Medical network collaborative penetration test system and method based on artificial intelligence

Abstract

The invention discloses a medical network collaborative penetration test system and method based on artificial intelligence, and belongs to the technical field of medical information security, and the method comprises the steps: integrating a hospital intranet, medical equipment, cloud data center data and historical network delay data to construct a medical network data center; analyzing association between network vulnerabilities and delay data through a graph neural network, constructing an attack path analysis model containing delay weights, and quantifying risk scores to generate a test target priority list; defining a protocol vulnerability and a delay threshold, designing a test scene and generating an attack vector, matching an attack tool to perform a simulation test, calculating a vulnerability triggering success rate and evaluating a risk; generating a penetration test case according to the test target priority list and the risk level, executing multiple rounds of attack tests and generating a report; and monitoring the change of the vulnerability triggering success rate by dynamically adjusting the delay parameter, setting an early warning threshold value, and monitoring and sending a risk early warning notification in real time.

Description

Technical Field

[0001] The present invention relates to the field of medical information security technology, and in particular to a medical network collaborative penetration testing system and method based on artificial intelligence. Background Art

[0002] With the continuous advancement of medical informatization, the medical network has evolved into a complex network consisting of various medical devices, hospital internal management systems, and regional health information sharing platforms. This network carries critical business such as patients' vital health data and hospital diagnosis and treatment processes. Its security directly determines the sustainable and stable operation of medical services and the protection of patients' lives. Penetration testing, as an important means of assessing network security, simulates the behavior of malicious attackers to detect vulnerabilities in network systems, providing a key basis for security protection.

[0003] In the medical network scenario, penetration testing can accurately locate various potential security risks and assess the impact of network attacks on the continuity of medical services. However, the current mainstream penetration testing technologies mostly rely on general vulnerability scanning tools and preset attack script libraries, ignoring the mutual influence between the proprietary communication protocol characteristics of medical devices and the real-time requirements of medical services. Medical devices often use private protocols for data interaction, and medical Internet of Things devices need to maintain microsecond-level timely response in emergency diagnosis and treatment scenarios. However, existing penetration testing technologies fail to fully consider the relevant impact of network latency on testing, resulting in simulated attacks unable to truly reproduce the chain reaction of vulnerability triggering in high-latency scenarios; in addition, existing penetration test attack path planning is only based on static vulnerability priorities, and cannot dynamically evaluate the actual feasibility of vulnerability triggering under different delay conditions, ultimately resulting in the inability of penetration testing to accurately quantify the degree of damage to medical service continuity caused by network attacks. Summary of the Invention

[0004] The purpose of the present invention is to provide a medical network collaborative penetration testing system and method based on artificial intelligence to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a medical network collaborative penetration testing method based on artificial intelligence, the method comprising:

[0006] Step S100: Integrate the network topology information, device attributes, and vulnerability database of the hospital intranet, medical devices, and cloud data centers, and combine the historical network delay data between each network node to build a medical network data hub;

[0007] Step S200: Using a graph neural network to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, constructing an attack path analysis model that includes latency weights, and based on the model output, quantifying the path risk score to generate a test target priority list;

[0008] Step S300: Build a multi-dimensional feature device set based on the medical network data hub. Combined with historical delay data and network topology characteristics, define a set of protocol vulnerabilities and determine the delay thresholds for each network link. Design test scenarios covering different delay conditions, generate attack vectors for each scenario, and automatically match attack tools for simulation testing. Compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level based on historical attack data.

[0009] Step S400: Generate a penetration test case based on the test target priority list and vulnerability risk level, associating target device features, protocol vulnerabilities, and delay conditions. Perform multiple rounds of attack tests under different delay thresholds, and generate a test report based on the test results.

[0010] Step S500: By dynamically adjusting the delay parameters, the vulnerability trigger success rate and the change value caused by the delay parameter change are monitored and recorded in real time, and a dynamic warning threshold is set. When the real-time monitoring shows that the change value exceeds the warning threshold, the risk location and related network links and device nodes are located through the reverse node to issue a risk warning notification.

[0011] Furthermore, the step S100 includes:

[0012] Step S101: Scan and record the IP addresses, MAC addresses, and open ports of all devices through the hospital network management system, draw a network topology, mark the physical connection paths and communication connection paths between devices, and record the adjacency and access rights of each network node; collect device model, operating system version, firmware version, and service configuration information through the device management interface, and associate the network area to which the device belongs and the administrator's permission configuration; link to the general vulnerability database to filter out entries related to medical devices, and integrate the hospital's historical security event logs to mark the vulnerability trigger conditions;

[0013] By deploying network performance monitoring tools, we continuously monitor the end-to-end latency of each communication link, store historical latency data, and associate latency data with network topology nodes. For data involving patient personal information, we use virtual IDs instead of real patient identifiers, hide image file identification information, and use encryption technology to store patient-related information, unifying and standardizing data formats.

[0014] Step S102: Use a graph database to store network topology and device relationships. The nodes of the graph database include medical devices, network areas, and cloud services. The edges represent the connection relationships between the nodes and the access rights between different nodes. Use a time series database to store network delay data, and establish a relational database to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty. Integrate the various types of data collected in step S101 according to the corresponding data storage method, establish associations between the various databases through device IDs and network area identifiers, and form a complete medical network data hub based on the integrated and associated data.

[0015] Furthermore, the step S200 includes:

[0016] Step S201: Clean the data in the medical network data hub constructed in step S102, remove duplicate, erroneous and invalid data records, integrate various protocols used in the medical network, and extract medical protocol interaction features, including protocol type, port number, data packet format, and communication frequency; extract network delay data from the time series database, calculate the average delay, maximum delay, and delay volatility in different time periods as network delay statistical features; at the same time, combine the network topology structure to extract topological features related to delay, including node degree and path length; extract features of vulnerability details in the relational database, including vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty; and integrate these features with medical protocol features and network delay features; mark the data based on historical security event logs, mark the devices and paths with vulnerabilities, and the corresponding vulnerability trigger conditions and risk levels;

[0017] Step S202: Fusion-encode the medical protocol features, network delay features, and vulnerability features to construct an input vector; construct a multi-layer graph convolutional network architecture, aggregate the topological association information and attribute features of neighboring nodes layer by layer through a message passing mechanism, introduce an attention mechanism in the graph convolution layer, and perform weighted aggregation on the information of neighboring nodes by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, outputs the vulnerability triggering probability and delay weight of each node; at the edge level, calculates the risk propagation probability and delay tolerance threshold of the communication link between adjacent nodes; the vulnerability triggering probability represents; the delay weight is a delay-related weight value assigned to each network node, which represents the degree of influence of the node on the overall delay during network data transmission; the risk propagation probability represents the probability that the vulnerability risk of a node is propagated to another node in the communication link between adjacent nodes; the delay tolerance threshold represents the maximum delay time that the communication link between adjacent nodes can tolerate; use the labeled data to train the graph neural network model, adopt the cross entropy loss function and the stochastic gradient descent algorithm, and continuously adjust the model parameters until the model reaches the preset stop condition;

[0018] Step S203: Based on the predicted value output by the model, a weighted random walk algorithm is used to simulate the attack path generation process. Starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the main weight for the selection probability, and the network link delay tolerance is used as the adjustment coefficient for sampling:

[0019] P(v j ∣v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))];

[0020] where v i Indicates the current node, v j represents the candidate next hop node, P(v j ∣v i ) indicates that the current node is v i Under the condition of j The conditional probability of being the next hop node; v k Represents the current node v i Any neighbor node of P(v k ) represents the node v output by the model k The probability of vulnerability triggering; P(v j ) represents the node v output by the model jthe vulnerability trigger probability of edge e ik denotes the edge connecting the current node v i and its neighbor node v k ; D(e ik ) denotes the delay weight of edge e ik output by the model; N i denotes the neighbor node set of node v i ; e ij denotes the edge connecting node v i and v j ; D(e ij ) denotes the delay weight of edge e ij output by the model;

[0021] Set the termination condition: when reaching a node in the target node set, the total delay of the path exceeds the set maximum tolerance threshold of the network, the vulnerability trigger probability of the set consecutive m nodes is lower than the preset threshold, trigger any one of the above conditions to terminate the path sampling;

[0022] Step S204: Calculate the comprehensive risk score R for each sampled path:

[0023] R = Π e∈path P(e)·exp(-D total / D net );

[0024] wherein path represents the penetration path obtained by sampling, represented by the sequence of edges; P(e) represents the vulnerability trigger probability of each edge e in the path; D total represents the total delay time of the path, D net represents the network diameter; wherein the network diameter represents the maximum distance between any two nodes in the network, measured by the link tree, the shortest path between any two nodes in the network is calculated, and the maximum value in these shortest paths determines the value of the network diameter; according to the descending order of the comprehensive risk score, the final penetration test target list containing priority ranking is formed.

[0025] Further, the step S300 comprises:

[0026] Step S301: According to the device information scanned by the hospital network management system in step S101, a multi-dimensional feature device set D = {d1, d2,..., dn} is constructed, wherein dn represents the feature information of the nth device, including the IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network area to which the device belongs, and administrator permission configuration of the device;

[0027] Set the set of delay conditions to L = {l1, l2, ..., lm}, where lm represents the mth composite delay constraint. Each composite delay constraint corresponds to a specific delay threshold, which is determined by comprehensively considering the end-to-end delay recorded in step S101, the average delay, maximum delay, and delay fluctuation calculated in step S201, and the node degree and path length extracted in step S201.

[0028] Assume that the protocol vulnerability set is U = {u1,u2,...,uq}, where uq represents the qth protocol vulnerability; each protocol vulnerability includes vulnerability type, vulnerability attack vector, target device characteristics, expected response mode and risk level;

[0029] Step S302: Based on the graph database constructed in step S102 and combined with the historical delay data in the time series database, a network simulation engine is used to dynamically generate a test environment that meets the L set constraints: when the delay threshold is set, a subgraph that meets the node degree and path length constraints is selected in the network topology, and then the link bandwidth parameters and background traffic load are adjusted to make the end-to-end delay distribution of any two nodes in the subgraph meet the preset statistical characteristics; for each protocol vulnerability, the attack vector automatically selects a matching attack tool according to its vulnerability type, and extracts key parameters from the device configuration information collected in step S101. When the attack payload is sent to the target device, Deep packet inspection technology captures response traffic and performs pattern matching with the expected response pattern defined in the protocol vulnerability set. If the match is successful, the risk level assessment process is triggered, and a comprehensive scoring rule is constructed. A weighted sum is taken based on the vulnerability trigger probability, delay weight, and risk propagation probability output by the model, and a risk level threshold is set. The risk level is determined based on the comprehensive score, including low, medium, and high risk levels, and risk information is recorded. If the match fails, the entire process of the attack attempt is recorded, including the attack time, the attack tools and parameters used, and the actual response of the target device. The number of successful matches and the total number of attempts are counted to obtain the vulnerability triggering success rate.

[0030] Furthermore, the step S400 includes:

[0031] Step S401: According to the penetration test target list generated in step S204, and the multi-dimensional feature device set constructed in step S301, the protocol vulnerability set, combined with the test environment generated in step S302, the test case is generated. For the higher priority path in the penetration test target list, the device features and corresponding protocol vulnerabilities associated with it are preferentially selected to design the test case, the attack vector is set, the data packet sent by the attacker to the device is simulated using the vulnerability, and the test is repeated multiple times under different delay threshold values in combination with the test environment generated in step S302. Monitor whether the success rate of vulnerability triggering is affected; Under the simulated delay condition, the generated test cases are executed one by one, and the response of the target device and the success rate of vulnerability exploitation are monitored. Through the deep packet inspection technology deployed in step S302, the device response traffic is captured in real time, and the expected response mode is compared to determine whether the vulnerability is successfully exploited; At the same time, by dynamically adjusting the delay parameter, the network delay environment is gradually changed from low delay to high delay interval multiple times, and the success rate change of vulnerability triggering under different delay conditions is recorded.

[0032] Step S402: After the test is completed, a test report containing the delay threshold is generated, and the report content includes: the execution of all test cases, including the target device, the attack vector used, the delay condition of the test scene, and whether the vulnerability triggering is successful, the comprehensive risk score and the determined risk level. Combined with the above test results, a complete test report is formed.

[0033] Further, the step S500 collects the history data of the success rate of vulnerability triggering and the history data of the delay parameter by monitoring and recording the change value generated by the change of the success rate of vulnerability triggering and the delay parameter in real time, respectively. The mean and standard deviation are calculated, and the threshold values of the success rate of vulnerability triggering and the delay parameter are set to the mean plus the standard deviation of the set multiple; When the change value monitored in real time exceeds the early warning threshold value, the specific risk position and the related network link and device node are located according to the medical data hub from the end node where the anomaly occurs. Risk warning notification.

[0034] A medical network collaborative penetration testing system based on artificial intelligence, the system comprises a medical network data hub construction module, an attack path analysis module, a composite attack scene generation module, a penetration test execution module and a self-adaptive risk warning module.

[0035] The medical network data hub construction module integrates the network topology information, device attributes and vulnerability database of the hospital intranet, medical devices and cloud data center, and combines the historical network delay data between network nodes to construct the medical network data hub.

[0036] The attack path analysis module uses a graph neural network to analyze the correlation characteristics between network vulnerability data and network latency of the medical network data center, constructs an attack path analysis model that includes latency weights, and based on the output of the model, quantifies the path risk score to generate a test target priority list;

[0037] The composite attack scenario generation module constructs a multi-dimensional feature device set based on the medical network data center, combines historical delay data and network topology characteristics, defines a set of protocol vulnerabilities, and determines the delay threshold of each network link. It designs test scenarios covering different delay conditions, generates attack vectors for each scenario, and automatically matches attack tools for simulation testing. It compares the simulated attack test results with the expected response results, calculates the vulnerability triggering success rate, and evaluates the vulnerability risk level based on historical attack data.

[0038] The penetration test execution module generates penetration test cases based on the test target priority list and vulnerability risk level, associates target device characteristics, protocol vulnerabilities and delay conditions, performs multiple rounds of attack tests under different delay thresholds, and generates a test report based on the test results;

[0039] The adaptive risk warning module dynamically adjusts the delay parameters, monitors and records the vulnerability trigger success rate and the change value caused by the delay parameter change in real time, sets a dynamic warning threshold, and when the real-time monitoring change value exceeds the warning threshold, it locates the risk location and related network links and device nodes through the reverse node to issue a risk warning notification.

[0040] Compared with the prior art, the present invention has the following beneficial effects:

[0041] By building a medical network data hub, the present invention achieves efficient aggregation and deep integration of multi-source heterogeneous data. This approach can more accurately associate medical devices with network topology, improving the comprehensiveness and accuracy of medical network security testing.

[0042] This paper uses graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in medical network data centers. By constructing an attack path analysis model and quantifying path risk scores based on latency weights, it optimizes the prioritization of penetration test targets. This method can not only accurately identify potential attack paths but also dynamically adjust testing strategies, improving the efficiency and accuracy of penetration testing.

[0043] The application generates an attack scene of multi-dimensional characteristics based on historical network delay data, device attributes and protocol vulnerability information, and combines an automatically matched attack tool to perform simulation testing, so that penetration testing can be verified in an actual running environment, the testing method can not only discover potential security vulnerabilities, but also quantifies the success rate of vulnerability triggering, and evaluates the vulnerability risk level according to historical attack data, and further enhances the standardization and practicality of the testing process.

[0044] The application can effectively reduce the network attack risk and improve the overall security and protection capability of the medical network by dynamically adjusting the delay parameter, monitoring the relationship between the vulnerability triggering success rate and the delay change in real time, setting the early warning threshold, and quickly determining the risk position and related network link through the reverse node positioning technology, and providing timely risk early warning notification. BRIEF DESCRIPTION OF DRAWINGS

[0045] The accompanying drawings are used to provide a further understanding of the application, and constitute a part of the specification, together with the embodiments of the application, to explain the application, and do not constitute a limitation on the application. In the drawings:

[0046] Figure 1 A method flow chart of a medical network collaborative penetration testing method based on artificial intelligence. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0048] Please refer to Figure 1 The application provides a technical solution: a medical network collaborative penetration testing method based on artificial intelligence, the method comprising:

[0049] Step S100: integrate the network topology information, device attributes and vulnerability database of the hospital intranet, medical devices and cloud data center, and combine the historical network delay data between network nodes to build a medical network data hub;

[0050] Step S200: analyze the correlation characteristics of network vulnerability data and network delay of the medical network data hub by using a graph neural network, construct an attack path analysis model containing delay weight, and generate a test target priority list based on the output result of the model;

[0051] Step S300: Build a multi-dimensional feature device set based on the medical network data hub. Combined with historical delay data and network topology characteristics, define a set of protocol vulnerabilities and determine the delay thresholds for each network link. Design test scenarios covering different delay conditions, generate attack vectors for each scenario, and automatically match attack tools for simulation testing. Compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level based on historical attack data.

[0052] Step S400: Generate a penetration test case based on the test target priority list and vulnerability risk level, associating target device features, protocol vulnerabilities, and delay conditions. Perform multiple rounds of attack tests under different delay thresholds, and generate a test report based on the test results.

[0053] Step S500: By dynamically adjusting the delay parameters, the vulnerability trigger success rate and the change value caused by the delay parameter change are monitored and recorded in real time, and a dynamic warning threshold is set. When the real-time monitoring shows that the change value exceeds the warning threshold, the risk location and related network links and device nodes are located through the reverse node to issue a risk warning notification.

[0054] The step S100 includes:

[0055] Step S101: Scan and record the IP addresses, MAC addresses, and open ports of all devices through the hospital network management system, draw a network topology, mark the physical connection paths and communication connection paths between devices, and record the adjacency and access rights of each network node; collect device model, operating system version, firmware version, and service configuration information through the device management interface, and associate the network area to which the device belongs and the administrator's permission configuration; link to the general vulnerability database to filter out entries related to medical devices, and integrate the hospital's historical security event logs to mark the vulnerability trigger conditions;

[0056] Collect historical security event logs from various security devices and systems in the hospital. These logs record past security incidents, including attack attempts and abnormal access-related information; clean the collected logs to remove duplicate, erroneous and irrelevant records; associate the screened medical device-related vulnerability entries with historical security event logs through time, IP address and device identification; analyze the network environment, user operation behavior and system configuration parameters at the time of the attack in the associated historical security event logs, summarize the triggering conditions of each vulnerability, and mark the summarized vulnerability triggering conditions on the corresponding vulnerability entries.

[0057] By deploying network performance monitoring tools, we continuously monitor the end-to-end latency of each communication link, store historical latency data, and associate latency data with network topology nodes. For data involving patient personal information, we use virtual IDs instead of real patient identifiers, hide image file identification information, and use encryption technology to store patient-related information, unifying and standardizing data formats.

[0058] Step S102: Use a graph database to store network topology and device relationships. The nodes of the graph database include medical devices, network areas, and cloud services. The edges represent the connection relationships between the nodes and the access rights between different nodes. Use a time series database to store network delay data, and establish a relational database to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty. Integrate the various types of data collected in step S101 according to the corresponding data storage method, establish associations between the various databases through device IDs and network area identifiers, and form a complete medical network data hub based on the integrated and associated data.

[0059] The step S200 includes:

[0060] Step S201: Clean the data in the medical network data hub constructed in step S102, remove duplicate, erroneous and invalid data records, integrate various protocols used in the medical network, and extract medical protocol interaction features, including protocol type, port number, data packet format, and communication frequency; extract network delay data from the time series database, calculate the average delay, maximum delay, and delay volatility in different time periods as network delay statistical features; at the same time, combine the network topology structure to extract topological features related to delay, including node degree and path length; extract features of vulnerability details in the relational database, including vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty; and integrate these features with medical protocol features and network delay features; mark the data based on historical security event logs, mark the devices and paths with vulnerabilities, and the corresponding vulnerability trigger conditions and risk levels;

[0061] Step S202: Fusion-encode the medical protocol features, network delay features, and vulnerability features to construct an input vector; construct a multi-layer graph convolutional network architecture, aggregate the topological association information and attribute features of neighboring nodes layer by layer through a message passing mechanism, introduce an attention mechanism in the graph convolution layer, and perform weighted aggregation on the information of neighboring nodes by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, outputs the vulnerability triggering probability and delay weight of each node; at the edge level, calculates the risk propagation probability and delay tolerance threshold of the communication link between adjacent nodes; the vulnerability triggering probability represents; the delay weight is a delay-related weight value assigned to each network node, which represents the degree of influence of the node on the overall delay during network data transmission; the risk propagation probability represents the probability that the vulnerability risk of a node is propagated to another node in the communication link between adjacent nodes; the delay tolerance threshold represents the maximum delay time that the communication link between adjacent nodes can tolerate; use the labeled data to train the graph neural network model, adopt the cross entropy loss function and the stochastic gradient descent algorithm, and continuously adjust the model parameters until the model reaches the preset stop condition;

[0062] Step S203: Based on the predicted value output by the model, a weighted random walk algorithm is used to simulate the attack path generation process. Starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the main weight for the selection probability, and the network link delay tolerance is used as the adjustment coefficient for sampling:

[0063] P(v j ∣v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))];

[0064] where v i Indicates the current node, v j represents the candidate next hop node, P(v j ∣v i ) indicates that the current node is v i Under the condition of j The conditional probability of being the next hop node; v k Represents the current node v i Any neighbor node of P(v k ) represents the node v output by the model k The probability of vulnerability triggering; P(v j ) represents the node v output by the model jThe probability of vulnerability triggering; e ik Indicates connecting to the current node v i and its neighbor node v k The edge of D(e ik ) represents the edge e output by the model ik Delay weight; N i Represents node v i The set of neighbor nodes, e ij Represents the connection node v i and v j The edge of D(e ij ) represents the edge e output by the model ij The delay weight of

[0065] Set termination conditions: When a node in the target node set is reached, the total path delay exceeds the set network maximum tolerance threshold, or the probability of triggering a vulnerability for m consecutive nodes is lower than the preset threshold, any of the above conditions is triggered to terminate path sampling;

[0066] Step S204: Calculate the comprehensive risk score R for each sampling path:

[0067] R=Π e∈path P(e)·exp(-D total / D net );

[0068] Where path represents the penetration path obtained by sampling, which is represented by the sequence of edges; P(e) represents the vulnerability triggering probability of each edge e in the path; D total Denotes the total path delay time, D net Represents the network diameter; the network diameter represents the maximum distance between any two nodes in the network, which is measured by the link tree. The shortest path between any two nodes in the network is calculated, and the maximum value of these shortest paths is taken to determine the value of the network diameter; the network is sorted in descending order according to the comprehensive risk score, and finally a penetration test target list with priority sorting is formed.

[0069] The step S300 includes:

[0070] Step S301: Based on the device information scanned by the hospital network management system in step S101, a multi-dimensional feature device set D = {d1, d2, ..., dn} is constructed, where dn represents the feature information of the nth device, including the device's IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network region, and administrator permission configuration;

[0071] A set of delay conditions is set as L = {l1, l2,..., lm}, where lm represents the mth composite delay constraint condition, each composite delay constraint condition corresponds to a specific delay threshold, and the delay threshold is determined by the end-to-end delay recorded in step S101, the average delay, the maximum delay, and the delay fluctuation rate calculated in step S201, and the node degree and path length extracted in step S201;

[0072] A set of protocol vulnerabilities is set as U = {u1, u2,..., uq}, where uq represents the qth protocol vulnerability; each protocol vulnerability includes a vulnerability type, a vulnerability attack vector, a target device feature, an expected response mode, and a risk level;

[0073] Step S302: Based on the graph database constructed in step S102, combined with the historical delay data in the time series database, a network simulation engine is used to dynamically generate a test environment that meets the constraints of the L set: when setting the delay threshold, the subgraph that meets the node degree and path length constraints is selected in the network topology, and then the link bandwidth parameters and background traffic load are adjusted to make the end-to-end delay distribution between any two nodes in the subgraph meet the preset statistical characteristics; for each protocol vulnerability, the attack vector automatically selects a matching attack tool according to its vulnerability type, and extracts key parameters from the device configuration information collected in step S101; after the attack payload is sent to the target device, the response traffic is captured through deep packet inspection technology, and the expected response mode defined in the protocol vulnerability set is matched; if the matching is successful, the risk level evaluation process is triggered, the comprehensive scoring rule is constructed, the vulnerability trigger probability, the delay weight, and the risk propagation probability output by the model are weighted and summed, and the risk level threshold is set; the risk level is determined according to the comprehensive score, including low, medium, and high risk levels, and the risk information is recorded; if the matching fails, the whole process information of this attack attempt is recorded, including the attack time, the attack tool and parameters used, and the actual response of the target device; the number of successful matches and the total number of attempts are counted to obtain the vulnerability trigger success rate.

[0074] The step S400 includes:

[0075] Step S401: Based on the priority-ordered penetration test target list generated in step S204 and the multi-dimensional feature device set and protocol vulnerability set constructed in step S301, test cases are generated in combination with the test environment generated in step S302. For paths with higher priority in the penetration test target list, the device features associated with them and the corresponding protocol vulnerabilities are preferentially selected to design test cases, attack vectors are set, and data packets sent to the device by the attacker using the vulnerability are simulated. At the same time, in combination with the delay-constrained test environment generated in step S302, the test is repeated multiple times under different delay thresholds to monitor whether the vulnerability triggering success rate is affected. Under the simulated delay conditions, the generated test cases are executed one by one to monitor the response of the target device and the vulnerability exploitation success rate. The device response traffic is captured in real time through the deep packet inspection technology deployed in step S302, and compared with the expected response pattern to determine whether the vulnerability is successfully exploited. At the same time, the network delay environment is gradually changed by dynamically adjusting the delay parameters, and the values ​​are taken multiple times from low delay to high delay ranges to record the changes in the vulnerability triggering success rate under different delay conditions.

[0076] Step S402: After the test is completed, a test report including the delay threshold is generated. The report content includes: the execution status of all test cases, including the target device, the attack vector adopted, the delay conditions of the test scenario, and whether the vulnerability is successfully triggered, the comprehensive risk score and the determined risk level. Combined with the above test results, a complete test report is formed.

[0077] The step S500 monitors and records the change values ​​of vulnerability triggering success rate and delay parameter changes in real time, collects historical data of vulnerability triggering success rate and delay parameter history data, respectively, and sets the thresholds of vulnerability triggering success rate and delay parameter to the mean plus the set multiple of the standard deviation; when the real-time monitoring shows that the change value exceeds the warning threshold, the medical data center traces back from the end node where the abnormality occurs to the specific risk location and related network links and device nodes to issue a risk warning notification.

[0078] Embodiments of the present invention:

[0079] Through the hospital network management system, a comprehensive scan and record of equipment information is performed. Taking ultrasound diagnostic equipment as an example, the information includes IP addresses, MAC addresses, open ports, and the connection paths between it and surrounding switches and servers are mapped, with access rights marked. The model, operating system version, and firmware version are collected from the device management interface. The service configuration information shows that the remote diagnosis function is enabled, and the associated network area is the east area on the 3rd floor of the outpatient building. The administrator authority is configured as the department director. At the same time, historical security event logs are collected, cleaned, and linked to the general vulnerability database. It was found that this model of equipment had a buffer overflow vulnerability, and the trigger condition was marked as receiving an overlong data packet. Network performance monitoring tools are deployed to continuously monitor the delay of each link, store data and associate topological nodes, anonymize and encrypt patient data for storage, and finally use graph databases, time series databases, and relational databases to integrate data to build a medical network data hub.

[0080] Data is cleaned and features of medical protocol interactions are extracted. Taking the image transmission protocol as an example, port number 5060, data packet format conforming to the DICOM standard, and communication frequency every 5 minutes, an average delay of 30ms, a maximum delay of 50ms, and a delay volatility of 10% are calculated from the time series database. Node degrees and path lengths are then extracted based on the topology. Feature extraction and fusion of vulnerability details are performed, labeling vulnerable devices and paths. An input vector is then constructed and the model is trained using a multi-layer graph convolutional network, introducing an attention mechanism. For example, when training to detect ECG monitor vulnerability risks, the model focuses on the delay weight of the link between the ECG monitor and the connected server. At the node level, the model outputs a 30% probability of ECG monitor vulnerability triggering and a delay weight of 0.4. At the edge level, the communication link risk propagation probability is 20% and the delay tolerance threshold is 40ms. A weighted random walk algorithm is used to simulate attack paths, starting from the external network entry node and selecting the next hop according to rules. Sampling is terminated if the vulnerability trigger probability of a node is low or the total path delay exceeds a threshold. Finally, a comprehensive risk score is calculated and ranked for each sampled path, resulting in a prioritized list of test targets.

[0081] A multi-dimensional feature device set is constructed, and the delay condition set is determined based on historical data. For example, the peak period delay threshold is set to 2 times the standard deviation of the average delay. The protocol vulnerability set includes a certain infusion pump protocol vulnerability of the command injection type, and the attack vector is automatically matched to the hacker tool. Based on the graph database and historical delay data, the network simulation engine generates a test environment, adjusts the link bandwidth and background traffic to meet the delay standard. During the attack, the attack payload is sent to the infusion pump vulnerability, and deep packet inspection technology is used to capture the response and match it with the expected response. The risk level is assessed by weighted summation according to the rules, and the number of successful matches and the total number of attempts are recorded to calculate the vulnerability triggering success rate.

[0082] According to the test target priority list, the device set, the protocol vulnerability set and the test environment, test cases are generated, high-priority path associated devices are tested preferentially, special data packets are sent to the devices by simulating an attacker, the process is repeated multiple times combined with different delay thresholds, the high-risk image storage server is tested in the low delay 20ms to high delay 60ms interval, the vulnerability trigger success rate and the device response are monitored, the vulnerability trigger condition is judged by using the deep packet detection technology, and finally a test report containing the delay threshold is generated; the vulnerability trigger success rate and the delay parameter variation are monitored in real time, historical data is collected to calculate the mean value and the standard deviation, a threshold is set, once the change value exceeds the threshold, the risk position and the link are located by backtracking from the abnormal end node according to the medical data hub, and a warning notification is sent.

[0083] It will be obvious to a person skilled in the art that the application is not limited to the details of the foregoing exemplary embodiments and can be implemented in other concrete forms without departing from the spirit or essential characteristics of the application. The embodiments are therefore considered in all respects to be illustrative and not restrictive, the scope of the application being indicated by the appended claims rather than by the foregoing description, and it is intended to encompass all changes and modifications that fall within the meaning and scope of the equivalent elements of the claims. Any reference signs in the claims should not be considered as limiting the claims involved.

Claims

1. A medical network collaborative penetration testing method based on artificial intelligence, characterized by: The method comprises: Step S100: Integrate the network topology information, device attributes, and vulnerability database of the hospital intranet, medical devices, and cloud data centers, and combine the historical network delay data between each network node to build a medical network data hub; Step S200: Using a graph neural network to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, constructing an attack path analysis model that includes latency weights, and based on the model output, quantifying the path risk score to generate a test target priority list; Step S300: Build a multi-dimensional feature device set based on the medical network data hub. Combined with historical delay data and network topology characteristics, define a set of protocol vulnerabilities and determine the delay thresholds for each network link. Design test scenarios covering different delay conditions, generate attack vectors for each scenario, and automatically match attack tools for simulation testing. Compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level based on historical attack data. Step S400: Generate a penetration test case based on the test target priority list and vulnerability risk level, associating target device features, protocol vulnerabilities, and delay conditions. Perform multiple rounds of attack tests under different delay thresholds, and generate a test report based on the test results. Step S500: By dynamically adjusting the delay parameters, the vulnerability trigger success rate and the change value caused by the delay parameter change are monitored and recorded in real time, and a dynamic warning threshold is set. When the real-time monitoring shows that the change value exceeds the warning threshold, the risk location and related network links and device nodes are located through the reverse node to issue a risk warning notification.

2. The medical network collaborative penetration testing method based on artificial intelligence according to claim 1, characterized in that: The step S100 includes: Step S101: Scan and record the IP addresses, MAC addresses, and open ports of all devices through the hospital network management system, draw a network topology map, mark the physical connection paths and communication connection paths between devices, and record the adjacency and access rights of each network node; collect device model, operating system version, firmware version, and service configuration information through the device management interface, and associate the network area to which the device belongs and the administrator's permission configuration; associate with the general vulnerability database, filter out entries related to medical devices, and integrate the hospital's historical security event logs to mark vulnerability triggering conditions; continuously monitor the end-to-end delay of each communication link by deploying a network performance monitoring tool, store historical delay data, and associate the delay data with the network topology nodes; use a virtual ID instead of the real patient ID for data involving patient personal information, hide the image file identification information, use encryption technology to store patient-related information, and unify and standardize the data format; Step S102: Use a graph database to store network topology and device relationships. The nodes of the graph database include medical devices, network areas, and cloud services. The edges represent the connection relationships between the nodes and the access rights between different nodes. Use a time series database to store network delay data, and establish a relational database to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty. Integrate the various types of data collected in step S101 according to the corresponding data storage method, establish associations between the various databases through device IDs and network area identifiers, and form a complete medical network data hub based on the integrated and associated data.

3. The medical network collaborative penetration testing method based on artificial intelligence according to claim 1, characterized in that: The step S200 includes: Step S201: Clean the data in the medical network data center, remove duplicate, erroneous and invalid data records, integrate various protocols used in the medical network, and extract medical protocol interaction features, including protocol type, port number, data packet format, and communication frequency; extract network delay data from the time series database, calculate the average delay, maximum delay, and delay fluctuation rate in different time periods as network delay statistical features; at the same time, combine the network topology structure to extract topological features related to delay, including node degree and path length; extract features of vulnerability details in the relational database, including vulnerability type, vulnerability level, impact range, and vulnerability attack difficulty; and merge these features with medical protocol features and network delay features; mark the data according to historical security event logs, mark the devices and paths with vulnerabilities, as well as the corresponding vulnerability trigger conditions and risk levels; Step S202: Fusion-encode the medical protocol features, network delay features, and vulnerability features to construct an input vector; construct a multi-layer graph convolutional network architecture, aggregate the topological association information and attribute features of neighboring nodes layer by layer through a message passing mechanism, introduce an attention mechanism in the graph convolution layer, and perform weighted aggregation on the information of neighboring nodes by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, outputs the vulnerability trigger probability and delay weight of each node; at the edge level, calculates the risk propagation probability and delay tolerance threshold of the communication link between adjacent nodes; the vulnerability trigger probability represents; the delay weight is a delay-related weight value assigned to each network node, which represents the degree of influence of the node on the overall delay during network data transmission; the risk propagation probability represents the probability that the vulnerability risk of one node is propagated to another node in the communication link between adjacent nodes; the delay tolerance threshold represents the maximum delay time that the communication link between adjacent nodes can tolerate; use the labeled data to train the graph neural network model, adopt the cross entropy loss function and the stochastic gradient descent algorithm, and continuously adjust the model parameters until the model reaches the preset stop condition.

4. The artificial intelligence-based collaborative penetration testing method for medical networks according to claim 3, characterized in that: The step S200 further includes: Step S203: Based on the predicted value output by the model, a weighted random walk algorithm is used to simulate the attack path generation process. Starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the main weight for the selection probability, and the network link delay tolerance is used as the adjustment coefficient for sampling: P(v j ∣v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))]; where v i Indicates the current node, v j represents the candidate next hop node, P(v j ∣v i ) indicates that the current node is v i Under the condition of j The conditional probability of being the next hop node; v k Represents the current node v i Any neighbor node of P(v k ) represents the node v output by the model k The probability of vulnerability triggering; P(v j ) represents the node v output by the model j The probability of vulnerability triggering; e ik Indicates connecting to the current node v i and its neighbor node v k The edge of D(e ik ) represents the edge e output by the model ik Delay weight; N i Represents node v i The set of neighbor nodes, e ij Represents the connection node v i and v j The edge of D(e ij ) represents the edge e output by the model ij The delay weight of Set termination conditions: When a node in the target node set is reached, the total path delay exceeds the set network maximum tolerance threshold, or the probability of triggering a vulnerability for m consecutive nodes is lower than the preset threshold, any of the above conditions is triggered to terminate path sampling; Step S204: Calculate the comprehensive risk score R for each sampling path: R=Π e∈path P(e)·exp(-D total / D net ); Where path represents the penetration path obtained by sampling, which is represented by the sequence of edges; P(e) represents the vulnerability triggering probability of each edge e in the path; D total Denotes the total path delay time, D net Represents the network diameter; the network diameter represents the maximum distance between any two nodes in the network, which is measured by the link tree. The shortest path between any two nodes in the network is calculated, and the maximum value of these shortest paths is taken to determine the value of the network diameter; the network is sorted in descending order according to the comprehensive risk score, and finally a penetration test target list with priority sorting is formed.

5. The medical network collaborative penetration testing method based on artificial intelligence according to claim 1 is characterized in that: The step S300 includes: Step S301: Construct a multi-dimensional feature device set D = {d1, d2, ..., dn} based on the device information scanned by the hospital network management system, where dn represents the feature information of the nth device, including the device's IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network region, and administrator authority configuration; Set the set of delay conditions to L = {l1, l2, ..., lm}, where lm represents the mth composite delay constraint. Each composite delay constraint corresponds to a specific delay threshold, which is determined by comprehensively considering the end-to-end delay recorded in step S101, the average delay, maximum delay, and delay fluctuation calculated in step S201, and the node degree and path length extracted in step S201. Assume that the protocol vulnerability set is U = {u1,u2,...,uq}, where uq represents the qth protocol vulnerability; each protocol vulnerability includes vulnerability type, vulnerability attack vector, target device characteristics, expected response mode and risk level; Step S302: Based on the constructed graph database and combined with the historical delay data in the time series database, a network simulation engine is used to dynamically generate a test environment that meets the set L constraints: when the delay threshold is set, a subgraph that meets the node degree and path length constraints is selected in the network topology, and then the link bandwidth parameters and background traffic load are adjusted to make the end-to-end delay distribution of any two nodes in the subgraph meet the preset statistical characteristics; for each protocol vulnerability, the attack vector automatically selects the matching attack tool according to its vulnerability type, and extracts key parameters from the collected device configuration information. When the attack payload is sent to the target device, it is detected through deep packet inspection. The technology captures response traffic and matches it with the expected response pattern defined in the vulnerability set. If the match is successful, the risk level assessment process is triggered, and a comprehensive scoring rule is constructed. A weighted sum is taken based on the vulnerability trigger probability, delay weight, and risk propagation probability output by the model, and a risk level threshold is set. The risk level is determined based on the comprehensive score, including low, medium, and high risk levels, and risk information is recorded. If the match fails, the entire process of the attack attempt is recorded, including the attack time, the attack tools and parameters used, and the actual response of the target device. The number of successful matches and the total number of attempts are counted to obtain the vulnerability triggering success rate.

6. The medical network collaborative penetration testing method based on artificial intelligence according to claim 1, characterized in that: The step S400 includes: Step S401: Generate test cases based on the test target priority list, the multi-dimensional feature device set, the protocol vulnerability set, and the test scenario. For the paths with high priority in the penetration test target list, prioritize the device features associated with them and the corresponding protocol vulnerabilities to design test cases, set attack vectors, simulate the data packets sent by the attacker to the device using the vulnerability, and repeat the test multiple times under different delay thresholds in combination with the test scenario to monitor whether the vulnerability triggering success rate is affected. Under the simulated delay conditions, execute the generated test cases one by one to monitor the response of the target device and the vulnerability exploitation success rate. Use deep packet inspection technology to capture the device response traffic in real time, compare it with the expected response pattern, and determine whether the vulnerability is successfully exploited. At the same time, dynamically adjust the delay parameters to gradually change the network delay environment, take multiple values ​​from low delay to high delay range, and record the changes in the vulnerability triggering success rate under different delay conditions. Step S402: After the test is completed, a test report including the delay threshold is generated. The report content includes: the execution status of all test cases, including the target device, the attack vector adopted, the delay conditions of the test scenario, and whether the vulnerability is successfully triggered, the comprehensive risk score and the determined risk level. Combined with the above test results, a complete test report is formed.

7. The medical network collaborative penetration testing method based on artificial intelligence according to claim 1, characterized in that: The step S500 monitors and records the change values ​​of vulnerability triggering success rate and delay parameter changes in real time, collects historical data of vulnerability triggering success rate and delay parameter history data, respectively, and sets the thresholds of vulnerability triggering success rate and delay parameter to the mean plus the set multiple of the standard deviation; when the real-time monitoring shows that the change value exceeds the warning threshold, the medical data center traces back from the end node where the abnormality occurs to the specific risk location and related network links and device nodes to issue a risk warning notification.

8. An artificial intelligence-based collaborative penetration testing system for medical networks, characterized by: The system includes a medical network data hub construction module, an attack path analysis module, a composite attack scenario generation module, a penetration test execution module, and an adaptive risk warning module; The medical network data hub construction module builds a medical network data hub by integrating network topology information, device attributes and vulnerability databases of the hospital intranet, medical devices and cloud data centers, and combining historical network delay data between each network node; The attack path analysis module uses a graph neural network to analyze the correlation characteristics between network vulnerability data and network latency of the medical network data center, constructs an attack path analysis model that includes latency weights, and based on the output of the model, quantifies the path risk score to generate a test target priority list; The composite attack scenario generation module constructs a multi-dimensional feature device set based on the medical network data center, combines historical delay data and network topology characteristics, defines a set of protocol vulnerabilities, and determines the delay threshold of each network link. It designs test scenarios covering different delay conditions, generates attack vectors for each scenario, and automatically matches attack tools for simulation testing. It compares the simulated attack test results with the expected response results, calculates the vulnerability triggering success rate, and evaluates the vulnerability risk level based on historical attack data. The penetration test execution module generates penetration test cases based on the test target priority list and vulnerability risk level, associates target device characteristics, protocol vulnerabilities and delay conditions, performs multiple rounds of attack tests under different delay thresholds, and generates a test report based on the test results; The adaptive risk warning module dynamically adjusts the delay parameters, monitors and records the vulnerability trigger success rate and the change value caused by the delay parameter change in real time, sets a dynamic warning threshold, and when the real-time monitoring change value exceeds the warning threshold, it locates the risk location and related network links and device nodes through the reverse node to issue a risk warning notification.

Images