于存储网络拓扑的文件中，并将第一网络模板对应的网络拓扑的保存路径以及网络拓扑的参数保存在第一网络模板的模板标识对应的课程模板参数表中。
举例来进行说明，例如，第一攻防课程的课程标识为3，则将网络模板的网络模板标识设置为3，标识关联表可以如表1所示：
课程标识 网络模板标识
1 1
2 2
表1
将第一攻防课程的课程标识与第一网络模板的模板标识的对应关系保存在标识关联表中可以如表2所示：
课程标识 网络模板标识
1 1
2 2
3 3
表2
创建第一网络模板的模板标识对应的课程模板参数表，第一网络模板的模板标识对应的课程模板参数表可以如表3所示：
Figure PCTCN2018107633-appb-000001
表3
在另一种可能的实现方式中，也可以为每一个课程创建与其对应的课程模板关联表，将第一网络模板对应的网络拓扑保存在用于存储网络拓扑的文件中，并将第一网络模板对应的网络拓扑的保存路径和网络拓扑的参数保存在第一攻防课程对应的课程模板关联表中。由于第一攻防课程对应的课程模板关联表对应第一攻防课程，第一攻防课程对应的课程模板关联表存储着第一网络模板的相关信息，则该第一攻防课程对应的课程模板实质上也保存了第一攻防课程与第一网络模板的对应关系。
S203，当获取到第二用户针对第一攻防课程发起的虚拟环境启动请求时，云系统根据课程模板关联表获取第一网络模板。
第二用户为学习该第一攻防课程的学生用户。
本申请实施例中，针对第一攻防课程发起的虚拟环境启动请求可以携带第一攻防课程的课程标识。云系统可以通过获取第二用户在用户系统的可视化图形界面上的操作获取第二用户针对第一攻防课程发起的虚拟环境启动请求。以下介绍获取第二用户针对第一攻防课程发起的虚拟环境启动请求的具体过程：
第一步，第二用户通过第二主机登录用户系统。第二用户登录用户系统的过程与第一主机登录用户系统的过程类似，可参考前述描述，用户系统的可视化图形界面如图4中的A所示。
第二步，第二用户在用户系统的可视化图形界面上选择第一攻防课程，如4中的B所示，第一主机向web请求处理子系统发起进入第一攻防课程对应的可视化图形界面的请求，web处理子系统响应该请求，将第一攻防课程对应的可视化图形界面的有关数据返回给第一主机，第一主机根据这些数据显示第一攻防课程对应的可视化图形界面，如图4中的C所示。
第三步，第二用户在第二攻防课程对应的可视化图形界面上选择启动实验环境，如图4中的D所示，第一主机向web请求处理子系统发起启动实验环境的请求，web请求处理子系统获取到第二用户针对第一攻防课程发起的虚拟环境启动请求。
在通过网络模板的标识建立标识关联表与网络模板参数表的关联关系的情况下，云系统根据第一攻防课程的课程标识确定第一网络模板的网络模板标识，然后根据第一网络模板的网络模板标识找到第一网络模板的模板标识对应的网络模板参数表，然后从该网络模板参数表中获取第一网络模板对应的网络拓扑的保存路径以及该网络拓扑的参数，最后根据该网络拓扑的保存路径获取第一网络模板对应的网络拓扑。
在将第一网络模板对应的网络拓扑和网络拓扑的参数保存在第一课程模板对应的课程模板关联表中的情况下，云系统根据第一攻防课程的课程标识找到第一课程模板对应的课程模板关联表，然后从该课程模板关联表中获取第一网络模板对应的网络拓扑的保存路 径以及该网络拓扑的参数，最后根据该网络拓扑的保存路径获取第一网络模板对应的网络拓扑。
S204，云系统根据网络拓扑、网络拓扑对应的路由参数、网络拓扑对应的网络参数以及网络拓扑对应的主机参数在云系统的云环境中创建第一网络模板对应的虚拟演练网络。
这里，在云环境中创建第一网络模板对应的虚拟演练网络可以包括以下步骤：根据主机参数生成VPS配置参数，并将VPS配置参数写入VPS配置文件，根据VPS配置文件在云环境中创建虚拟主机，其中，根据VPS配置文件在云环境中的创建的虚拟主机包括为第二用户创建的第一虚拟主机；根据网络拓扑以及网络参数在云环境中创建虚拟网络；根据路由参数在云环境中创建虚拟主机之间的虚拟路由。
下面分别介绍创建虚拟主机、虚拟网络以及虚拟路由的具体过程。
一、创建虚拟主机的过程。在创建虚拟主机的过程中，首先，根据VPS配置文件中的VPS配置参数确定该网络拓扑中的各个主机节点所需的计算资源以及存储资源，其中，计算资源包括处理器资源和内存资源。然后，根据该计算资源和存储资源为各个主机节点分配相应的虚拟计算资源和虚拟存储资源。最后，利用各个主机节点对应的镜像在为各个主机节点分配的虚拟计算资源和虚拟存储资源中创建各个主机节点对应的虚拟主机。其中，主机节点是指网络拓扑中的各个计算机，虚拟主机的配置与其对应的计算机的配置相同，虚拟主机的配置包括虚拟主机的操作系统、虚拟主机的内存、虚拟主机的存储容量，等等。在创建的虚拟主机中，包括为第二用户创建的第一虚拟主机，第一虚拟主机为用户主机，即在虚拟演练网络中供用户操作或使用的主机。
二、创建虚拟网络的过程。在创建虚拟网络的过程中，首先，根据网络参数分配创建该网络拓扑对应的虚拟网络所需的网络资源，网络资源包括虚拟局域网(Virtual Local Area Network，VLAN)编号、可扩展虚拟局域网(Virtual eXtensible Local Area Network，VXLAN)编号、开放虚拟交换机(Open Virtual Switch，OVS)规则表、命名空间(namespace)等网络资源，根据网络拓扑将虚拟主机配置到与虚拟主机的配置相对应的网络资源中。然后，根据网络参数创建该网络拓扑对应的虚拟网络的安全策略规则，其中，安全策略规则是指该虚拟网络中的各个虚拟主机的访问控制规则，例如，访问控制规则为来自拒绝某一IP地址的网络流量。
三、创建虚拟路由的过程。在创建虚拟路由的过程中，首先，根据路由参数为该虚拟演练网络中的各个虚拟主机分配路由资源，其中，路由资源包括虚拟网卡、虚拟接口等配置虚拟路由所需的底层资源；利用为各个虚拟主机分配的底层资源创建各个节点对应的虚拟路由。
通过上述三个过程，可以在云环境中为第一用户创建该网络拓扑对应的虚拟网络。
本申请实施例中，通过将用户创建的与课程相关联的第一网络模板保存，在用户在该课程中进行训练时，根据与课程对应的第一网络模板为其创建虚拟演练网络，虚拟演练网络模拟了真实的网络环境，用户可以在虚拟演练网络中进行实验，可以得到更多的训练；另外，不同课程对应不同的网络模板，根据网络模板创建虚拟演练网络能够使得创建的虚拟演练网络能够与课程内容相匹配，使用户在学习了课程内容后能够得到与课程内容相匹 配的练习，有助于提高用户的能力。
在一些可能的实施例中，在根据第一网络模板创建好第一攻防课程对应的虚拟演练网络之后，第二用户可以在第一攻防课程对应的虚拟演练网络中进行攻防实验。参见图5，图5是本申请实施例提供的另一种虚拟演练网络的创建方法的流程示意图，该方法可以在上述步骤S204之后被执行，如图所示，所述方法包括：
S301，云系统确定为第二用户创建的第一虚拟主机。
这里，第一虚拟主机是该虚拟演练网络中的用户主机，即供第二用户进行操作的虚拟主机。
S302，云系统将虚拟演练网络的网络拓扑以及第一虚拟主机的虚拟主机访问方式返回给第二用户。
这里，第一主机的虚拟主机访问方式是指访问该第一虚拟主机对应的VPS的方式，第二用户通过该第一虚拟主机的虚拟访问方式可连接至第一虚拟主机对应的VPS。
具体实现中，该第一虚拟主机的虚拟主机访问方式可以为该第一虚拟主机对应的VPS的IP地址；该第一虚拟主机的虚拟主机访问方式也可以为该第一虚拟主机对应的VPS所对应的统一资源标识符(Uniform Resource Locator，URL)；第一虚拟主机的虚拟主机访问方式还可以为其他任意一种可以使第二用户可以连接至第一虚拟主机对应的VPS的连接方式。
在可选实施方式中，云系统除了将给虚拟演练网络的网络拓扑以及第一虚拟主机的虚拟主机访问方式返回给第二用户之外，还可以将连接至该第一虚拟主机对应的VPS的密码、密钥或令牌等具备验证作用的数据发送给第二用户，以使第二用户可以通过密码、密钥或令牌登录该第一虚拟主机对应的VPS。
S303，云系统获取第二用户根据第一虚拟主机的虚拟主机访问方式发起的攻防实验操作请求。
这里，第二用户根据第一虚拟主机的虚拟主机访问方式可以访问并登录该第一虚拟主机对应的VPS，在登录该第一虚拟主机对应的VPS之后，云系统可以根据第二用户在该第一虚拟主机对应的VPS上的操作获取第二用户发起的攻防实验操作请求。
这里，攻防实验操作请求是指各种攻防操作对应的请求，例如，可以为访问该虚拟演练网络中的另一虚拟主机的操作所对应的攻防实验操作请求。
S304，云系统将攻防实验请求映射至所述第一虚拟主机，以使第一虚拟主机在虚拟演练网络中执行所述攻防实验操作请求对应的实验操作。
这里，该攻防实验请求可携带第二用户的用户信息，第二用户的用户信息例如可以是第二用户的用户标识，云系统中的VPS可以根据第二用户的用户信息确定该第一虚拟主机，进而将攻防实验操作请求映射至第一虚拟主机，虚拟主机可以根据该攻防实验操作请求执行该攻防实验操作请求对应的实验操作。
本申请实施例中，在创建虚拟演练网络之后，通过将云系统为用户创建的用户主机的连接方式发送给用户并获取用户根据该连接方式发起的操作请求，可以使该用户主机在虚拟演练环境中执行该操作请求对应的实验操作，即在虚拟演练环境中模拟了用户的操作，从而使得用户可以在该虚拟演练环境中进行实验。
在一些可选的实施方式中，当确定该第二用户结束在虚拟演练网络中的实验操作时，云系统可以释放该虚拟演练网络占用的虚拟资源。
云系统释放该虚拟演练网络占用的虚拟资源可以包括如下步骤：释放为虚拟演练网络中的各个主机分配的计算资源以及存储资源；释放虚拟演练网络对应的网络资源；删除虚拟演练网络的安全策略规则；释放该虚拟演练网络中的各个主机分配的路由资源。
由于在第二用户结束实验操作后，虚拟演练网络对应的虚拟资源实质上一些无用的虚拟资源，通过释放虚拟演练网络对应的虚拟资源，实现对虚拟资源的回收，有助于实现对虚拟资源的循环利用。
在一些可选的实施方式中，该云系统还可以记录并保存该第二用户在虚拟演练网络中进行攻防实验操作的过程中该虚拟演练网络产生的网络流量；根据网络流量对第二用户在虚拟演练网络中的攻防实验操作进行分析。
具体实现中，云系统可以通过网络节点获取第二用户在虚拟演练网络中进行攻防实验操作的过程中虚拟演练网络产生的网络流量，网络节点将该网络流量发送给云系统中的辅助子系统，然后通过辅助子系统根据该网络流量中的IP地址、数据包类型等对网络流量进行分类，最后确定分类的网络流量所对应的实验操作并对这些操作进行分析。
在一些可能的实施例中，在第二用户在进入虚拟演练网络进行实验的过程中，第一用户还可以进入虚拟演练网络中对第二用户进行指导。这里，以目前有两个第二用户在该第一攻防课程对应的虚拟演练网络中进行实验操作为例介绍第一用户进入虚拟演练网络中对第二用户进行指导的情况。参见图6，图6是本申请实施例提供的又一种虚拟演练网络的创建方法的流程示意图，该方法在上述步骤S202之后被执行如图所示，所述方法包括：
S401，云系统获取第三用户针对第一攻防课程的第一虚拟环境启动请求。
这里，第一主机为第三用户的主机，第三用户为学习该第一攻防课程的学生用户。
云系统获取第三用户针对第一攻防课程的第一虚拟环境启动请求的实现方式可以参考步骤S203中的云系统获取第二用户针对第一攻防课程发起的虚拟环境启动请求的过程，此处不再赘述。
S402，云系统根据第一网络模板在云环境中为第三用户创建第一虚拟演练网络。
云系统根据第一网络模板在云环境中为第三用户创建第一虚拟演练网络的实现方式可以参考前述步骤S204的描述，此处不再赘述。
S403，云系统获取第三用户发起的第一攻防实验操作请求。
云系统获取第三用户发起的第一攻防实验操作请求的过程与前述图5对应的实施例类似，首先，云系统确定为第三用户创建的第三虚拟主机，然后将该第三虚拟主机对应的虚拟主机访问方式返回给第三用户，第三用户根据该第三虚拟主机对应的虚拟主机访问方式向该第三虚拟主机对应的VPS发起第一攻防实验操作请求，云系统通过该第三虚拟主机对应的VPS获取第三用户发起的第一攻防实验操作请求。
S404，云系统将第一攻防实验操作请求映射至第三虚拟主机，以使第三虚拟主机在第一虚拟演练网络中执行第一攻防实验操作请求对应的攻防操作。
这里，云系统将第一攻防实验请求映射至第三虚拟主机的方式可参考前述步骤S304 的描述，此处不再赘述。
S405，云系统获取第四用户针对第一攻防课程的第二虚拟环境启动请求。
云系统获取第四用户针对第一攻防课程的第二虚拟环境启动请求的实现方式可以参考步骤S203中的云系统获取第二用户针对第一攻防课程发起的虚拟环境启动请求的过程，此处不再赘述
S406，云系统根据第一网络模板在云环境中为第四用户创建第二虚拟演练网络。
云系统根据第一网络模板在云环境中为第四用户创建第二虚拟演练网络的实现方式可以参考前述步骤S205的描述，此处不再赘述。
这里，由于第二虚拟演练网络和第一虚拟演练网络对应的网络拓扑以及网络拓扑的参数相同，可以通过VXLAN来对第一虚拟演练网络和第二虚拟演练网络进行隔离。在为第一虚拟演练网络和第二虚拟演练网络的过程中，可以为第一虚拟演练网络和第二虚拟演练网络分配不同的VXLAN编号，以将第一虚拟演练网络和第二虚拟演练网络隔离。
S407，云系统获取第四用户发起的第二攻防实验操作请求。
云系统获取第四用户发起的第二攻防实验操作请求与前述图5对应的实施例类似，首先，云系统确定为第四用户创建的第四虚拟主机，然后将该第四虚拟主机对应的虚拟主机访问方式返回给第四用户，第四用户根据该第四虚拟主机对应的虚拟主机访问方式向该第四虚拟主机对应的VPS发起第二攻防实验操作请求，云系统通过该第四虚拟主机对应的VPS获取第四用户发起的第二攻防实验操作请求。
S408，云系统将第二攻防实验操作请求映射至第四虚拟主机，以使第四虚拟主机在第二虚拟演练网络中执行第二攻防实验操作请求对应的攻防操作。
这里，云系统将第二攻防实验操作请求映射至第四虚拟主机的方式可参考前述步骤S304的描述，此处不再赘述。
S409，云系统获取第一用户针对第一攻防课程的课程实验查看请求。
云系统可以通过获取第一用户在用户系统的可视化图形界面上的操作获取第一用户针对第一攻防课程的课程实验查看请求。例如，第一用户进入第一攻防课程对应的可视化图形界面如图3中的C所示，当第一用户在图3中的C所示的可视化图形界面上点击“实验情况”时，则云系统获取到第一用户针对第一攻防课程的课程实验查看请求。
S410，云系统根据课程实验查看请求向第一用户返回第三用户和第四用户的实验情况。
具体地，云系统可以将第三用户和第四用户当前的实验进展(如实验的时长、实验进行到哪一环节，等等)以及第三用户和第四用户在其各自的虚拟演练网络中所进行的操作的记录返回给第一用户。
例如，该第一攻防课程为一门有关于漏洞检测及修复的课程，则云系统可以将第三用户和第四用户找到的漏洞情况、第三用户和第四用户修复的漏洞情况、第三用户和第四用户当前正在进行的操作以及第三用户和第四用户在查找和修复漏洞的过程中所执行的操作的记录返回给第一用户。示例性地，第三用户和第四用户找到的漏洞情况和漏洞修复可以分别如表4和表5所示：
漏洞名称 漏洞级别 是否修复
SQL注入 高 否
敏感信息泄露 高 是
… … …
表4
漏洞名称 漏洞级别 是否修复
SQL注入 高 否
html注入 中 是
… … …
表5
可以将表4和表5中的信息返回给第一用户。
S411，云系统获取第一用户发起的网络进入请求。
这里，如果第一用户发起的网络进入请求为请求进入第一虚拟演练网络的请求，云系统执行步骤S412；如果第一用户发起的网络进入请求为请求进入第二虚拟演练网络的情况，云系统执行步骤S413。
S412，云系统将网络请求映射至第三虚拟主机，以对第三虚拟主机进行控制。
S413，云系统将网络请求映射至第四虚拟主机，以对第四虚拟主机进行控制。
本申请实施例中，通过将分别在第一攻防课程对应的第一虚拟演练网络和第二虚拟演练网络中进行实验的第三用户和第四用户的实验情况返回给第一用户，使得第一用户能够根据第三用户和第四用户的实验情况了解第三用户和第三用户对课程的掌握程度，通过将第一用户的请求映射至对应的虚拟演练网络中，使得第一用户可以进入虚拟演练网络中对第三用户或第四用户进行指导，可以帮助实验的用户更快地掌握实验内容。
上面介绍了本申请实施例的方法，下面介绍本申请实施例的装置。
参见图7，图7是本申请实施例提供的一种虚拟演练网络的创建装置的组成结构示意图，该装置可以是图1所示的云系统或云系统的一部分，如图所示，所述装置50包括：
网络模板获取模块501，用于获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑以及所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
网络模板保存模块502，用于保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程第一网络模板关联表中；
虚拟网络创建模块503，用于当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，根据所述课程模板关联表中获取所述第一网络模板，所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在云环境中创建所述第一网络模板对应的虚拟演练网络。
在一种可能的设计中，所述网络拓扑的参数包括路由参数、网络参数以及主机参数，所述虚拟网络创建模块503具体用于：
根据所述主机参数生成虚拟专用服务器配置参数，并将所述虚拟专用服务器配置参数写入虚拟专用服务器配置文件，根据所述虚拟专用服务器配置文件在所述云环境中创建 虚拟主机，所述虚拟主机包括为所述第二用户创建的第一虚拟主机；
根据所述网络拓扑以及所述网络参数在所述云环境中创建虚拟网络；
根据所述路由参数在所述云环境中创建所述虚拟主机之间的虚拟路由。
在一种可能的设计中，所述装置50还包括：
连接方式返回模块504，用于将所述网络拓扑以及目标连接方式返回给所述第二用户，所述目标连接方式为所述装置在所述云环境中为所述第二用户创建的第一虚拟主机对应的虚拟主机访问方式。
在一种可能的设计中，所述装置50还包括：
第一请求接收模块505，用于获取所述第二用户根据所述目标连接方式发起的攻防实验操作请求；
第一请求映射模块506，用于将所述攻防实验操作请求映射至所述第一虚拟主机，以使所述第一虚拟主机在所述虚拟演练网络中执行所述攻防实验操作请求对应的实验操作。
在一种可能的设计中，所述装置50还包括：
虚拟资源释放模块507，用于当确定所述第二用户结束在所述虚拟演练网络中的实验操作时，释放所述虚拟演练网络在所述云环境中占用的虚拟资源。
在一种可能的设计中，所述装置50还包括：
流量保存模块508，用于记录并保存所述第二用户在所述虚拟演练网络中进行实验操作的过程中所述虚拟演练网络产生的网络流量；
操作分析模块509，用于根据所述网络流量对所述第二用户在所述虚拟演练网络中的实验操作进行分析。
在一种可能的设计中，所述装置50还包括：
第二请求接收模块510，用于获取所述第一用户针对所述第一攻防课程发起的课程实验查看请求；
实验情况返回模块511，用于根据所述课程实验查看请求向所述第一用户返回在所述第一攻防课程对应的虚拟演练网络中进行实验操作的用户的实验情况；
请求获取模块512，用于获取所述第一用户根据所述实验情况发起的网络进入请求；
第二请求映射模块513，用于将所述网络进入请求映射至所述网络进入请求对应的第二虚拟主机，以对所述第二虚拟主机进行控制。
需要说明的是，图7对应的实施例中未提及的内容可参见方法实施例的描述，这里不再赘述。
本申请实施例中，用户可以在虚拟演练网络中进行实验，可以得到更多的训练；可以使用户在学习了课程内容后能够得到与课程内容相匹配的练习，有助于提高用户的能力。
参见图8，图8是本申请实施例提供的另一种虚拟演练网络的创建装置的组成结构示意图，该装置可以为云系统或云系统的一部分，如图所示，该装置60包括处理器601、存储器602以及输入输出接口603。处理器601连接到存储器602和通信接口603，例如处理器601可以通过总线连接到存储器602和通信接口603。
处理器601被配置为支持所述保存服务器日志的装置执行图3-图6所述的保存服务 器日志的方法中相应的功能。该处理器601可以是中央处理器(Central Processing Unit，CPU)，网络处理器(Network Processor，NP)，硬件芯片或者其任意组合。上述硬件芯片可以是专用集成电路(Application-Specific Integrated Circuit，ASIC)，可编程逻辑器件(Programmable Logic Device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(Complex Programmable Logic Device，CPLD)，现场可编程逻辑门阵列(Field-Programmable Gate Array，FPGA)，通用阵列逻辑(Generic Array Logic,GAL)或其任意组合。
存储器602存储器用于存储程序代码等。存储器602可以包括易失性存储器(Volatile Memory，VM)，例如随机存取存储器(Random Access Memory，RAM)；存储器602也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如只读存储器(Read-Only Memory，ROM)，快闪存储器(flash memory)，硬盘(Hard Disk Drive，HDD)或固态硬盘(Solid-State Drive，SSD)；存储器602还可以包括上述种类的存储器的组合。本申请实施例中，存储器602用于存储保存服务器日志的应用程序。
所述通信接口603用于输入或输出数据。
处理器601可以调用所述程序代码以执行以下操作：
获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程模板关联表中；
当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，根据所述课程模板关联表获取所述第一网络模板；
根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在云系统的云环境中创建所述第一网络模板对应的虚拟演练网络。需要说明的是，各个操作的实现还可以对应参照图2-图6所示的方法实施例的相应描述；所述处理器601还可以与通信接口603配合执行上述方法实施例中的其他操作。
本申请实施例还提供一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被计算机执行时使所述计算机执行如前述实施例所述的方法，所述计算机可以为上述提到的虚拟演练网络的创建装置的一部分。例如为上述的处理器601。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的程序可存储于一计算机可读取存储介质中，该程序在执行时，可包括如上述各方法的实施例的流程。其中，所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory，ROM)或随机存储记忆体(Random Access Memory，RAM)等。
以上所揭露的仅为本申请较佳实施例而已，当然不能以此来限定本申请之权利范围，因此依本申请权利要求所作的等同变化，仍属本申请所涵盖的范围。

Claims (20)

  1. 一种虚拟演练网络的创建方法，其特征在于，包括：
    云系统获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
    所述云系统保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程模板关联表中；
    当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，所述云系统根据所述课程模板关联表获取所述第一网络模板；
    所述云系统根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云系统的云环境中创建所述第一网络模板对应的虚拟演练网络。
  2. 根据权利要求1所述的方法，其特征在于，所述云系统根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云系统的云环境中创建所述第一网络模板对应的虚拟演练网络包括：
    所述云系统根据所述主机参数生成虚拟专用服务器配置参数，并将所述虚拟专用服务器配置参数写入虚拟专用服务器配置文件，根据所述虚拟专用服务器配置文件在所述云环境中创建虚拟主机，所述虚拟主机包括为所述第二用户创建的第一虚拟主机；
    所述云系统根据所述网络拓扑以及所述网络参数在所述云环境中创建虚拟网络；
    所述云系统根据所述路由参数在所述云环境中创建所述虚拟主机之间的虚拟路由。
  3. 根据权利要求1或2所述的方法，其特征在于，所述云系统根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云系统的云环境中创建所述第一网络模板对应的虚拟演练网络之后，还包括：
    所述云系统将所述网络拓扑以及目标连接方式返回给所述第二用户，所述目标连接方式为所述云系统在所述云环境中为所述第二用户创建的第一虚拟主机对应的虚拟主机访问方式。
  4. 根据权利要求3所述的方法，其特征在于，所述云系统将所述网络拓扑以及所述目标连接方式返回给所述第二用户之后，还包括：
    所述云系统获取所述第二用户根据所述目标连接方式发起的攻防实验操作请求；
    所述云系统将所述攻防实验操作请求映射至所述第一虚拟主机，以使所述第一虚拟主机在所述虚拟演练网络中执行所述攻防实验操作请求对应的实验操作。
  5. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    当确定所述第二用户结束在所述虚拟演练网络中的实验操作时，所述云系统释放所述虚拟演练网络在所述云环境中占用的虚拟资源。
  6. 根据要求4所述的方法，其特征在于，所述方法还包括：
    所述云系统记录并保存所述第二用户在所述虚拟演练网络中进行攻防实验操作的过程中所述虚拟演练网络产生的网络流量；
    所述云系统根据所述网络流量对所述第二用户在所述虚拟演练网络中的实验操作进 行分析。
  7. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述云系统获取所述第一用户针对所述第一攻防课程发起的课程实验查看请求；
    所述云系统根据所述课程实验查看请求向所述第一用户返回在所述第一攻防课程对应的虚拟演练网络中进行实验操作的用户的实验情况；
    所述云系统获取所述第一用户根据所述实验情况发起的网络进入请求；
    所述云系统将所述网络进入请求映射至所述网络进入请求对应的第二虚拟主机，以对所述第二虚拟主机进行控制。
  8. 一种虚拟演练网络的创建装置，其特征在于，包括：
    网络模板获取模块，用于获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑以及所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
    网络模板保存模块，用于保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程模板关联表中；
    虚拟网络创建模块，用于当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，根据所述课程模板关联表获取所述第一网络模板，并根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在云系统的云环境中创建所述第一网络模板对应的虚拟演练网络，所述云系统包括所述装置。
  9. 根据权利要求8所述的装置，其特征在于，所述虚拟网络创建模块具体用于：
    根据所述主机参数生成虚拟专用服务器配置参数，并将所述虚拟专用服务器配置参数写入虚拟专用服务器配置文件，根据所述虚拟专用服务器配置文件在所述云环境中创建虚拟主机，所述虚拟主机包括为所述第二用户创建的第一虚拟主机；
    根据所述网络拓扑以及所述网络参数在所述云环境中创建虚拟网络；
    根据所述路由参数在所述云环境中创建所述虚拟主机之间的虚拟路由。
  10. 根据权利要求8或9所述的装置，其特征在于，所述装置还包括：
    连接方式返回模块，用于将所述网络拓扑以及目标连接方式返回给所述第二用户，所述目标连接方式为所述装置在所述云环境中为所述第二用户创建的第一虚拟主机对应的虚拟主机访问方式。
  11. 根据权利要求10所述的装置，其特征在于，所述装置还包括：
    第一请求接收模块，用于获取所述第二用户根据所述目标连接方式发起的攻防实验操作请求；
    第一请求映射模块，用于将所述攻防实验操作请求映射至所述第一虚拟主机，以使所述第一虚拟主机在所述虚拟演练网络中执行所述攻防实验操作请求对应的实验操作。
  12. 根据权利要求11所述的装置，其特征在于，所述装置还包括：
    虚拟资源释放模块，用于当确定所述第二用户结束在所述虚拟演练网络中的实验操作时，释放所述虚拟演练网络在所述云环境中占用的虚拟资源。
  13. 根据权利要求11所述的装置，其特征在于，所述装置还包括：
    流量保存模块，用于记录并保存所述第二用户在所述虚拟演练网络中进行实验操作的过程中所述虚拟演练网络产生的网络流量；
    操作分析模块，用于根据所述网络流量对所述第二用户在所述虚拟演练网络中的实验操作进行分析。
  14. 根据权利要求8所述的装置，其特征在于，所述装置还包括：
    第二请求接收模块，用于获取所述第一用户针对所述第一攻防课程发起的课程实验查看请求；
    实验情况返回模块，用于根据所述课程实验查看请求向所述第一用户返回在所述第一攻防课程对应的虚拟演练网络中进行实验操作的用户的实验情况；
    请求获取模块，用于获取所述第一用户根据所述实验情况发起的网络进入请求；
    第二请求映射模块，用于将所述网络进入请求映射至所述网络进入请求对应的第二虚拟主机，以对所述第二虚拟主机进行控制。
  15. 一种虚拟演练网络的创建装置，其特征在于，包括处理器、存储器以及通信接口，所述处理器、存储器和通信接口相互连接，其中，所述通信接口用于传输数据，所述存储器用于存储程序代码，所述处理器用于调用所述程序代码，执行以下操作：
    获取第一用户针对第一攻防课程创建的第一网络模板，所述第一网络模板包括网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数；
    保存所述第一网络模板，并将所述第一网络模板与所述第一攻防课程的对应关系保存在课程模板关联表中；
    当获取到第二用户针对所述第一攻防课程发起的虚拟环境启动请求时，根据所述课程模板关联表获取所述第一网络模板；
    根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云系统的云环境中创建所述第一网络模板对应的虚拟演练网络。
  16. 根据权利要求15所述的装置，其特征在于，所述处理器执行所述根据所述网络拓扑、所述网络拓扑对应的路由参数、所述网络拓扑对应的网络参数以及所述网络拓扑对应的主机参数在所述云环境中创建所述第一网络模板对应的虚拟演练网络的操作，包括：
    根据所述主机参数生成虚拟专用服务器配置参数，并将所述虚拟专用服务器配置参数写入虚拟专用服务器配置文件，根据所述虚拟专用服务器配置文件在所述云环境中创建虚拟主机，所述虚拟主机包括为所述第二用户创建的第一虚拟主机；
    根据所述网络拓扑以及所述网络参数在所述云环境中创建虚拟网络；
    根据所述路由参数在所述云环境中创建所述虚拟主机之间的虚拟路由。
  17. 根据权利要求15或16所述的装置，其特征在于，所述处理器还用于执行以下操作：
    将所述网络拓扑以及目标连接方式返回给所述第二用户，所述目标连接方式为所述装置在所述云环境中为所述第二用户创建的第一虚拟主机对应的虚拟主机访问方式。
  18. 根据权利要求17所述的装置，其特征在于，所述处理器还用于执行以下操作：
    获取所述第二用户根据所述目标连接方式发起的攻防实验操作请求；
    将所述攻防实验操作请求映射至所述第一虚拟主机，以使所述第一虚拟主机在所述虚拟演练网络中执行所述攻防实验操作请求对应的实验操作。
  19. 根据权利要求18所述的装置，其特征在于，所述处理器还用于执行以下操作：
    当确定所述第二用户结束在所述虚拟演练网络中的实验操作时，释放所述虚拟演练网络在所述云环境中占用的虚拟资源。
  20. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质存储有计算机程序，所述计算机程序包括程序指令，所述程序指令当被处理器执行时使所述处理器执行如权利要求1-7任一项所述的方法。
PCT/CN2018/107633 2018-07-26 2018-09-26 虚拟演练网络的创建方法和装置 WO2020019475A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810852267.1A CN108965021B (zh) 2018-07-26 2018-07-26 虚拟演练网络的创建方法和装置
CN201810852267.1 2018-07-26

Publications (1)

Publication Number Publication Date
WO2020019475A1 true WO2020019475A1 (zh) 2020-01-30

Family

ID=64466337

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/107633 WO2020019475A1 (zh) 2018-07-26 2018-09-26 虚拟演练网络的创建方法和装置

Country Status (2)

Country Link
CN (1) CN108965021B (zh)
WO (1) WO2020019475A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117097627A (zh) * 2023-10-19 2023-11-21 中国人民解放军国防科技大学 渗透测试智能体训练与验证环境构建方法及电子设备

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109495324B (zh) * 2018-12-26 2021-12-24 武汉职业技术学院 一种虚拟训练通信网络构建方法及系统
CN111654402B (zh) * 2020-06-23 2023-08-01 中国平安财产保险股份有限公司 网络拓扑创建方法、装置、设备及存储介质
CN112447076A (zh) * 2020-11-05 2021-03-05 贵州数安汇大数据产业发展有限公司 一种风险可控的实网攻防演练系统
CN112118272B (zh) * 2020-11-18 2021-01-15 中国人民解放军国防科技大学 基于仿真实验设计的网络攻防推演平台
CN113162954B (zh) * 2021-06-23 2021-09-03 西南石油大学 靶机的创建方法以及网络攻防训练系统
CN115334698B (zh) * 2022-07-20 2023-05-23 烽台科技（北京）有限公司 靶场目标5g安全网络的构建方法、装置、终端及介质
CN117640260B (zh) * 2024-01-25 2024-04-12 天津丈八网络安全科技有限公司 一种基于事件驱动的仿真网络攻防演练方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103701777A (zh) * 2013-12-11 2014-04-02 长春理工大学 基于虚拟化和云技术的远程网络攻防虚拟仿真系统
CN104900102A (zh) * 2015-04-13 2015-09-09 成都双奥阳科技有限公司 基于虚拟环境的攻防演练系统
CN106790046A (zh) * 2016-10-11 2017-05-31 长春理工大学 基于超融合架构的网络攻防虚拟仿真系统

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11522977B2 (en) * 2015-10-09 2022-12-06 Niranjan Suri System and method to optimize communications in tactical networks by computing and using information value
CN107222325A (zh) * 2016-03-22 2017-09-29 中兴通讯股份有限公司 一种虚拟网络的生成方法和装置
CN106789233B (zh) * 2016-12-16 2020-07-24 华北电力科学研究院有限责任公司 一种网络攻防实验平台的自动评分方法及装置
CN107885578A (zh) * 2017-11-13 2018-04-06 新华三云计算技术有限公司 一种虚拟机资源分配方法及装置
CN108170656B (zh) * 2017-12-28 2021-09-07 创新先进技术有限公司 模板创建方法、文档创建方法、渲染方法和装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103701777A (zh) * 2013-12-11 2014-04-02 长春理工大学 基于虚拟化和云技术的远程网络攻防虚拟仿真系统
CN104900102A (zh) * 2015-04-13 2015-09-09 成都双奥阳科技有限公司 基于虚拟环境的攻防演练系统
CN106790046A (zh) * 2016-10-11 2017-05-31 长春理工大学 基于超融合架构的网络攻防虚拟仿真系统

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117097627A (zh) * 2023-10-19 2023-11-21 中国人民解放军国防科技大学 渗透测试智能体训练与验证环境构建方法及电子设备
CN117097627B (zh) * 2023-10-19 2023-12-22 中国人民解放军国防科技大学 渗透测试智能体训练与验证环境构建方法及电子设备

Also Published As

Publication number Publication date
CN108965021B (zh) 2021-09-07
CN108965021A (zh) 2018-12-07

Similar Documents

Publication Publication Date Title
WO2020019475A1 (zh) 虚拟演练网络的创建方法和装置
US20230006915A1 (en) Cloud Network Reachability Analysis for Virtual Private Clouds
US20190199623A1 (en) Using headerspace analysis to identify flow entry reachability
CN105612735B (zh) 可靠地址发现高速缓存
CN105684357A (zh) 虚拟机中地址的管理
US8423734B2 (en) Making automated use of data volume copy service targets
US20190334868A1 (en) Accessing cloud resources using private network addresses
US10846377B2 (en) Secure file sharing using semantic watermarking
TWI338838B (en) Method for mapping an iscsi target name to a storage resource based on an initiator hardware class identifier
CN107547242B (zh) Vm配置信息的获取方法及装置
US10180845B1 (en) System and methods for network booting
Miseviciene et al. Educational infrastructure using virtualization technologies: Experience at kaunas university of technology
US10789088B2 (en) Peer-to-peer license enforcement in virtualized computing environments
Kelbley et al. Windows Server 2008 Hyper-V: Insiders Guide to Microsoft's Hypervisor
Zhan et al. CIADL: cloud insider attack detector and locator on multi-tenant network isolation: an OpenStack case study
WO2017096951A1 (zh) 一种虚拟机更新方法和装置
CN111736947A (zh) 一种开放式多人线上教学教学系统及实验方法
CN110995489A (zh) 大数据平台服务器管理方法、装置、服务器及存储介质
US20220294699A1 (en) Network Reachability Impact Analysis
Anderson et al. Student experiential learning of cyber security through virtualization.
Sianipar et al. Crowdsourcing virtual laboratory architecture on hybrid cloud
Terashima et al. Kakoi: A new tool to make simple and secure build cyber ranges using public cloud
CN107016289B (zh) 基于Web操作系统的移动瘦终端安全模型建立方法及装置
Iguchi et al. Development of hands-on IP network practice system with automatic scoring function
Wazan et al. Which Virtualization Technology is Right for My Online IT Educational Labs?

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18927313

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18927313

Country of ref document: EP

Kind code of ref document: A1