Automatic penetration testing method for information system security

Abstract

The invention belongs to the technical field of network security and discloses an automatic penetration testing method for information system security. A penetration testing platform is built to automatically scan the mainframe state of an information system and the security loopholes of a topological structure and the information system, to analyze the loophole information, to automatically transfer a verification script in a loophole verification base for attacking a target system, to obtain and improve the target control authority and to remove the access trace after finishing the penetration attack. Finally, the whole penetration testing process and result are recorded and analyzed to generate a testing report. According to the method, the penetration testing flow is comprehensively considered and the existing security analyzing tools are fully utilized to design various tools for packing an automatic penetration testing module, so that the automatic transfer and execution of the tools are achieved, and the completeness of the penetration testing process is improved. Through the exchange utilization of data among different modules and the automatic analysis and arrangement of the result output of the security analyzing tools, the efficiency and automatic degree of the penetration testing are improved.

Description

technical field [0001] The invention belongs to the technical field of network security, and relates to an automatic penetration testing method for information system security. Background technique [0002] With the rapid development of information technology, security vulnerabilities have caused great security risks to information systems, opened the door for malicious intrusion by attackers, and become the entrance and way for malicious codes such as Trojan horses to spread wantonly. With the development of information technology, the security problem of information system is becoming more and more prominent. In order to discover the security problems existing in the information system as early as possible and determine the degree of harm, it is necessary to conduct in-depth penetration tests on the security of the information system periodically. [0003] Penetration testing can simulate real attacks, use vulnerability discovery techniques and attack methods, conduct in-...

AI Technical Summary

Problems solved by technology

This situation cannot meet the needs of efficient and automated penetration testing

[0006] Lack of an effective automated penetration testing platform. The data formats among the various tools required for testing are different, and independent interaction cannot be performed. Testers need to manually integrate data to drive the penetration testing process. The degree of manual participation is high and cannot meet the needs of automation. Penetration Testing Requirements

Images