Automated safety penetration test method

Abstract

The invention discloses an automated safety penetration test method, comprising: step 1, training an automated response model, establishing a corresponding model; step 2, scanning a target information system, obtaining host information; step 3, scanning vulnerability of the target information system, obtaining vulnerability information; step 4, according to the host information and the vulnerability information obtained in the step 2 and step 3, combined with an attack strategy library, establishing an attack model, according to the attack model, trying to attack the target information system, obtaining an attack feedback result; step 5, performing comprehensive analysis on a penetration test overall process, generating a penetration test report and teasing test steps and intermediate results, analyzing system security, providing a related solution; step 6, the response model updating in an adaptive manner, and regulating a response strategy.

Description

technical field [0001] The invention belongs to the field of network security and relates to an automatic security penetration test method. Background technique [0002] With the rapid development of information technology, security vulnerabilities have caused great security risks to information systems, and have become the entrance and way for malicious codes such as Trojan horses to spread. In order to discover the security problems existing in the information system as early as possible and determine the degree of harm, it is necessary to periodically conduct penetration tests on the information systems and perform system security repairs based on the results of the penetration tests. [0003] Penetration testing refers to the process in which security engineers simulate the information detection technology, vulnerability assessment technology and attack means used by hackers, conduct in-depth detection of the security of the target, and find the most vulnerable part of t...

AI Technical Summary

Problems solved by technology

[0005] (1) The penetration testing process requires the use of a variety of security analysis tools. Due to the different penetration strategies, functions and usage methods of various tools, this situation cannot meet the needs of efficient and automated penetration testing

[0006] (2) There is a lack of an effective test platform that combines manual and automated testing. The data formats among the various tools required for testing are not uniform, and independent interaction cannot be performed. It requires testers to spend a lot of time and energy on data integration to drive penetration testing. process, unable to meet high-frequency penetration testing requirements

Images