Domain penetration attack path generation method based on graph structure

Abstract

The invention discloses a graph structure-based domain penetration attack path generation method, which belongs to the technical field of network security, and comprises the following steps of: constructing a multi-level relation graph comprising a host node, a service node and a user node through automatic detection by taking any host in a domain as a starting point; assigning a weight attribute to the atlas edge based on a vulnerability library and an attack pattern library; an improved heuristic graph search algorithm is adopted, all feasible attack paths and threat scores thereof are generated by integrating the path length, attack difficulty and permission improvement effect, and the problem that the threat scores of all the feasible attack paths are influenced in various scenes and dynamic change domain environments is solved. The technical problems of realizing comprehensive automatic penetration testing, accurately identifying potential attack paths and establishing a systematic threat assessment mechanism are solved, the automation, intelligence and high-efficiency level of domain penetration testing is remarkably improved, and the method has good adaptability, expansibility and practical value and is suitable for popularization and application. And attack path discovery and risk early warning work in a dynamic network environment with high security requirements can be effectively supported.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a method for generating a domain penetration attack path based on a graph structure. Background Art

[0002] With the widespread deployment of information systems across various industries, enterprise network environments are becoming increasingly complex. Identity authentication and resource access control systems, particularly those represented by Windows domains, have become crucial components of network infrastructure. However, domain environments are often characterized by complex permission inheritance, widespread asset exposure, and long chains of trust relationships. Once an attacker gains control of a host within a domain, they can exploit trust relationships, user permissions, and system configuration vulnerabilities within the domain to launch escalating lateral movement and privilege escalation attacks, ultimately achieving control of the entire domain environment.

[0003] Deficiencies of existing technology: Existing penetration path analysis tools mostly rely on manual combing of asset information or static rule matching, which are inefficient, inaccurate, and poorly real-time, making them difficult to adapt to dynamically changing enterprise network structures.

[0004] Existing technologies generally ignore the combinatorial and correlational nature of attack behaviors, lack the ability to assess the threat level of attack paths from a global perspective, and are unable to meet the current needs of advanced persistent threat (APT) defense. Summary of the Invention

[0005] The purpose of this invention is to provide a domain penetration attack path generation method based on a graph structure, which solves the technical problems of achieving comprehensive automated penetration testing, accurately identifying potential attack paths, and establishing a systematic threat assessment mechanism in various scenarios and dynamically changing domain environments.

[0006] To achieve the above object, the present invention adopts the following technical solutions: A method for generating a domain penetration attack path based on a graph structure includes the following steps: Step 1: Select a host in the domain as the starting point of the attack, deploy a topology discovery module on the host, and establish an information collector in the topology discovery module. The information collector collects information from each key node in the domain and outputs the domain information set; Step 2: The relationship graph construction module retrieves the domain information set, classifies and analyzes each entity information, extracts node attributes, constructs attack edges, sets weight calculation rules, generates a configuration file, constructs a network relationship graph based on the configuration file, and outputs the graph structure and weight configuration results of the network relationship graph; The graph structure of the network relationship graph includes node attributes, attack edges and weight calculation rules; Step 3: The attack path analysis module performs multiple rounds of attack path searches based on the graph structure and weight configuration results, starting with the host where the topology discovery module is located. During the search process, the feasibility of candidate paths is determined one by one based on the attack edge conditions and node attributes. Candidate paths that meet the conditions are added to the secondary candidate set. A scoring model is established based on the edge type, node weight, and the importance of the key target to assign threat scores to the candidate paths in the secondary candidate set. A state feedback mechanism is introduced during the search process to adjust the parameters of the network relationship graph in real time, thereby optimizing the search efficiency and ultimately outputting all feasible attack paths and corresponding threat score results.

[0007] Preferably, the key nodes include hosts, servers and network devices.

[0008] Preferably, when executing step 1, the following steps are specifically included: Step 1-1: Select a controlled host in the subdomain as the attack starting point and deploy an information collector; Step 1-2: Utilize the two-way trust relationship in the Windows domain forest to interact with the Windows domain's Active Directory database to collect information, including the domain name, domain identity information, domain controller list, domain controller list, domain server list, high-privilege and special user group members, domain delegation information, and service principal names; Steps 1-3: Collect information about the operating system of the hosts in the domain and the current logged-in user and high-privilege users by sending SMB probe packets or querying the remote registry. Step 1-4: Summarize the various information collected in steps 1-2 to 1-3, construct the domain information set, and output it.

[0009] Preferably, when executing step 2, a configuration file is generated according to the topological relationship and vulnerability information of the target host.

[0010] Preferably, when executing step 2, the following steps are specifically included: Step 2-1: The relationship graph construction module calls the domain information set, parses and classifies various entities, and defines node attributes; Host node: stored in the format of IP-OS-port; Service node: Associated with the corresponding host node, recording service type and version information; User node: Identified in the domain name\user name format, recording group relationships and permission information; The above node attributes are stored in the database. During the penetration analysis process, the node attributes are dynamically updated according to the latest scan results. Based on the analysis and classification results of various entities, a network relationship map is constructed; Step 2-2: In the network relationship graph, define attack edges based on vulnerability exploitation relationships. Each attack edge contains a source node and a target node. Add a traversed or untraversed mark to the attack edge; When the number of attacking edges is too large, prior knowledge is used for optimization, specifically: Step 2-2-1: First, use the edge combination method to combine vulnerabilities with the same attack conditions and results into the same type of edge; Step 2-2-2: Then directly combine the fixed attack sequence into a composite edge; Step 2-2-3: Based on the optimization results of steps 2-2-1 and 2-2-3, construct the optimized attack edge set and output it; Step 2-3: Based on the characteristics of the attacking edge and the node, establish a path search, set the weight calculation rules, and generate the weight configuration results according to the weight calculation rules. Specifically: For privilege escalation edges: set weights based on the extent of privilege escalation; For domain control-related edges: give special weights to highlight their criticality; For edges that obtain domain administrator credentials: give additional reward weight; Step 2-4: Output the graph structure and weight configuration results of the network relationship graph.

[0011] Preferably, when executing step 3, the following steps are specifically included: Step 3-1: Initialize the graph structure state; Step 3-2: Execute the first round of path search, starting from the host where the topology discovery module is located, traverse the feasible attack edges in the graph structure that meet the attack conditions, and build a candidate path set; Step 3-3: Perform threat scoring on the candidate paths in the candidate path set. Calculate the path threat score based on the attack edge type, node feature weight, and key edge reward value. The scoring model is as follows: ; Among them, W (E i ) is the attacking edge E i The weight score, W(N i ) is the node N in the path i The feature weight of R(E i ) is the reward value, which gives additional promotion to key edges; m is the total number of candidate paths; Step 3-4: When a valid path is found, the edges involved in the valid path are marked as traversed, and the weights of the relevant nodes and edges in the graph structure are adaptively adjusted based on the information of the current valid path. The specific adaptive adjustment method is to use a quasi-reinforcement learning mechanism for adjustment: ; ; ; Among them, α, β, and λ are preset learning rates, which are used to control the intensity of weight adjustment; W′(E i ) is the weight score of the adjusted attack edge Ei, W′(N i ) is the feature weight of node Ni in the adjusted path; R′(E i ) is the adjusted reward value; Step 3-5: Repeat the valid path discovery and scoring process from step 3-2 to step 3-4 until there are no new valid paths. Finally, merge, deduplicate, and cluster all paths to obtain the attack path set and its corresponding threat score.

[0012] The graph-based domain penetration attack path generation method described in this invention solves the technical problems of achieving comprehensive automated penetration testing, accurately identifying potential attack paths, and establishing a systematic threat assessment mechanism in various scenarios and dynamically changing domain environments. This invention automates and intelligentizes domain penetration testing. Traditional penetration testing relies on manual operations and experience-driven methods, resulting in low efficiency, high costs, and susceptibility to human error. By constructing a graph-based model and introducing an intelligent learning mechanism, this method can automatically identify, model, and assess attack paths. It can automatically complete information collection, path generation, and threat scoring without human intervention, significantly improving the efficiency, accuracy, and comprehensiveness of penetration testing. This method is suitable for automated penetration assessment tasks in large-scale, complex network environments, effectively processing large state spaces and improving path search efficiency. In Windows domain environments, with their large number of hosts and complex trust relationships, traditional path analysis often encounters computational bottlenecks when faced with massive states and attack actions. This invention constructs an attack relationship graph using a graph structure and combines attack edge pruning strategies, composite edge construction, and a priori knowledge optimization mechanism to significantly compress the action space. During the graph traversal process, redundant paths can be quickly eliminated, focusing on the most likely successful attack sequences, achieving efficient convergence and accurate output of path searches, significantly reducing analysis time and resource overhead, and possessing dynamic self-adaptation and continuous learning capabilities. The present invention supports real-time updates of graph information, node attributes, and attack edge relationships based on changes in network structure and asset status in a real operating environment, and possesses good environmental adaptability. At the same time, the path scoring and traversal strategies can be dynamically adjusted based on the results of each path analysis, continuously optimizing the model effect and enhancing the system's responsiveness to new vulnerabilities, new topologies, and new attack methods. Compared to static scanning tools, the present invention can better maintain the timeliness and accuracy of analysis in a dynamic network environment, has good structural scalability and engineering implementation capabilities, and adopts a modular design. The information collector, graph builder, path analysis engine, and scoring mechanism can be independently deployed and expanded, supporting adaptation and integration of different network structures, different protocol types, and multiple types of attack methods, facilitating collaborative linkage with existing security protection systems. It can be used as an enterprise-level attack path assessment platform, and can also be embedded in the red team automated testing framework, vulnerability mining platform and security situation awareness system. It has broad application prospects. It not only significantly improves the automation, intelligence and efficiency of domain penetration testing, but also has good adaptability, scalability and practical value. It can effectively support attack path discovery and risk warning work in dynamic and high-security network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is the overall flow chart of the present invention; Figure 2 This is a flow chart of information collection by the information collector of the present invention. DETAILED DESCRIPTION

[0014] Depend on Figure 1-Figure 2 The method for generating a domain penetration attack path based on a graph structure shown in FIG. 1 includes the following steps: Step 1: Select a host in the domain as the starting point of the attack, deploy a topology discovery module on the host, and establish an information collector in the topology discovery module. The information collector collects information from each key node in the domain and outputs the domain information set; The key nodes include hosts, servers and network equipment; When executing step 1, the specific steps include: Step 1-1: Select a controlled host in the subdomain as the attack starting point and deploy an information collector; Step 1-2: Utilize the two-way trust relationship in the Windows domain forest to interact with the Windows domain's Active Directory database to collect information, including the domain name, domain identity information, domain controller list, domain controller list, domain server list, high-privilege and special user group members, domain delegation information, and service principal names; Steps 1-3: Collect information about the operating system of the hosts in the domain and the current logged-in user and high-privilege users by sending SMB probe packets or querying the remote registry. Step 1-4: Summarize the various information collected in steps 1-2 to 1-3, construct the domain information set, and output it.

[0015] This embodiment selects any controlled host in a subdomain as the starting point of the attack and deploys an information collector. In a Windows domain, the forest is the security boundary of the logical structure. Each subdomain that joins the Windows domain forest will establish a two-way trust relationship with the forest root domain, and in the same domain forest, if the user has access rights to a certain resource, cross-domain access can be achieved. The collector will use these trust relationships to conduct comprehensive information collection when interacting with the Active Directory database of the Windows domain. This information includes domain name, domain identity information, a list of ordinary hosts in the domain, a list of domain controllers, a list of servers in the domain, members of high-privilege and special user groups, delegation information in the domain, and service principal names.

[0016] In addition to the information in the Active Directory, the collector also collects operating system information, current logged-in users, and high-privilege user information of hosts in the domain by sending SMB probe packets and querying the remote registry.

[0017] Step 2: The relationship graph construction module retrieves the information set within the domain, classifies and analyzes the information of each entity, extracts node attributes, constructs attack edges and sets weight calculation rules, generates a configuration file, constructs a network relationship graph through the configuration file, and outputs the graph structure and weight configuration results of the network relationship graph.

[0018] When executing step 2, the specific steps include: Step 2-1: The relationship graph construction module calls the domain information set, parses and classifies various entities, and defines node attributes; Host node: stored in the format of IP-OS-port; Service node: Associated with the corresponding host node, recording service type and version information; User node: Identified in the domain name\user name format, recording group relationships and permission information; The above node attributes are stored in the database. During the penetration analysis process, the node attributes are dynamically updated according to the latest scan results. Based on the analysis and classification results of various entities, a network relationship map is constructed; In this embodiment, node attributes are used to accurately describe the security status of each entity within the domain. Nodes are categorized into three types: host nodes, service nodes, and user nodes, depending on the entity type. Host nodes are stored in the database in the format of "IP-operating system-open port," for example, "172.16.253.17-Windows7-22,80,445." Service nodes are associated with corresponding host nodes, annotated with service type and version information. User nodes are identified in the format of "domain name\user name" and store group relationships and permissions. During the penetration process, node attributes are dynamically updated to reflect the latest security status.

[0019] Step 2-2: In the network relationship graph, define attack edges based on vulnerability exploitation relationships. Each attack edge contains a source node and a target node. Add a traversed or untraversed mark to the attack edge; When the number of attacking edges is too large, prior knowledge is used for optimization, specifically: Step 2-2-1: First, use the edge combination method to combine vulnerabilities with the same attack conditions and results into the same type of edge; Step 2-2-2: Then directly combine the fixed attack sequence into a composite edge; Step 2-2-3: Based on the optimization results of steps 2-2-1 and 2-2-3, construct the optimized attack edge set and output it; In this embodiment, in the definition of attack edges, each edge is discrete and has a clear source node and target node. The attack edge comprehensively considers the frequency and implementation difficulty of various types of vulnerabilities in Windows domain penetration. During the analysis process in a real domain environment, repeated traversal of edges will cause the system to run for a long time. Therefore, during the automated path analysis process, each edge in the graph is marked to determine whether it has been traversed, to reduce the problem of long system running time. At the same time, if the number of attack edges is too large, it will also lead to an increase in analysis time. For this reason, prior knowledge is introduced to optimize the edge set: certain vulnerability exploits with exactly the same attack conditions and attack results are classified as the same type of edge; certain fixed attack sequences are directly combined into a composite edge.

[0020] Step 2-3: Based on the characteristics of the attacking edge and the node, establish a path search, set the weight calculation rules, and generate the weight configuration results according to the weight calculation rules. Specifically: For privilege escalation edges: set weights based on the extent of privilege escalation; For domain control-related edges: give special weights to highlight their criticality; For edges that obtain domain administrator credentials: give additional reward weight; In this embodiment, attack paths are discovered by analyzing the nodes and edges in the graph. The weight of each edge reflects the difficulty and risk of the corresponding attack step. The design of the weight calculation rules can guide the algorithm to prioritize high-risk attack paths. For domain penetration scenarios, weights are divided into the following parts: For privilege escalation edges, weights are set according to the degree of privilege escalation; edges related to domain control are given special weight consideration; and edges that obtain domain administrator credentials are given corresponding weight rewards.

[0021] Step 2-4: Output the graph structure and weight configuration results of the network relationship graph.

[0022] Based on the collected information, this embodiment conducts a detailed analysis of the exposed information of each host and each domain. It then constructs a network relationship map based on penetration testing experience and vulnerability threat levels. Finally, it combines potential vulnerabilities with the collected topology information to generate a configuration file, which is used to build a complete attack path analysis model. The network relationship map performs automated path analysis based on node attributes and attack edge weights. This requires clear definition of each element in the map. Therefore, this embodiment defines node attributes, attack edges, and weight calculation rules based on the configuration file.

[0023] Step 3: The attack path analysis module performs multiple rounds of attack path searches based on the graph structure and weight configuration results, starting with the host where the topology discovery module is located. During the search process, the feasibility of candidate paths is determined one by one based on the attack edge conditions and node attributes. Candidate paths that meet the conditions are added to the secondary candidate set. A scoring model is established based on the edge type, node weight, and the importance of the key target to assign threat scores to the candidate paths in the secondary candidate set. A state feedback mechanism is introduced during the search process to adjust the parameters of the network relationship graph in real time, thereby optimizing the search efficiency and ultimately outputting all feasible attack paths and corresponding threat score results.

[0024] When executing step 3, the specific steps include: Step 3-1: Initialize the graph structure state; initialize the graph state and perform the first round of path discovery. Starting from the host where the topology discovery module is located, traverse the feasible attack edges in the graph that meet the attack conditions and build an initial set of candidate paths.

[0025] In this embodiment, the initial state is set as follows: the system uses the host where the topology discovery module is located as the starting point of the path search, and loads the attack edges (such as privilege escalation edges, lateral movement edges, domain control edges) and node attributes (such as credential status, service information, and permission level) contained in the graph.

[0026] This embodiment traverses the current graph for feasible attack edges that meet attack conditions, such as whether the target service port is open and whether the target user group's permissions meet the edge conditions. Subpaths that meet the conditions are added to the candidate path set, and path-related information is recorded, including the starting node, edge type, and estimated security value of the target node.

[0027] Make a path Contains nodes and edges: P k ={N1,E1,N2,...,N m}, use the judgment formula: ; in: Represents an edge The degree of satisfaction of the conditions, such as whether the port is open, whether the user has high permissions, etc. Represents an attack path P K overall effectiveness.

[0028] Step 3-2: Execute the first round of path search, starting from the host where the topology discovery module is located, traverse the feasible attack edges in the graph structure that meet the attack conditions, and build a candidate path set; Step 3-3: Perform threat scoring on the candidate paths in the candidate path set. Calculate the path threat score based on the attack edge type, node feature weight, and key edge reward value. The scoring model is as follows: ; Among them, W (E i ) is the attacking edge E i The weight score, W(N i ) is the node N in the path i The feature weight of R(E i ) is the reward value, which gives additional promotion to key edges (such as domain administrator credential edge); m is the total number of candidate paths; In this implementation, the potential threat level of a path is calculated based on the type of attack edge and the characteristics of key nodes along the path. Scoring weights are determined based on: attack edge type (privilege escalation edge, lateral movement edge, domain control edge); and node importance (domain administrator credentials, domain controller, etc.).

[0029] Step 3-4: When a valid path is found, the edges involved in the valid path are marked as traversed, and the weights of the relevant nodes and edges in the graph structure are adaptively adjusted based on the information of the current valid path. The specific adaptive adjustment method is to use a quasi-reinforcement learning mechanism for adjustment: ; ; ; Among them, α, β, and λ are preset learning rates, which are used to control the intensity of weight adjustment; W′(E i ) is the weight score of the adjusted attack edge Ei, W′(N i ) is the feature weight of node Ni in the adjusted path; R′(E i ) is the adjusted reward value; Step 3-5: Repeat the valid path discovery and scoring process from step 3-2 to step 3-4 until there are no new valid paths. Finally, merge, deduplicate, and cluster all paths to obtain the attack path set and its corresponding threat score.

[0030] The present invention can automatically perform comprehensive attack path analysis in various scenarios and dynamically changing domain scenarios, find all possible attack paths in the domain, and sort all attack paths according to their threat levels, helping security personnel to use limited resources to carry out focused defense deployment and ensure the safety and stability of the entire system.

[0031] The graph-based domain penetration attack path generation method described in this invention solves the technical problems of achieving comprehensive automated penetration testing, accurately identifying potential attack paths, and establishing a systematic threat assessment mechanism in various scenarios and dynamically changing domain environments. This invention automates and intelligentizes domain penetration testing. Traditional penetration testing relies on manual operations and experience-driven methods, resulting in low efficiency, high costs, and susceptibility to human error. By constructing a graph-based model and introducing an intelligent learning mechanism, this method can automatically identify, model, and assess attack paths. It can automatically complete information collection, path generation, and threat scoring without human intervention, significantly improving the efficiency, accuracy, and comprehensiveness of penetration testing. This method is suitable for automated penetration assessment tasks in large-scale, complex network environments, effectively processing large state spaces and improving path search efficiency. In Windows domain environments, with their large number of hosts and complex trust relationships, traditional path analysis often encounters computational bottlenecks when faced with massive states and attack actions. This invention constructs an attack relationship graph using a graph structure and combines attack edge pruning strategies, composite edge construction, and a priori knowledge optimization mechanism to significantly compress the action space. During the graph traversal process, redundant paths can be quickly eliminated, focusing on the most likely successful attack sequences, achieving efficient convergence and accurate output of path searches, significantly reducing analysis time and resource overhead, and possessing dynamic self-adaptation and continuous learning capabilities. The present invention supports real-time updates of graph information, node attributes, and attack edge relationships based on changes in network structure and asset status in a real operating environment, and possesses good environmental adaptability. At the same time, the path scoring and traversal strategies can be dynamically adjusted based on the results of each path analysis, continuously optimizing the model effect and enhancing the system's responsiveness to new vulnerabilities, new topologies, and new attack methods. Compared to static scanning tools, the present invention can better maintain the timeliness and accuracy of analysis in a dynamic network environment, has good structural scalability and engineering implementation capabilities, and adopts a modular design. The information collector, graph builder, path analysis engine, and scoring mechanism can be independently deployed and expanded, supporting adaptation and integration of different network structures, different protocol types, and multiple types of attack methods, facilitating collaborative linkage with existing security protection systems. It can be used as an enterprise-level attack path assessment platform, and can also be embedded in the red team automated testing framework, vulnerability mining platform and security situation awareness system. It has broad application prospects. It not only significantly improves the automation, intelligence and efficiency of domain penetration testing, but also has good adaptability, scalability and practical value. It can effectively support attack path discovery and risk warning work in dynamic and high-security network environments.

Claims

1. A method for generating domain penetration attack paths based on a graph structure, characterized by: The steps include: Step 1: Select a host in the domain as the starting point of the attack, deploy a topology discovery module on the host, and establish an information collector in the topology discovery module. The information collector collects information from each key node in the domain and outputs the domain information set; Step 2: The relationship graph construction module retrieves the domain information set, classifies and analyzes each entity information, extracts node attributes, constructs attack edges, sets weight calculation rules, generates a configuration file, constructs a network relationship graph based on the configuration file, and outputs the graph structure and weight configuration results of the network relationship graph; Step 3: The attack path analysis module performs multiple rounds of attack path searches based on the graph structure and weight configuration results, starting with the host where the topology discovery module is located. During the search process, the feasibility of candidate paths is determined one by one based on the attack edge conditions and node attributes. Candidate paths that meet the conditions are added to the secondary candidate set. A scoring model is established based on the edge type, node weight, and the importance of the key target to assign threat scores to the candidate paths in the secondary candidate set. A state feedback mechanism is introduced during the search process to adjust the parameters of the network relationship graph in real time, thereby optimizing the search efficiency and ultimately outputting all feasible attack paths and corresponding threat score results.

2. The method for generating a domain penetration attack path based on a graph structure according to claim 1, wherein: The key nodes include hosts, servers and network devices.

3. The method for generating a domain penetration attack path based on a graph structure according to claim 1, wherein: When executing step 1, the specific steps include: Step 1-1: Select a controlled host in the subdomain as the attack starting point and deploy an information collector; Step 1-2: Utilize the two-way trust relationship in the Windows domain forest to interact with the Windows domain's Active Directory database to collect information, including the domain name, domain identity information, domain controller list, domain controller list, domain server list, high-privilege and special user group members, domain delegation information, and service principal names; Steps 1-3: Collect information about the operating system of the hosts in the domain and the current logged-in user and high-privilege users by sending SMB probe packets or querying the remote registry. Step 1-4: Summarize the various information collected in steps 1-2 to 1-3, construct the domain information set, and output it.

4. The method for generating a domain penetration attack path based on a graph structure according to claim 2, wherein: When executing step 2, a configuration file is generated based on the topology relationship and vulnerability information of the target host.

5. The method for generating a domain penetration attack path based on a graph structure according to claim 1, wherein: When executing step 2, the specific steps include: Step 2-1: The relationship graph construction module calls the domain information set, parses and classifies various entities, and defines node attributes; Host node: stored in the format of IP-OS-port; Service node: Associated with the corresponding host node, recording service type and version information; User node: Identified in the domain name\user name format, recording group relationships and permission information; The above node attributes are stored in the database. During the penetration analysis process, the node attributes are dynamically updated according to the latest scan results. Based on the analysis and classification results of various entities, a network relationship map is constructed; Step 2-2: In the network relationship graph, define attack edges based on vulnerability exploitation relationships. Each attack edge contains a source node and a target node. Add a traversed or untraversed mark to the attack edge; When the number of attacking edges is too large, prior knowledge is used for optimization, specifically: Step 2-2-1: First, use the edge combination method to combine vulnerabilities with the same attack conditions and results into the same type of edge; Step 2-2-2: Then directly combine the fixed attack sequence into a composite edge; Step 2-2-3: Based on the optimization results of steps 2-2-1 and 2-2-3, construct the optimized attack edge set and output it; Step 2-3: Based on the characteristics of the attacking edge and the node, establish a path search, set the weight calculation rules, and generate the weight configuration results according to the weight calculation rules. Specifically: For privilege escalation edges: set weights based on the extent of privilege escalation; For domain control-related edges: give special weights to highlight their criticality; For edges that obtain domain administrator credentials: give additional reward weight; Step 2-4: Output the graph structure and weight configuration results of the network relationship graph.

6. The method for generating a domain penetration attack path based on a graph structure according to claim 1, wherein: When executing step 3, the specific steps include: Step 3-1: Initialize the graph structure state; Step 3-2: Execute the first round of path search, starting from the host where the topology discovery module is located, traverse the feasible attack edges in the graph structure that meet the attack conditions, and build a candidate path set; Step 3-3: Perform threat scoring on the candidate paths in the candidate path set. Calculate the path threat score based on the attack edge type, node feature weight, and key edge reward value. The scoring model is as follows: ； Among them, W (E i ) is the attacking edge E i The weight score, W(N i ) is the node N in the path i The feature weight of R(E i ) is the reward value, which gives additional promotion to key edges; m is the total number of candidate paths; Step 3-4: When a valid path is found, the edges involved in the valid path are marked as traversed, and the weights of the relevant nodes and edges in the graph structure are adaptively adjusted based on the information of the current valid path. The specific adaptive adjustment method is to use a quasi-reinforcement learning mechanism for adjustment: ； ； ； Among them, α, β, and λ are preset learning rates, which are used to control the intensity of weight adjustment; W′(E i ) is the weight score of the adjusted attack edge Ei, W′(N i ) is the feature weight of node Ni in the adjusted path; R′(E i ) is the adjusted reward value; Step 3-5: Repeat the valid path discovery and scoring process from step 3-2 to step 3-4 until there are no new valid paths. Finally, merge, deduplicate, and cluster all paths to obtain the attack path set and its corresponding threat score.

Images