A multi-model cooperative penetration testing method, device and electronic equipment

Abstract

A multi-model cooperative penetration testing method, device and electronic equipment, relating to the field of data processing. In the method, target asset information and external knowledge data of a target system are obtained, the target system being an object to be penetrated; the target asset information is analyzed in combination with the external knowledge data to obtain corresponding structured penetration data; the current state of the target system is obtained, and the current state and the structured penetration data are input into a preset large language model to generate a penetration testing strategy; based on the penetration testing strategy, a preset reinforcement learning algorithm is used to generate an attack path; the original attack code corresponding to the attack path is input into a preset generative adversarial network to generate obfuscated attack code; and based on the attack path and the obfuscated attack code, the target system is penetrated to obtain a penetration testing result. The technical solution provided by the present application improves the penetration testing coverage.

Description

Technical Field

[0001] This application relates to the field of data processing, and particularly to a penetration testing method, device, and electronic device for multi-model collaboration. Background Art

[0002] With the wide deployment of video surveillance systems, the exposed security vulnerabilities have shown exponential growth. Traditional penetration testing methods have significant limitations in dealing with security threats in this field. Existing technologies mainly rely on predefined vulnerability libraries for rule matching, making it difficult to effectively cover unknown vulnerabilities, having insufficient adaptability to dynamic network architectures, and having a high false positive rate in business logic vulnerability detection due to the lack of environmental dynamic perception capabilities. More critically, the process of generating traditional penetration testing scripts requires a large amount of manpower for script writing and debugging. According to statistics, more than 60% of the testing time is consumed here, severely restricting the security response efficiency.

[0003] To improve the automation level of script generation, existing technologies have proposed a penetration testing scheme that combines multi-agent collaboration and deep learning. This method can perform vulnerability mining and exploitation in parallel through multiple agents, and optimize the decision-making process by combining reinforcement learning, enabling automated security scanning in a preset URL scenario and partially reducing the intensity of manual intervention.

[0004] However, this scheme still has problems: its test path generation strictly depends on the initially preset URLs and static rule libraries manually, and cannot dynamically adjust the penetration strategy according to the real-time state of the target system. When facing complex business logic chains commonly found in video surveillance systems, such as multi-device linkage control and streaming media protocol interaction, the system has insufficient penetration coverage due to the lack of environmental adaptability. Summary of the Invention This application provides a penetration testing method, device, and electronic device for multi-model collaboration, which improves the penetration coverage rate.

[0006] In the first aspect of this application, a penetration testing method for multi-model collaboration is provided. The method includes: obtaining the target asset information and external knowledge data of the target system, where the target system is the object to be penetrated; analyzing the target asset information in combination with the external knowledge data to obtain corresponding structured penetration data; obtaining the current state of the target system, inputting the current state and the structured penetration data into a preset large language model to generate a penetration testing strategy; generating an attack path by using a preset reinforcement learning algorithm based on the penetration testing strategy; inputting the original attack code corresponding to the attack path into a preset generative adversarial network to generate an obfuscated attack code; and performing a penetration test on the target system based on the attack path and the obfuscated attack code to obtain a penetration test result.

[0007] ​By employing the aforementioned technical solutions, target asset information and external knowledge data of the target system are acquired. Analyzing the target asset information in conjunction with the external knowledge data allows for a comprehensive understanding of the target system's security status, identifying potential weaknesses and exploitable vulnerabilities, and providing ample intelligence support for subsequent penetration testing. The current state and structured penetration data are input into a pre-defined large language model. Leveraging the powerful natural language understanding and generation capabilities of this model, the optimal penetration testing strategy can be automatically generated, avoiding the blind spots and limitations of manually formulated strategies. Based on the penetration testing strategy, a pre-defined reinforcement learning algorithm generates attack paths. Through intelligent planning and dynamic decision-making, the attack paths become more covert and efficient. The original attack code is input into a generative adversarial network for obfuscation, effectively resisting detection by antivirus software and intrusion detection systems, thus increasing the attack success rate. Finally, penetration testing is conducted on the target system based on the attack paths and obfuscated attack code, comprehensively verifying the system's security and outputting the penetration test results. The entire methodology is highly automated and intelligent, with multiple AI models working collaboratively, significantly improving the efficiency and effectiveness of penetration testing. This method generates structured penetration data by fusing external knowledge and asset information, then uses a large language model to adaptively generate a strategy based on the current state of the target system. It utilizes reinforcement learning to plan an approximately optimal attack path under constraints, and generates semantically equivalent obfuscated loads through generative adversarial networks to improve the realism of the evaluation. Finally, it forms a traceable closed loop in execution and result collection, achieving higher coverage, better execution efficiency, and stronger adversarial realism.

[0008] Optionally, the external knowledge data includes business documents, vulnerability knowledge bases, POC script libraries, and EXP script libraries. The step of combining the external knowledge data to analyze the target asset information and obtain corresponding structured penetration data specifically includes: performing correlation analysis on the port information and service information, and combining the vulnerability knowledge base to identify potential vulnerabilities related to open ports and running services, forming a potential vulnerability list for the target system; using a similar vulnerability correlation analysis method, comparing and classifying the potential vulnerabilities with features from the vulnerability knowledge base, POC script library, and EXP script library in the external knowledge data, and identifying the corresponding vulnerabilities. The vulnerability families are identified, and vulnerability family analysis results are obtained. Based on the potential vulnerability list and the vulnerability family analysis results, and combined with the external knowledge data, general vulnerability information and common vulnerability information of the target system are determined, forming a structured general vulnerability list and a common vulnerability list. The business documents are semantically parsed using a BERT pre-trained language model to extract key elements related to penetration testing, forming structured penetration testing terminology. The key elements include the attacker, prerequisites, attack operations, and expected results. The structured penetration data is obtained by combining the potential vulnerability list, the general vulnerability list, the common vulnerability list, and the penetration testing terminology.

[0009] By adopting the above technical solutions and introducing external knowledge data such as business documents, vulnerability knowledge bases, POC script libraries, and EXP script libraries, the deficiencies in the target system's own information can be comprehensively supplemented, providing richer intelligence sources for attack surface analysis. Through correlation analysis of port and service information, potential vulnerabilities related to open ports and running services can be accurately discovered, forming a potential vulnerability list. Using a vulnerability association analysis method based on shared origins, clustering algorithms are used to identify vulnerability families corresponding to potential vulnerabilities, uncovering the inherent connections between vulnerabilities and predicting the attack surface. Based on the potential vulnerability list and vulnerability family analysis results, combined with external knowledge data, common and prevalent vulnerabilities in the target system can be identified, further focusing attack directions. The BERT language model is used to perform semantic parsing of business documents, extracting key elements for penetration testing and deepening the understanding of the target system's business logic. Finally, the various analysis results are cross-validated to obtain structured penetration data. This comprehensive data-driven analysis method provides high-quality information support for penetration testing.

[0010] Optionally, the method of using the same source vulnerability association analysis involves comparing and classifying the potential vulnerability with the vulnerability knowledge base, POC script library, and EXP script library in the external knowledge data to identify the vulnerability family corresponding to the potential vulnerability and obtain vulnerability family analysis results. Specifically, this includes: extracting the feature information of the potential vulnerability and constructing a target vulnerability feature vector based on the feature information; extracting the key features of known vulnerabilities in the vulnerability knowledge base to form a known vulnerability feature vector; calculating the similarity between the target vulnerability feature vector and the known vulnerability feature vector to obtain a similarity matrix; using a clustering algorithm to cluster the potential vulnerability and the known vulnerability based on the similarity matrix to obtain multiple clusters, where each cluster corresponds to a vulnerability family; determining the vulnerability family corresponding to the potential vulnerability based on the clusters; and integrating the POC script library and the EXP script library to identify the vulnerability family, obtain the common attack surface and attack chain path of the vulnerability family, and obtain the vulnerability family analysis results.

[0011] By employing the aforementioned technical solution and using a vulnerability association analysis method based on shared origins, potential vulnerabilities are characterized and vectorized. This transforms the vulnerability association analysis problem into a problem of feature vector similarity calculation and clustering. Leveraging the powerful capabilities of machine learning algorithms, the association between potential and known vulnerabilities can be quickly identified, revealing the "family" attribute of vulnerabilities—that is, the hacker organization, attack group, or automated tool to which the vulnerability belongs. Further integration of POC and EXP script libraries automatically identifies the common attack surfaces and attack chain paths of vulnerability families. This method of automatically mining vulnerability associations and attack paths from massive amounts of vulnerability data significantly improves automation. The analyzed vulnerability family results can guide penetration testers in referencing mature attack weapons and strategies, achieving twice the result with half the effort.

[0012] Optionally, the step of using a BERT pre-trained language model to perform semantic parsing on the business document and extracting key elements related to penetration testing to form structured penetration testing terminology specifically includes: expanding the vocabulary of the BERT pre-trained language model based on penetration testing terminology to obtain a BERT-BiLSTM-CRF named entity recognition model, wherein the BERT-BiLSTM-CRF named entity recognition model includes a BERT layer, a BiLSTM layer, and a CRF layer; dividing the business document into multiple word segmentation units, and inputting each word segmentation unit into the BERT layer, and extracting each word segmentation unit through the BERT layer. The semantic vectors corresponding to the segmented units are used to obtain a semantic vector sequence. The semantic vector sequence is input into the BiLSTM layer and the CRF layer. The BiLSTM layer learns the sequence dependencies between the segmented units, and the CRF layer is used to annotate the segmented units to obtain a tag sequence containing key penetration testing terms. The tag sequence is post-processed to extract key terms from the business document and calculate the attention weight of the key terms. Target key terms are selected from the key terms based on the attention weight, and the attribute information of the target key terms is structurally represented to form structured penetration testing terminology.

[0013] By employing the above technical solutions, the BERT pre-trained language model is used to semantically parse business documents, fully leveraging BERT's advanced capabilities in NLP to accurately understand the technical terms and semantic logic within these documents. By constructing a BERT-BiLSTM-CRF named entity recognition model, key elements relevant to penetration testing can be automatically extracted from business documents, including the attacking entity, prerequisites, attack operations, and expected results, directly addressing the core aspects of penetration testing. The business document is decomposed into a sequence of semantic vectors, and the sequence dependencies of segmentation units are learned through BiLSTM layers to further uncover the intrinsic relationships between elements. CRF layers are used to accurately annotate key terms. An attention mechanism assigns different weights to key terms, highlighting important information. Finally, penetration testing terminology is structured into standardized instructions.

[0014] Optionally, the preset reinforcement learning algorithm includes a state awareness layer, an Actor decision layer, a Critic value evaluation layer, and a prior knowledge fusion layer. The step of generating an attack path based on the penetration testing strategy using the preset reinforcement learning algorithm specifically includes: organizing the real-time state data of the target system through the state awareness layer; inputting the real-time state data, the output data of the prior knowledge fusion layer, and the penetration testing strategy into the Actor decision layer to generate the next attack action; inputting the next attack action into the Critic value evaluation layer to calculate the value evaluation score of the next attack action; feeding back the value evaluation score to the Actor decision layer and the prior knowledge fusion layer to optimize the policy network parameters of the preset reinforcement learning algorithm; adjusting the output of the Actor decision layer according to the policy network parameters, and using the attack action sequence output by the Actor decision layer as the attack path.

[0015] By employing the above technical solution, the pre-defined reinforcement learning algorithm comprises multiple layers that work collaboratively to achieve adaptive generation of attack paths. The state awareness layer is responsible for organizing real-time state data of the target system and sensing dynamic changes in the environment during the penetration process. The actor decision layer receives real-time state data, prior knowledge, and penetration strategies, makes decisions, and outputs the optimal attack action for the next step. The criterion value assessment layer scores the attack actions, evaluates the attack effect, and establishes a reward and punishment mechanism. The prior knowledge fusion layer uses known attack paths as prior experience to guide and optimize the decision-making process. Through feedback from value scores, the decision model is continuously adjusted and improved, making the output attack path more intelligent and efficient. The entire decision-making process is a closed-loop learning and self-reinforcing process, constantly adapting to the dynamic changes of the target system. The resulting attack path possesses strong environmental adaptability, can evade defense measures, and improves the penetration success rate.

[0016] Optionally, the step of inputting the original attack code corresponding to the attack path into a preset generative adversarial network (GAN) to generate obfuscated attack code specifically includes: using the original attack code as a conditional input to the preset GAN, which includes a generator and a discriminator; using the generator to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code in combination with random noise to generate transformed attack code; using the discriminator to analyze the characteristics of the transformed attack code and calculate the quality score of the transformed attack code; if the quality score is determined to be greater than or equal to a preset score threshold, then the transformed attack code is determined to be the obfuscated attack code.

[0017] By employing the above technical solution, the original attack code corresponding to the attack path is input into a pre-defined generative adversarial network (GAN). Leveraging the GAN's powerful generation and adversarial capabilities, obfuscated attack code that bypasses antivirus detection systems can be automatically generated. The generator takes the original attack code and random noise as input, and through syntax transformation, semantic obfuscation, and encoding conversion, generates diverse transformation attack codes, expanding the code's distribution space and giving it a degree of randomness and diversity. The discriminator, through adversarial learning, continuously optimizes its parameters, improving its ability to identify obfuscated code, which in turn prompts the generator to generate more deceptive obfuscated code. Through the game-like adversarial interaction between the generator and the discriminator, the quality of the obfuscated attack code can be continuously iteratively optimized, ultimately generating obfuscated code capable of bypassing antivirus software and intrusion detection systems. A quality scoring feedback mechanism is introduced to ensure that the obfuscated code not only has strong evasion capabilities but also functional integrity, allowing it to be directly used for penetration attacks. Compared to traditional obfuscation tools, this solution has stronger adaptability and flexibility, enabling it to cope with constantly changing defense and adversarial environments.

[0018] Optionally, the step of using the generator to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code in conjunction with random noise to generate transformed attack code specifically includes: concatenating the original attack code and a random noise vector to form the input vector of the generator; randomly replacing code elements of the original attack code using the generator's built-in syntax transformation rule library to generate syntax-transformed attack code, wherein the code elements include variable names, function names, and class names; inserting redundant code fragments into the syntax-transformed attack code using the generator's built-in semantic obfuscation rule library to generate semantically obfuscated attack code, wherein the redundant code fragments include invalid instructions, redundant code blocks, and unreachable branches, wherein the unreachable branches are paths that will not be executed; and encoding conversion of the semantically obfuscated attack code using a preset encoding method using the generator's built-in encoding conversion rule library to form the transformed attack code.

[0019] This paper details the working principle of the generator in a generative adversarial network (GAN) by employing the aforementioned technical solution. The generator incorporates a grammar transformation rule base, a semantic obfuscation rule base, and an encoding conversion rule base, forming an automated code obfuscation mechanism. By randomly replacing code elements, it can disrupt the readability of the attack code, causing it to lose its semantic features and making it difficult for static analysis tools to detect. By inserting invalid instructions and redundant code blocks, it further increases code complexity, resisting code similarity detection. Finally, it utilizes multiple encoding methods to hide sensitive literal information, bypassing signature-based detection. The generator integrates obfuscation methods at the grammatical, semantic, and encoding levels, providing comprehensive protection for the original attack code. By setting random noise input, the obfuscation can be made more flexible and varied, increasing code diversity. Unlike traditional obfuscation tools, this solution can automatically and customarily generate a large number of obfuscated code variants with complex requirements, giving the attack code multifaceted characteristics and greatly improving immunity.

[0020] Optionally, the penetration test on the target system based on the attack path and the obfuscated attack code to obtain the penetration test result specifically includes: controlling the attack execution layer to execute each attack action in a set order according to the attack path; during the execution of each attack action, calling the corresponding obfuscated attack code to initiate an attack request; after initiating the attack request, monitoring the response status and behavior changes of the target system; if the expected response status or abnormal behavior is detected, the penetration is determined to be successful, the penetration success status is output, and the penetration process log is recorded; if the expected response status or abnormal behavior is not detected, the penetration is determined to be unsuccessful, the penetration failure status is output, and the penetration process log is recorded.

[0021] Specifically, the process of penetration testing based on attack paths and obfuscated attack code is described in detail. The attack execution layer controls the execution order of attack actions according to the attack path, strictly following the path planning to make the attack more standardized and efficient. During execution, the generated obfuscated attack code is invoked to launch the actual attack. The obfuscated code not only hides the attack behavior but also adapts to different attack scenarios, significantly improving the success rate. By monitoring the response status and behavioral changes of the target system, feedback is obtained in a timely manner to determine the penetration effect. If the penetration is successful, the penetration process log is fully recorded to provide a basis for reproduction and auditing. If the penetration fails, relevant information is also recorded in detail to improve subsequent penetration strategies. The entire penetration process achieves automated operation and intelligent judgment, and a comprehensive recording mechanism is established to form a closed-loop process for penetration testing.

[0022] A second aspect of this application provides a multi-model collaborative penetration testing device, comprising: a data acquisition module, a penetration testing data extraction module, a large model generation testing strategy module, an attack path generation module, a code obfuscation module, and a penetration testing module, wherein: the data acquisition module is used to acquire target asset information and external knowledge data of a target system, the target system being the object to be penetrated; the penetration testing data extraction module is used to analyze the target asset information in conjunction with the external knowledge data to obtain corresponding structured penetration data; the large model generation testing strategy module is used to acquire the current state of the target system, input the current state and the structured penetration data into a preset large language model to generate a penetration testing strategy; the attack path generation module is used to generate attack paths based on the penetration testing strategy using a preset reinforcement learning algorithm; the code obfuscation module is used to input the original attack code corresponding to the attack path into a preset generative adversarial network to generate obfuscated attack code; and the penetration testing module is used to perform penetration testing on the target system based on the attack path and the obfuscated attack code to obtain penetration testing results.

[0023] A third aspect of this application provides an electronic device including a processor, a memory, a user interface, and a network interface, wherein the memory is used to store instructions, the user interface and the network interface are both used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described in any of the foregoing.

[0024] A fourth aspect of this application provides a computer-readable storage medium storing instructions that, when executed, perform the method described in any of the preceding descriptions.

[0025] In summary, one or more technical solutions provided in this application have at least the following technical effects or advantages:

[0026] 1. By integrating external knowledge and asset information to generate structured penetration data, and then combining the current state of the target system with the large language model to adaptively generate strategies, reinforcement learning is used to plan near-optimal attack paths under constraints, and semantically equivalent obfuscation loads are generated through generative adversarial networks to improve the realism of the assessment. Finally, a traceable closed loop is formed in the execution and result collection, achieving higher coverage, better execution efficiency and stronger adversarial realism. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating a multi-model collaborative penetration testing method disclosed in an embodiment of this application;

[0028] Figure 2This is a schematic diagram of a multi-model collaborative penetration testing device disclosed in an embodiment of this application;

[0029] Figure 3 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application.

[0030] Explanation of reference numerals in the attached diagram: 201, Data acquisition module; 202, Penetration test data extraction module; 203, Large model generation test strategy module; 204, Attack path generation module; 205, Code obfuscation module; 206, Penetration test module; 300, Electronic device; 301, Processor; 302, Communication bus; 303, User interface; 304, Network interface; 305, Memory. Detailed Implementation

[0031] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0032] In the description of the embodiments of this application, the words "for example" or "for instance" are used to indicate examples, illustrations, or explanations. Any embodiment or design that is described as "for example" or "for instance" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design options. Rather, the use of the words "for example" or "for instance" is intended to present the relevant concepts in a specific manner.

[0033] In the description of the embodiments of this application, the term "multiple" means two or more. For example, multiple systems means two or more systems, and multiple screen terminals means two or more screen terminals. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the indicated technical features. Thus, a feature defined with "first" or "second" may explicitly or implicitly include one or more of that feature. The terms "comprising," "including," "having," and variations thereof all mean "including but not limited to," unless otherwise specifically emphasized.

[0034] This application provides a multi-model collaborative penetration testing method, referring to... Figure 1 , Figure 1This is a flowchart illustrating a multi-model collaborative penetration testing method provided in an embodiment of this application. The method is applied to a server, which executes the multi-model collaborative penetration testing program. The server can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center. The method includes steps S101 to S106, as follows:

[0035] Step S101: Obtain target asset information and external knowledge data of the target system. The target system is the object to be penetrated and tested.

[0036] In step S101, the server, as the executing entity, is responsible for acquiring target asset information and external knowledge data of the target system. The target system refers to an object that can be used for penetration testing, which can be a website, application, server, network device, etc. The server automatically collects various types of information from the target system through multiple methods for subsequent analysis and penetration testing.

[0037] First, the server performs a comprehensive scan of the target system using network scanning tools such as Nmap and Masscan to obtain target asset information, including open port numbers, the service types and versions corresponding to those ports. This step helps the server quickly understand the network topology and host distribution of the target system. For example, the scan results show that the target system has ports 80, 443, and 3306 open, corresponding to a web service, an SSL-encrypted web service, and a MySQL database service, respectively.

[0038] Next, the server uses web crawling technology, starting with the identified web services, to automatically crawl the website's URLs, page content, request parameters, cookies, and other information to create a site map. The crawler can be configured with parameters such as crawl depth and frequency, ensuring coverage of the entire site while avoiding impact on the target system's performance.

[0039] Building upon port scanning and web crawling, the server also actively invokes various fingerprinting tools to further obtain information about the target system's technology stack, such as operating system type, web container type, and scripting language type. Common tools include Nmap, p0f, and WhatWeb. Fingerprint information helps identify potential security vulnerabilities in the target system. For example, it might identify that the target system is using Apache Tomcat version 7.x, which has several serious vulnerabilities.

[0040] Besides active probing, servers also acquire target asset information passively. For example, they use search engines like Zoomeye and Fofa to query the target system's public network information, collecting asset data such as domain names, IP addresses, and SSL certificates; they retrieve target-related source code and configuration information through code hosting platforms like GitHub; and they use social engineering databases to query the account and password information of target personnel. Passive information collection minimizes the risk of directly contacting the target and reduces the chance of being discovered.

[0041] In addition to acquiring the target's own asset data, the server can also obtain relevant vulnerability intelligence and exploit code from external knowledge bases. Vulnerability knowledge bases, such as NVD and CVE, provide massive amounts of structured information including vulnerability descriptions, affected versions, and exploitation conditions. The server can synchronize this data locally and compare it with the target asset information to make a preliminary judgment on potential security vulnerabilities in the target system.

[0042] In addition, the server collects penetration testing-related technical documents, including system design documents, database structure documents, and interface specification documents, to gain a more comprehensive understanding of the target system's architecture and business logic, and to uncover potential attack surfaces. These documents can be obtained through search engines, cloud storage, internal knowledge bases, and other channels.

[0043] Step S102: Combine external knowledge data to analyze the target asset information and obtain the corresponding structured penetration data.

[0044] In step S102, external knowledge data includes business documents, vulnerability knowledge bases, POC script libraries, and EXP script libraries. Combining this external knowledge data, the target asset information is analyzed to obtain corresponding structured penetration testing data. Specifically, this includes: performing correlation analysis on port and service information, and combining this with the vulnerability knowledge base to identify potential vulnerabilities related to open ports and running services, forming a potential vulnerability list for the target system; using a common vulnerability correlation analysis method, comparing and classifying the potential vulnerabilities with features from the vulnerability knowledge base, POC script library, and EXP script library in the external knowledge data to identify the vulnerability families corresponding to the potential vulnerabilities, obtaining vulnerability family analysis results; based on the potential vulnerability list and vulnerability family analysis results, and combined with external knowledge data, determining the general and common vulnerability information of the target system, forming a structured general vulnerability list and a common vulnerability list; using a BERT pre-trained language model to perform semantic parsing on the business documents, extracting key elements related to penetration testing, forming structured penetration testing terminology, with key elements including the attacker, prerequisites, attack operations, and expected results; and combining the potential vulnerability list, general vulnerability list, common vulnerability list, and penetration testing terminology to obtain structured penetration testing data.

[0045] Specifically, the server performs correlation analysis between the open ports of the target asset and the service running status. By matching port numbers with service fingerprints, it can accurately determine the specific service type, version, and other information running on each open port. Based on this, the server calls a vulnerability knowledge base interface to comprehensively search for known vulnerabilities related to these service versions, identify potential security risks, and form a potential vulnerability list for the target system. For example, if it finds that the target host has port 80 open and the service is Apache Tomcat 8.5.31, it can be associated with high-risk vulnerabilities such as CVE-2018-11784 and CVE-2018-1305.

[0046] Next, the server employs a vulnerability association analysis method based on shared origins to further cluster the potential vulnerability list. This method, based on vulnerability knowledge graph construction technology, comprehensively associates vulnerabilities by analyzing their causes, impacts, exploitation methods, and other multi-dimensional attributes. For each potential vulnerability, the server extracts its key features, embeds them into a semantic vector space, and identifies "vulnerability families" that share the same roots through clustering algorithms. For example, historical Struts2 vulnerabilities can be grouped into a vulnerability family based on their common exploit expression parsing flaws. Forming families implies that these vulnerabilities may share common attack surfaces and exploit chains, significantly increasing the penetration success rate. The server then traverses the vulnerability families, retrieving corresponding attack methods and exploit code from the vulnerability knowledge base, POC library, and EXP library, further enriching the threat intelligence of potential vulnerabilities.

[0047] Based on this, the server further analyzes the overall threat landscape of the target system from two different dimensions. First, based on the CVSS vulnerability scoring system, it analyzes the severity, scope of impact, and exploitation difficulty of potential vulnerabilities, extracting common high-risk vulnerabilities prevalent in the target system, such as weak passwords and misconfigurations, forming a list of common vulnerabilities. Second, the server comprehensively reviews common industry-wide key vulnerabilities, such as SQL injection, file upload, and RCE, assessing their exposure in the target system, forming a list of common vulnerabilities. Common vulnerabilities reflect weaknesses in the target's own security baseline, while common vulnerabilities indicate a high risk of encountering known attack methods. These two types of threats intertwine, defining key directions for subsequent penetration testing.

[0048] Finally, the server will also conduct in-depth semantic analysis of business documents to further guide penetration testing. The server uses a BERT-based language model to comprehensively parse unstructured text, including system design documents, API documentation, and user manuals. Through continuous pre-training and fine-tuning, the model learns from cybersecurity corpora using an attention mechanism, gaining the ability to accurately understand technical terms and identify semantic relationships. The server uses this model to perform comprehensive semantic mining of the text, extracting key elements such as attack targets, preconditions, operational steps, and expected results to form structured penetration testing materials. These elements are interconnected and can directly guide the efficient implementation of penetration tests. For example, extracting from API documentation that a certain interface can be arbitrarily called without authorization allows that interface to be identified as a key attack target.

[0049] The server ultimately integrates heterogeneous data from multiple sources, including potential vulnerability lists, vulnerability family intelligence, general vulnerability lists, common vulnerability lists, and structured penetration elements, converging them into a unified structured penetration dataset. This dataset covers multiple key dimensions, such as the target asset's inherent vulnerabilities, known threats, and possible attack paths, serving as direct input for subsequent penetration strategy formulation and attack path generation. The server persistently stores this structured penetration data, incorporating it into a security big data platform and establishing standardized data interfaces for continuous access throughout the penetration process.

[0050] Taking an e-commerce website as an example, this explains how the server can derive structured penetration data by analyzing target asset information and external knowledge data.

[0051] First, the server used port scanning to discover that the target website had open ports 80, 443, 3306, and 6379. Through fingerprinting, it was determined that port 80 was running Nginx 1.16.0, port 3306 was running MySQL 5.7.20, and port 6379 was running Redis 4.0.9. For these service versions, the server retrieved vulnerabilities from vulnerability databases such as NVD and identified Nginx code execution vulnerability (CVE-2019-20372), MySQL privilege escalation vulnerability (CVE-2016-6663), and Redis unauthorized access vulnerability (CVE-2022-0543), forming a list of potential vulnerabilities.

[0052] Next, the server categorizes these vulnerabilities into several vulnerability families using techniques such as semantic analysis and clustering. For example, the Nginx vulnerability shares the same origin as several historical PHP-FPM remote code execution vulnerabilities, and their exploitation methods are similar. The MySQL vulnerability stems from improper configuration and belongs to the "misconfiguration" family, along with other database weak password and sensitive information disclosure vulnerabilities. The server then extracts common exploit code for these vulnerability families from the POC and ExP libraries, enriching the exploitable information of the vulnerabilities.

[0053] Based on this, the server, drawing on industry experience, identified common vulnerabilities that may be prevalent on the target website, such as weak passwords, directory traversal, and unauthorized access, forming a list of common vulnerabilities. At the same time, e-commerce websites of this type are susceptible to business logic vulnerabilities such as SQL injection, product price tampering, and order information leakage, which are included in the list of common vulnerabilities.

[0054] Finally, the server performs semantic mining on the website's design documents, interface documents, etc. By accurately understanding technical terms through the BERT model, it extracts key penetration testing information such as "ordinary users can access the backend management interface" and "price parameters are not validated when generating orders," forming structured data that can directly guide penetration testing.

[0055] In one possible implementation, the vocabulary expansion embedding vector e new Determine as follows:

[0056] If the token is in the pre-trained vocabulary, e new =e pretrained ;

[0057] If the token is obtained by concatenating k subwords, e new= (1 / k)*Σ_{j=1..k}e j .}

[0058] Where: e_new is the embedding vector of the expanded term; e_pretrained is the embedding vector of existing terms in the pre-trained vocabulary; token is the current term; k is the number of sub-words obtained by decomposing token; e j Let be the embedding vector of the j-th subword.

[0059] In one possible implementation, a vulnerability association analysis method is employed to compare and classify potential vulnerabilities with external knowledge bases, POC script libraries, and EXP script libraries, identifying the vulnerability families corresponding to the potential vulnerabilities and obtaining vulnerability family analysis results. Specifically, this includes: extracting feature information from potential vulnerabilities and constructing target vulnerability feature vectors based on this information; extracting key features from known vulnerabilities in the vulnerability knowledge base to form known vulnerability feature vectors; calculating the similarity between the target vulnerability feature vectors and known vulnerability feature vectors to obtain a similarity matrix; using a clustering algorithm based on the similarity matrix to cluster potential and known vulnerabilities, obtaining multiple clusters, where each cluster corresponds to a vulnerability family; determining the vulnerability family corresponding to the potential vulnerabilities based on the clusters; and integrating the POC script library and EXP script library to identify vulnerability families, obtaining the common attack surface and attack chain path of the vulnerability families, thus obtaining vulnerability family analysis results.

[0060] Specifically, the server performs correlation analysis between the open ports of the target asset and the service running status. By matching port numbers with service fingerprints, it can accurately determine the specific service type, version, and other information running on each open port. Based on this, the server calls a vulnerability knowledge base interface to comprehensively search for known vulnerabilities related to these service versions, identify potential security risks, and form a potential vulnerability list for the target system. For example, if it finds that the target host has port 80 open and the service is Apache Tomcat 8.5.31, it can be associated with high-risk vulnerabilities such as CVE-2018-11784 and CVE-2018-1305.

[0061] Next, the server employs a vulnerability association analysis method based on shared origins to further cluster the potential vulnerability list. This method, based on vulnerability knowledge graph construction technology, comprehensively associates vulnerabilities by analyzing their causes, impacts, exploitation methods, and other multi-dimensional attributes. For each potential vulnerability, the server extracts its key features, embeds them into a semantic vector space, and identifies "vulnerability families" that share the same roots through clustering algorithms. For example, historical Struts2 vulnerabilities can be grouped into a vulnerability family based on their common exploit expression parsing flaws. Forming families implies that these vulnerabilities may share common attack surfaces and exploit chains, significantly increasing the penetration success rate. The server then traverses the vulnerability families, retrieving corresponding attack methods and exploit code from the vulnerability knowledge base, POC library, and EXP library, further enriching the threat intelligence of potential vulnerabilities.

[0062] Based on this, the server further analyzes the overall threat landscape of the target system from two different dimensions. First, based on the CVSS vulnerability scoring system, it analyzes the severity, scope of impact, and exploitation difficulty of potential vulnerabilities, extracting common high-risk vulnerabilities prevalent in the target system, such as weak passwords and misconfigurations, forming a list of common vulnerabilities. Second, the server comprehensively reviews common industry-wide key vulnerabilities, such as SQL injection, file upload, and RCE, assessing their exposure in the target system, forming a list of common vulnerabilities. Common vulnerabilities reflect weaknesses in the target's own security baseline, while common vulnerabilities indicate a high risk of encountering known attack methods. These two types of threats intertwine, defining key directions for subsequent penetration testing.

[0063] Finally, the server will also conduct in-depth semantic analysis of business documents to further guide penetration testing. The server uses a BERT-based language model to comprehensively parse unstructured text, including system design documents, API documentation, and user manuals. Through continuous pre-training and fine-tuning, the model learns from cybersecurity corpora using an attention mechanism, gaining the ability to accurately understand technical terms and identify semantic relationships. The server uses this model to perform comprehensive semantic mining of the text, extracting key elements such as attack targets, preconditions, operational steps, and expected results to form structured penetration testing materials. These elements are interconnected and can directly guide the efficient implementation of penetration tests. For example, extracting from API documentation that a certain interface can be arbitrarily called without authorization allows that interface to be identified as a key attack target.

[0064] The server ultimately integrates heterogeneous data from multiple sources, including potential vulnerability lists, vulnerability family intelligence, general vulnerability lists, common vulnerability lists, and structured penetration elements, into a unified structured penetration dataset. This dataset covers multiple key dimensions, such as the vulnerability of the target asset itself, the known threats it faces, and possible attack paths, serving as direct input for subsequent penetration strategy formulation and attack path generation.

[0065] In one possible implementation, a BERT pre-trained language model is used to perform semantic parsing on business documents, extracting key elements related to penetration testing to form structured penetration testing terminology. Specifically, this includes: expanding the vocabulary of the BERT pre-trained language model based on penetration testing terminology to obtain a BERT-BiLSTM-CRF named entity recognition model, which includes a BERT layer, a BiLSTM layer, and a CRF layer; dividing the business document into multiple word segments and inputting each segment into the BERT layer to extract semantic vectors corresponding to each segment, resulting in a semantic vector sequence; inputting the semantic vector sequence into the BiLSTM and CRF layers, learning sequence dependencies between segment segments through the BiLSTM layer, and labeling the segment segments using the CRF layer to obtain a label sequence containing key penetration testing terms; post-processing the label sequence to extract key terms from the business document and calculating attention weights for the key terms; selecting target key terms from the key terms based on the attention weights, and structurally representing the attribute information of the target key terms to form structured penetration testing terminology.

[0066] Specifically, the server expands the vocabulary of the original BERT pre-trained language model based on a massive corpus of penetration testing terminology. Engineers continuously supplement the model's vocabulary with professional terms, including technical terms, abbreviations, and hacker terms, enabling the model to accurately understand specific concepts in the context of penetration testing. Building upon this, the server constructs an enhanced named entity recognition model, BERT-BiLSTM-CRF. This model, by integrating BERT's semantic encoding capabilities, BiLSTM's sequence learning capabilities, and CRF's sequence labeling capabilities, can efficiently extract penetration elements end-to-end. Specifically, the model comprises three key layers: a BERT-based feature extraction layer, used to transform the original text into semantically rich vector representations; a BiLSTM-based sequence learning layer, used to mine the contextual relationships between words; and a CRF-based classification and labeling layer, used to achieve fine-grained annotation of word attributes. These three layers work together to form a complete penetration semantic parsing process.

[0067] After the model is built, the server loads the business document to be analyzed into the input of BERT-BiLSTM-CRF. First, the server performs word-based segmentation on the document. Tailored to the characteristics of the cybersecurity domain, the segmentation module incorporates a domain dictionary and rule engine, enabling accurate sentence segmentation and identification of proper noun phrases. Next, the segmented word sequence is fed into the BERT layer. Leveraging its powerful feature extraction capabilities, each word is mapped to a high-dimensional semantic vector space. Synonyms with the same semantic connotation are closer in Euclidean distance within this space, while words with different semantic meanings are farther apart. The output of this layer is a vector sequence containing rich semantic information.

[0068] The semantic vector sequence is then fed into a BiLSTM layer. BiLSTM, through a bidirectional recurrent neural network mechanism, retrieves the entire sentence forward and backward, centered on the current word, fully exploring the sequence dependencies between word units. This allows the model to understand not only the semantics of individual words but also the contextual word order relationships, forming a more complete semantic understanding. The output of BiLSTM is further passed to a CRF layer. CRF, by learning a penetration testing annotation system, can implement optimal sequence annotation for each word unit. For example, action-related word units are labeled as "operation," purpose-related word units as "target," and condition-related word units as "prerequisite," etc. CRF overcomes the annotation offset problem that easily occurs when using deep learning alone, significantly improving the accuracy of key element extraction.

[0069] The final output of the BERT-BiLSTM-CRF model is a label sequence of the same length as the original document. The server post-processes this sequence, connecting the labeled keywords into meaningful key terms according to a pre-defined penetration testing conceptual framework. For example, the two words labeled "target" and "vulnerability" can be combined into the term "target vulnerability." The extracted key terms are further weighted with attention weights. These weights reflect the importance of the term within the full-text semantic network. The server comprehensively considers factors such as term frequency, co-occurrence probability, and PageRank centrality, calculating the attention weight score for each term using a random walk algorithm.

[0070] Finally, the server ranks all terms based on attention weights, selecting the Top-N target keywords as the primary focus for penetration testing. The server extracts attribute information from these terms, including content, type, sentence segment, and context, and stores this information in a structured graph database, forming a standardized penetration testing terminology knowledge base. For example, the server extracts key terms such as "SQL injection," "lateral movement," and "domain administrator privileges" from business documents. These interconnected terms reveal a hidden high-risk attack path and thus occupy an important position in the penetration testing terminology knowledge base.

[0071] Step S103: Obtain the current state of the target system, input the current state and structured penetration data into the preset large language model, and generate a penetration testing strategy.

[0072] In step S103, the DeepSeek-R1 model is used as the base model of the preset large language model; multiple authoritative security domain knowledge bases are collected as training data to fine-tune the DeepSeek-R1 model so that the DeepSeek-R1 model can learn professional knowledge and language patterns in the security domain.

[0073] Based on cue learning technology, cue words are constructed that include attack task type, business scenario description, test objectives, and output requirements. The cue words, current status, and structured penetration data are input into the DeepSeek-R1 model, which performs analysis and reasoning to generate a penetration testing strategy document that includes test objectives, attack methods, and verification steps.

[0074] Specifically, the server uses DeepSeek-R1 as its base language model. DeepSeek-R1 is a general-purpose, large-scale pre-trained model with powerful natural language understanding and generation capabilities. However, due to the specialized nature of cybersecurity, this model is difficult to directly apply to penetration testing strategy generation tasks. Therefore, the server adopts a model fine-tuning strategy to specifically improve the model's applicability in the security domain.

[0075] Specifically, the server extensively collects authoritative knowledge in the security field, including well-known domestic and international vulnerability databases such as CNNVD, CNVD, and NVD, as well as technical articles and analysis reports from various sources such as cybersecurity forums, blogs, and public accounts. Engineers systematically organized this unstructured security knowledge system, extracted key information elements, and structured and stored it according to unified data standards, forming a high-quality security domain corpus. The server uses this corpus as a training set for fine-tuning, incrementally training the DeepSeek-R1 model. Leveraging this massive domain corpus, the model quickly learns professional concepts, terminology, and grammatical patterns in the penetration testing field, forming a unique security domain language model. The fine-tuned DeepSeek-R1 can accurately understand the semantic connotations of penetration testing tasks and has the ability to describe target systems and propose penetration strategies from a security perspective.

[0076] Next, based on cue learning technology, the server further guides the fine-tuned DeepSeek-R1 to generate specific penetration testing strategies. The core idea of ​​cue learning is to provide the large model with contextual cues describing the task background, enabling it to complete the target task within a specific context. The server has designed a set of structured cue word templates, which cover several key elements of a penetration testing task, including the attack target, test scenario, task type, and output requirements. For example, a typical cue word template is: "[Task Type: Web Penetration Testing][Target System: www.xxx.com][Known Vulnerabilities: SQL Injection, File Upload][Security Objective: Obtain Server Privileges][Output Requirements: Please provide detailed penetration steps, including tools used, exploitation methods, verification methods, etc., arranged in the order of penetration]". This set of cue word templates essentially provides a "task details table" for the model's strategy generation process, making the output strategy content more standardized, complete, and aligned with practical needs.

[0077] After the prompt words are constructed, the server inputs them, along with the structured penetration data generated in step S102 and the real-time status data of the target system, into the model. Thanks to the security knowledge accumulated during fine-tuning, DeepSeek-R1 can fully understand the target system's security semantic profile contained in the input data. For example, from the structured penetration data, the model analyzes that the target system's Web framework version has a known RCE vulnerability; from the real-time status information, the model perceives that the target system has not enabled its firewall and has multiple high-risk ports. Combining these clues and referring to the task requirements in the prompt words, the model autonomously generates a penetration testing strategy that fits the current state of the target system through intelligent logic such as causal reasoning and attack path planning. For example, the strategy document fragment output by the model might be: "1. Use Nmap to scan the target IP to confirm the running status of the Web service corresponding to port 80; 2. Utilize the known Web framework RCE vulnerability to upload a Webshell to obtain server control privileges; 3. After obtaining server privileges, scan internal network assets and find that the database server has port 3306 open; 4. Use the Sqlmap tool to attempt an SQL injection attack on the database to steal sensitive data; 5...". This penetration strategy, which generates data "in real-time" based on actual input using a large language model, far surpasses the traditional manual coding method in terms of professionalism, targeting, and effectiveness.

[0078] Finally, to further improve the quality of the strategy, the server performs post-processing on the strategy documents generated by DeepSeek-R1. On one hand, the server uses natural language processing algorithms to perform syntax correction and logical verification on the documents, improving the fluency and rigor of the language. On the other hand, the server reviews the strategy content based on a penetration testing knowledge graph, eliminating inefficient, invalid, high-risk, or other inappropriate penetration techniques to ensure that the final output strategy strikes a balance in terms of compliance, security, and executability.

[0079] Step S104: Based on the penetration testing strategy, use a preset reinforcement learning algorithm to generate attack paths.

[0080] In step S104, the preset reinforcement learning algorithm includes a state awareness layer, an Actor decision layer, a Critic value assessment layer, and a prior knowledge fusion layer. Based on the penetration testing strategy, the preset reinforcement learning algorithm is used to generate an attack path, specifically including: organizing the real-time state data of the target system through the state awareness layer; inputting the real-time state data, the output data of the prior knowledge fusion layer, and the penetration testing strategy into the Actor decision layer to generate the next attack action; inputting the next attack action into the Critic value assessment layer to calculate the value assessment score of the next attack action; feeding back the value assessment score to the Actor decision layer and the prior knowledge fusion layer to optimize the policy network parameters of the preset reinforcement learning algorithm; adjusting the output of the Actor decision layer according to the policy network parameters, and using the attack action sequence output by the Actor decision layer as the attack path.

[0081] Specifically, the server uses a reinforcement learning algorithm to transform penetration testing strategies into executable attack paths. This reinforcement learning model consists of five collaborative modules: a state awareness layer, an actor decision layer, a criterion value assessment layer, and a prior knowledge fusion layer. Through continuous interaction between the intelligent agent and the environment, it gradually optimizes penetration decisions, ultimately forming a secure, efficient, and stealthy sequence of attack paths.

[0082] The specific implementation process is as follows: First, the state awareness layer is responsible for sensing and organizing various security status indicators of the target system in real time. This layer is deployed in the target network in the form of probes, continuously monitoring and collecting key data during system operation, including port open status, process behavior, resource utilization, etc., to describe the real-time security posture of the target system. For example, if it is detected that a server suddenly opens an SSH remote port and the number of connections surges, it is likely that the current system is under brute-force attack. The state awareness layer will promptly capture this abnormal signal and organize it into a structured state feature vector to guide subsequent penetration testing decisions.

[0083] Next, the Actor decision layer dynamically determines the optimal attack action by combining the target system's real-time state data, the output of the prior knowledge fusion layer, and the penetration testing strategy generated in the previous step. Specifically, the Actor network first fuses these heterogeneous input data through feature engineering to extract a unified and comprehensive penetration posture representation. Then, based on this posture representation, the Actor network intelligently searches the massive attack operation space to find the attack action most conducive to achieving the penetration target. For example, if the comprehensive posture shows that the target host has a weak SSH password and is directly connected to multiple core assets, the Actor network may decide to launch a password brute-force attack to seize control of the host and use it as a springboard to penetrate the internal network. It is worth noting that during the decision-making process, the prior knowledge fusion layer provides valuable "experience" references to the Actor network as needed. For example, the knowledge base may contain a penetration case highly similar to the current target, and the Actor network will refer to the penetration path and usage techniques in that case to optimize its own decision.

[0084] The attack actions output by the Actor Network are then sent to the Critic value assessment layer for evaluation. The Critic Network is essentially a value function approximator used to assess the long-term benefit of an attack action. For example, for an SQL injection attack on a website, if the Critic Network predicts that the action may cause website paralysis, trigger user complaints, and thus increase administrator oversight, it will give a lower value score; conversely, if it predicts that the action can covertly steal website data, increasing the success rate of subsequent penetration, it will give a higher score. The Critic Network's value judgment is based on both immediate rewards, such as whether the action can breach the target system's defenses or gain target privileges, and long-term rewards, such as the positive contribution of the action to subsequent penetration. Through the Critic Network's evaluation, the Actor Network can optimize its decision-making strategy and make more valuable action choices.

[0085] The Critic network's scoring results are fed back to the Actor decision-making layer and the prior knowledge fusion layer to optimize the agent's decision-making strategy. The Actor network updates its own policy network parameters based on the scores, improving the generation strategy of subsequent attack actions to achieve higher long-term penetration gains. The prior knowledge base also dynamically adjusts the priority of knowledge based on the scores, recommending more valuable penetration experiences to the Actor network. Through multiple rounds of iterative cycles of decision generation, value evaluation, and strategy optimization, the agent's penetration strategy continuously improves and tends towards optimality.

[0086] Once the agent reaches a certain iteration threshold, the server can generate the final attack path based on the output of the Actor network. This path encompasses a series of penetration operations, such as information gathering, vulnerability exploitation, privilege escalation, and lateral movement. These operations are arranged sequentially to form a complete penetration loop. The attack execution layer is responsible for interpreting abstract attack actions into executable penetration code and performing the actual penetration through automated frameworks such as Metasploit.

[0087] For example, suppose the MES system in a smart factory is the target of the penetration attack. The state awareness layer detects through industrial control security situational awareness that the MES server has TCP / 8080 port open and that an application on this port has a known RCE vulnerability. The Actor decision layer, combining this real-time state with existing penetration strategies and referring to similar industrial control penetration cases in the prior knowledge base, decides to use this vulnerability to launch a remote code execution attack on the MES system to gain system privileges. The Critic evaluation layer evaluates the value of this action based on factors such as attack success probability, impact scope, and scalability, giving it a high score. The Actor network optimizes the strategy network based on the score, further improving subsequent penetration actions. The final generated attack path is as follows: 1. Port scanning reveals that the MES server has port 8080 open; 2. Vulnerability scanning reveals that an application on this port has an RCE vulnerability; 3. Construct exploit code to break through server privileges; 4. Based on server privileges, scan the internal network to discover industrial control PLC devices; 5. Exploit the PLC firmware vulnerability to control critical equipment and affect the production line; 6. Penetration complete, clear intrusion traces.

[0088] Step S105: Input the original attack code corresponding to the attack path into the preset generative adversarial network to generate obfuscated attack code.

[0089] In step S105, the original attack code corresponding to the attack path is input into a preset generative adversarial network (GAN) to generate obfuscated attack code. Specifically, this includes: using the original attack code as a conditional input to the preset GAN, which includes a generator and a discriminator; using the generator to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code in combination with random noise to generate transformed attack code; using the discriminator to analyze the characteristics of the transformed attack code and calculate its quality score; if the quality score is determined to be greater than or equal to a preset score threshold, the transformed attack code is determined to be obfuscated attack code.

[0090] Specifically, the server utilizes Generative Adversarial Networks (GANs) technology to automatically transform the original attack code in the attack path into highly obfuscated attack code. The core idea is to use a generator to perform various syntactic, semantic, and encoding transformations on the original code, generating a series of attack code variants. Then, a discriminator evaluates the quality of the variant code from the perspectives of syntactic correctness, functional consistency, and obfuscation strength, selecting the optimal obfuscated code output. This process significantly improves the stealth of the attack code, effectively countering security defense mechanisms such as antivirus software and intrusion detection systems.

[0091] The specific implementation process is as follows: First, the server feeds the generator with the original attack code as conditional input to the GAN. For different attack codes, such as Webshells, worms, and C2 communication scripts, the generator employs different obfuscation strategies. The server pre-configures various code obfuscation techniques for the generator, covering all levels of code obfuscation, including syntax, semantics, and formatting.

[0092] At the syntactic level, generators primarily employ methods such as equivalent statement substitution, dead code insertion, and control flow flattening to alter the surface structure of the code. For example, a generator might replace if-else structures with switch-case structures, or insert numerous irrelevant variable definitions and assignment statements, making the code logic obscure and difficult to understand, while maintaining the same execution result.

[0093] At the semantic level, generators focus on hiding key constants, strings, and function names in the code. Common obfuscation techniques include string encryption, function name randomization, and replacing sensitive constants with expressions. For example, for a webshell containing a malicious URL, the generator will perform multiple XOR encryption on the URL string, then split the encrypted result into multiple substrings and store them in an array. When the webshell is executed, it dynamically concatenates and decrypts the substrings to obtain the real URL. Even if the code is decompiled, this semantic obfuscation method makes it difficult to easily recover sensitive information.

[0094] At the encoding level, the generator transforms the code during the bytecode stage. For example, it employs techniques such as virtual machine protection, junk instruction embedding, and polymorphism to insert extra virtual instructions during compilation, replacing critical bytecode fragments and causing logical inconsistencies and missing information during disassembly. For self-extracting malicious code, the generator also uses sophisticated packing techniques to make the code difficult to debug and trace during runtime.

[0095] During code obfuscation, the generator introduces random noise, ensuring that each obfuscation produces different variant code. This noise can be random dead code snippets, random variable names, random encryption keys, etc. With the introduction of noise, even the same original code will produce drastically different variants after multiple obfuscations. This diversity further increases the difficulty of detecting malicious code.

[0096] The variant code output by the generator is then fed into a discriminator for quality evaluation. The discriminator is essentially a binary classifier used to determine whether the input code is natural, unobfuscated native code. Ideally, for obfuscated variant code, the discriminator should be unable to distinguish it from the native code. Therefore, the generator's goal is to maximize its ability to deceive the discriminator, making the obfuscated code syntactically and semantically mimic the characteristics of natural code as closely as possible.

[0097] During the training phase, the discriminator continuously improves its ability to distinguish between native and obfuscated code, providing guidance to the generator. The generator, in turn, adjusts its obfuscation strategy based on feedback from the discriminator, learning how to generate more stealthy and realistic obfuscated code. Through this competitive process, both sides learn and improve, ultimately enabling the generator to master the art of producing high-quality obfuscated code that closely mimics native code and is difficult to detect.

[0098] During the application phase, the discriminator scores the variant code output by the generator from multiple dimensions, including syntactic correctness, functional consistency, and concealment strength. Syntactic correctness ensures that the obfuscated code can compile and run correctly; functional consistency ensures that the obfuscated code's execution result is consistent with the original code; concealment strength measures the difficulty of detecting and deobfuscating the obfuscated code. Only variant code with a quality score exceeding a preset threshold is output as the final obfuscated result. Through rigorous quality control, the server ensures that every piece of obfuscated code has a high degree of concealment and reliability.

[0099] For example, suppose the attack path contains a privilege escalation exploit for Windows systems. The generator first performs syntax obfuscation on this C code segment, replacing function calls with equivalent inline assembly instructions and explicit string constants with complex character arithmetic expressions. Next, it performs semantic obfuscation, encapsulating the process injection functionality of the exploit into a custom encryption library and encrypting the new process startup parameters using a substitution table. Finally, it performs encoding obfuscation, inserting numerous junk instructions and protecting critical code segments using a virtual machine. After multiple obfuscations, the original exploit code of only a few dozen lines is transformed into complex code of thousands of lines, filled with random variable names and junk code.

[0100] The discriminator evaluated the obfuscated code and found that its syntax structure differed significantly from common C code, its functional logic was deeply obfuscated, sensitive constants were encrypted with multiple layers, and after being protected by a virtual machine, decompiling it only yielded random bytecode. Its overall score was 85, exceeding the passing threshold of 80. Therefore, this variant code was selected as the final output, successfully evading antivirus software detection and allowing the attack to execute smoothly.

[0101] In one possible implementation, a generator combines random noise to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code to generate transformed attack code. Specifically, this includes: concatenating the original attack code and a random noise vector to form the generator's input vector; randomly replacing code elements of the original attack code using the generator's built-in syntax transformation rule library to generate syntax-transformed attack code, where code elements include variable names, function names, and class names; inserting redundant code fragments into the syntax-transformed attack code using the generator's built-in semantic obfuscation rule library to generate semantically obfuscated attack code, where redundant code fragments include invalid instructions, redundant code blocks, and unreachable branches; and encoding the semantically obfuscated attack code using a preset encoding method using the generator's built-in encoding conversion rule library to form the transformed attack code.

[0102] Specifically, the server uses generators in GANs to automatically convert the original attack code into highly covert obfuscated code through various techniques such as syntax transformation, semantic obfuscation, and encoding conversion.

[0103] First, the generator receives two inputs: the original attack code and a random noise vector. The original attack code is the source code to be obfuscated, which could be a webshell, a worm, or an exploit script. The random noise vector is a set of randomly generated values ​​used to guide the various random decisions in the code obfuscation process. The server concatenates the original code and the noise vector according to a fixed format into a complete input vector, which is then used as the generator's input.

[0104] After the input vector enters the generator, it is first sent to the syntax transformation module. This module, based on a pre-built syntax transformation rule library, randomly replaces various syntax elements of the code, changing the code's surface structure. Replaceable elements include identifiers such as variable names, function names, and class names. For example, for variable name replacement, the rule library may contain various transformation rules such as "splitting underscores between words," "removing the first letter of words," and "adding random suffixes." The generator randomly selects a rule and replaces the variable names in the code according to that rule, for example, replacing the variable name "user_input" with "uI_Randomstr." The same random transformation method is applied to other syntax elements such as function names and class names. Through this method, the various syntax elements of the attack code are replaced with functionally equivalent but differently shaped random strings, completely altering the overall appearance of the code.

[0105] The syntactically transformed code is then passed to the semantic obfuscation module. This module focuses on obfuscating the code's execution logic, inserting a large amount of redundant code and disrupting the original semantic structure without affecting the code's execution result. The generator's semantic obfuscation rule base contains pre-built templates for generating various redundant code, including empty loops, dead code blocks, and unreachable branches. For example, a "dead code block" insertion rule might look like this: "Randomly generate 3 to 5 variables, perform meaningless increment operations and conditional judgments, forming a logically never-executed code block." Each time, the generator randomly selects several rules based on the noise vector, generates corresponding redundant code fragments according to the rule descriptions, and inserts them into random positions in the original code. For example, after a permission judgment function, an infinite loop code block might be inserted; before a sensitive function call, a series of never-executed if-else branches might be inserted. In this way, a large amount of garbage logic is mixed into the code, increasing its length several times over. The actual attack statements are submerged in a sea of ​​redundant code, making the code's semantic logic obscure and difficult to understand.

[0106] The final step is encoding conversion. The generator takes the code, which has already undergone syntax transformation and semantic obfuscation, and performs further encoding conversion using a preset encoding method to form the final obfuscated code. The main purpose of encoding conversion is to improve the code's stealth and prevent it from being statically reverse engineered. Common encoding methods include string encryption, behavior-level virtualization, and junk code insertion. The generator's encoding conversion rule library includes these commonly used conversion methods. For example, the "string encryption" conversion rule might be described as follows: "Extract all string constants from the code, encrypt them using the RC4 algorithm, and generate a random key. The encrypted string is stored in hexadecimal form in an array at the beginning of the code. Where the string can be used in the code, it is changed to dynamically decrypt and concatenate the array using a decryption function." Based on the input noise vector, the generator randomly determines the specific conversion method and parameters for each step, such as selecting the encryption algorithm and generating the key, and then performs the corresponding conversion operations on the code according to the rule description. In the converted code, the original strings are replaced with garbled characters, making it impossible to recover the original information during static analysis.

[0107] After multiple rounds of transformation, a completely obfuscated code is born. It inherits the malicious functionality of the original code, but its form is drastically different: identifiers are replaced with random strings, redundant code is everywhere, and critical information is encrypted layer by layer. This obfuscated code can effectively evade signature-based scanning by antivirus software, reducing the probability of the attack being detected.

[0108] Step S106: Perform penetration testing on the target system based on the attack path and obfuscated attack code to obtain the penetration test results.

[0109] In step S106, a penetration test is performed on the target system based on the attack path and obfuscated attack code to obtain the penetration test results. Specifically, this includes: controlling the attack execution layer to execute each attack action in a set order according to the attack path; during the execution of each attack action, calling the corresponding obfuscated attack code to initiate an attack request; after initiating the attack request, monitoring the response status and behavior changes of the target system; if the expected response status or abnormal behavior is detected, the penetration is determined to be successful, the penetration success status is output, and the penetration process log is recorded; if the expected response status or abnormal behavior is not detected, the penetration is determined to be unsuccessful, the penetration failure status is output, and the penetration process log is recorded.

[0110] Specifically, the server launches an actual penetration attack on the target system based on the previously generated attack path and obfuscated attack code, and outputs the penetration test results based on the attack effect.

[0111] First, the server's attack execution layer loads the previously generated attack path. This attack path specifies a sequence of attack actions, such as: gathering information about the target system, obtaining information on the system version, open ports, etc.; searching relevant vulnerability databases based on the collected information to identify exploitable vulnerabilities; using exploit code to launch a vulnerability attack on the target system and obtain initial privileges; using initial privileges to upload backdoor programs and establish stable C2 communication; implementing privilege escalation to obtain high system privileges; and using high privileges to carry out subsequent penetration operations such as stealing sensitive information and erasing traces.

[0112] The attack execution layer strictly follows the order of actions in the path, scheduling attack tasks one by one. During the execution of each specific attack action, the server calls the corresponding obfuscated attack code. This code might be a fuzzing test script, an SQL injection payload, or a Trojan program, etc. Through obfuscation, this attack code can effectively evade antivirus software detection, ensuring the successful execution of the attack.

[0113] After the server invokes the obfuscated code, the attack request is sent to the target system. During the penetration test, the server monitors various status indicators and behaviors of the target system in real time. On one hand, the status monitoring module records various parameters of the target system before and after the attack, such as CPU utilization, memory usage, and port connection count. If significant changes are observed in these indicators before and after the attack, it can be inferred that the attack has had an actual effect. For example, in an SQL injection attack, if a sharp increase in CPU utilization and the reading of a large amount of sensitive data are observed after the attack request, it can be determined that the injection attack was successful and the database has been compromised.

[0114] On the other hand, the behavior detection module continuously monitors the target system for abnormal behavior at the network and host levels. Many successful attacks result in certain typical anomalies in the target system, such as the startup of numerous new processes, suspicious file modifications, and malicious network connections. The behavior detection module has a built-in rule library for detecting common penetration behaviors, enabling it to accurately detect these attack traces. For example, in a Webshell upload attack, if a suspicious PHP file is detected in the web directory, and its execution creates a reverse connection, then the Webshell has been successfully implanted.

[0115] By comprehensively analyzing the state changes and behavioral performance of each attack step, the server can accurately infer the actual effect of each attack step. If the expected response state or abnormal behavior is observed, the step is marked as "penetration successful"; otherwise, it is marked as "penetration failed". The penetration results and detailed process information are recorded in the penetration log in real time. The log covers rich information such as the timestamp of each attack action, execution time, called code, and exception stack, which can trace and review the entire penetration process.

[0116] Once all steps in the attack path have been executed, the server will comprehensively assess the penetration results of each step and output the final penetration test result. If all attack steps are successful, "Penetration Successful" will be output; if only some steps are completed, "Penetration Partially Successful" will be output; if all steps fail, "Penetration Failed" will be output. In addition to the overall success / failure conclusion, the test report will also list the penetration process logs for each stage in detail for post-attack analysis.

[0117] Reference Figure 2 This application also provides a multi-model collaborative penetration testing device, which is a server. The server includes a data acquisition module 201, a penetration testing data extraction module 202, a large model generation testing strategy module 203, an attack path generation module 204, a code obfuscation module 205, and a penetration testing module 206. Specifically: the data acquisition module 201 is used to acquire target asset information and external knowledge data of the target system, where the target system is the object to be penetrated; the penetration testing data extraction module 202 is used to analyze the target asset information in conjunction with external knowledge data to obtain corresponding structured penetration data; the large model generation testing strategy module 203 is used to acquire the current state of the target system, input the current state and structured penetration data into a preset large language model, and generate a penetration testing strategy; the attack path generation module 204 is used to generate attack paths based on the penetration testing strategy using a preset reinforcement learning algorithm; the code obfuscation module 205 is used to input the original attack code corresponding to the attack path into a preset generative adversarial network to generate obfuscated attack code; and the penetration testing module 206 is used to perform penetration testing on the target system based on the attack path and the obfuscated attack code to obtain penetration testing results.

[0118] In one possible implementation, external knowledge data includes business documents, vulnerability knowledge bases, POC script libraries, and EXP script libraries. The penetration testing data extraction module 202 combines this external knowledge data to analyze the target asset information and obtain corresponding structured penetration data. Specifically, the penetration testing data extraction module 202 performs correlation analysis on port information and service information, and, in conjunction with the vulnerability knowledge base, identifies potential vulnerabilities related to open ports and running services, forming a potential vulnerability list for the target system. The penetration testing data extraction module 202 employs a same-origin vulnerability correlation analysis method to compare and classify potential vulnerabilities with features from the vulnerability knowledge base, POC script library, and EXP script library in the external knowledge data, identifying potential vulnerabilities... The vulnerability family corresponding to the vulnerability is analyzed to obtain the vulnerability family analysis results. Based on the potential vulnerability list and vulnerability family analysis results, and combined with external knowledge data, the penetration test data extraction module 202 determines the general vulnerability information and common vulnerability information of the target system, forming a structured general vulnerability list and a common vulnerability list. The penetration test data extraction module 202 uses the BERT pre-trained language model to perform semantic parsing on the business documents, extracting key elements related to penetration testing, forming structured penetration test terminology. The key elements include the attacker, prerequisites, attack operations, and expected results. The penetration test data extraction module 202 integrates the potential vulnerability list, the general vulnerability list, the common vulnerability list, and the penetration test terminology to obtain structured penetration data.

[0119] In one possible implementation, the penetration testing data extraction module 202 employs a vulnerability association analysis method based on shared origins and characteristics. It compares and categorizes potential vulnerabilities with external knowledge bases, POC script libraries, and EXP script libraries to identify the vulnerability families corresponding to the potential vulnerabilities and obtain vulnerability family analysis results. Specifically, this includes: the penetration testing data extraction module 202 extracting feature information of potential vulnerabilities and constructing a target vulnerability feature vector based on this feature information; the penetration testing data extraction module 202 extracting key features of known vulnerabilities from the vulnerability knowledge base to form a known vulnerability feature vector; and the penetration testing data extraction module 202 further extracting key features of known vulnerabilities from the vulnerability knowledge base to form a known vulnerability feature vector. The penetration testing data extraction module 202 calculates the similarity between the feature vector of the target vulnerability and the feature vector of known vulnerabilities to obtain a similarity matrix. Based on the similarity matrix, the penetration testing data extraction module 202 uses a clustering algorithm to cluster potential vulnerabilities and known vulnerabilities to obtain multiple clusters, where each cluster corresponds to a vulnerability family. Based on the clusters, the penetration testing data extraction module 202 determines the vulnerability family corresponding to the potential vulnerability. The penetration testing data extraction module 202 integrates the POC script library and the EXP script library to identify the vulnerability family, obtain the common attack surface and attack chain path of the vulnerability family, and obtain the vulnerability family analysis results.

[0120] In one possible implementation, the large model generation testing strategy module 203 uses a BERT pre-trained language model to perform semantic parsing on the business document, extracting key elements related to penetration testing, and forming structured penetration testing terminology. Specifically, the large model generation testing strategy module 203 expands the vocabulary of the BERT pre-trained language model based on the vocabulary of the penetration testing domain to obtain a BERT-BiLSTM-CRF named entity recognition model, which includes a BERT layer, a BiLSTM layer, and a CRF layer; the large model generation testing strategy module 203 divides the business document into multiple word segmentation units and inputs each word segmentation unit into the BERT layer, through... The BERT layer extracts the semantic vectors corresponding to each word segmentation unit, resulting in a semantic vector sequence. The large model generating test strategy module 203 inputs the semantic vector sequence into the BiLSTM layer and the CRF layer. The BiLSTM layer learns the sequence dependencies between word segmentation units, and the CRF layer annotates the word segmentation units to obtain a label sequence containing key penetration testing terms. The large model generating test strategy module 203 performs post-processing on the label sequence to extract key terms from the business documents and calculates the attention weights of the key terms. Based on the attention weights, the large model generating test strategy module 203 selects target key terms from the key terms and structures the attribute information of the target key terms to form structured penetration testing terminology.

[0121] In one possible implementation, the preset reinforcement learning algorithm includes a state awareness layer, an Actor decision layer, a Critic value assessment layer, and a prior knowledge fusion layer. The attack path generation module 204 generates attack paths based on the penetration testing strategy using the preset reinforcement learning algorithm. Specifically, the attack path generation module 204 organizes the real-time state data of the target system through the state awareness layer; inputs the real-time state data, the output data of the prior knowledge fusion layer, and the penetration testing strategy to the Actor decision layer to generate the next attack action; the attack path generation module 204 inputs the next attack action to the Critic value assessment layer to calculate the value assessment score of the next attack action; the attack path generation module 204 feeds back the value assessment score to the Actor decision layer and the prior knowledge fusion layer to optimize the policy network parameters of the preset reinforcement learning algorithm; the attack path generation module 204 adjusts the output of the Actor decision layer according to the policy network parameters and uses the attack action sequence output by the Actor decision layer as the attack path.

[0122] In one possible implementation, the code obfuscation module 205 inputs the original attack code corresponding to the attack path into a preset generative adversarial network (GAN) to generate obfuscated attack code. Specifically, the code obfuscation module 205 uses the original attack code as a conditional input to the preset GAN, which includes a generator and a discriminator. The code obfuscation module 205 uses the generator to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code in combination with random noise to generate transformed attack code. The code obfuscation module 205 uses the discriminator to analyze the characteristics of the transformed attack code and calculates the quality score of the transformed attack code. If the code obfuscation module 205 determines that the quality score is greater than or equal to a preset score threshold, then the transformed attack code is determined to be obfuscated attack code.

[0123] In one possible implementation, the code obfuscation module 205 uses a generator to combine random noise to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code, generating transformed attack code. Specifically, the code obfuscation module 205 concatenates the original attack code and a random noise vector to form the generator's input vector; the code obfuscation module 205 uses the generator's built-in syntax transformation rule library to randomly replace code elements in the original attack code, generating syntax-transformed attack code, where code elements include variable names, function names, and class names; the code obfuscation module 205 uses the generator's built-in semantic obfuscation rule library to insert redundant code fragments into the syntax-transformed attack code, generating semantically obfuscated attack code, where redundant code fragments include invalid instructions, redundant code blocks, and unreachable branches; and the code obfuscation module 205 uses the generator's built-in encoding conversion rule library to perform encoding conversion on the semantically obfuscated attack code using a preset encoding method, forming transformed attack code.

[0124] In one possible implementation, the penetration testing module 206 performs penetration testing on the target system based on the attack path and obfuscated attack code to obtain penetration testing results. Specifically, the penetration testing module 206 controls the attack execution layer to execute various attack actions in a set order according to the attack path; during the execution of each attack action, the penetration testing module 206 calls the corresponding obfuscated attack code to initiate an attack request; after initiating the attack request, it monitors the response status and behavior changes of the target system; if the penetration testing module 206 detects the expected response status or abnormal behavior, it determines that the penetration is successful, outputs a successful penetration status, and records the penetration process log; if the penetration testing module 206 does not detect the expected response status or abnormal behavior, it determines that the penetration has failed, outputs a failed penetration status, and records the penetration process log.

[0125] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0126] This application also provides an electronic device. (See reference...) Figure 3 , Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device 300 may include: at least one processor 301, at least one network interface 304, a user interface 303, a memory 305, and at least one communication bus 302.

[0127] The communication bus 302 is used to enable communication between these components.

[0128] The user interface 303 may include a display screen and a camera. Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0129] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0130] The processor 301 may include one or more processing cores. The processor 301 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 305, and by calling data stored in memory 305. Optionally, the processor 301 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 301 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 301 and may be implemented as a separate chip.

[0131] The memory 305 may include random access memory (RAM) or read-only memory. Optionally, the memory 305 may include a non-transitory computer-readable storage medium. The memory 305 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 305 may also be at least one storage device located remotely from the aforementioned processor 301. (Refer to...) Figure 3 The memory 305, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an application program for a multi-model collaborative penetration testing method.

[0132] exist Figure 3In the illustrated electronic device 300, the user interface 303 is mainly used to provide an input interface for the user and acquire user input data; while the processor 301 can be used to call an application program stored in the memory 305 for a multi-model collaborative penetration testing method. When executed by one or more processors 301, the electronic device 300 performs one or more of the methods described in the above embodiments. It should be noted that, for the foregoing method embodiments, for the sake of simplicity, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0133] This application also provides a computer-readable storage medium storing instructions. When executed by one or more processors 301, these instructions cause an electronic device 300 to perform one or more of the methods described in the above embodiments.

[0134] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0135] In the various embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between apparatuses or units may be electrical or other forms.

[0136] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0137] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0138] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0139] The above description is merely an exemplary embodiment of this disclosure and should not be construed as limiting the scope of this disclosure. Any equivalent changes and modifications made in accordance with the teachings of this disclosure shall still fall within the scope of this disclosure. Other embodiments of this disclosure will be readily apparent to those skilled in the art upon consideration of the specification and the disclosure of practical truths.

[0140] This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not described in this disclosure. The specification and embodiments are to be considered exemplary only, and the scope and spirit of this disclosure are defined by the claims.

Claims

1. A multi-model collaborative penetration testing method, characterized in that, The method includes: Acquire target asset information and external knowledge data of the target system, which is the object to be penetrated and tested; By combining the external knowledge data, the target asset information is analyzed to obtain the corresponding structured penetration data. The target asset information includes port information and service information, and the external knowledge data includes business documents, vulnerability knowledge bases, POC script libraries, and EXP script libraries. Obtain the current state of the target system, input the current state and the structured penetration data into a preset large language model, and generate a penetration testing strategy; Based on the aforementioned penetration testing strategy, an attack path is generated using a preset reinforcement learning algorithm; The original attack code corresponding to the attack path is input into a preset generative adversarial network to generate obfuscated attack code. Based on the attack path and the obfuscated attack code, a penetration test is performed on the target system to obtain the penetration test results. The step of combining the external knowledge data to analyze the target asset information and obtain corresponding structured penetration data specifically includes: The port information and service information are correlated and analyzed, and combined with the vulnerability knowledge base, potential vulnerabilities related to open ports and running services are identified to form a potential vulnerability list of the target system; By employing the same-origin vulnerability association analysis method, the potential vulnerability is compared and classified with the vulnerability knowledge base, POC script library and EXP script library in the external knowledge data to identify the vulnerability family corresponding to the potential vulnerability and obtain the vulnerability family analysis results. Based on the potential vulnerability list and the vulnerability family analysis results, and combined with the external knowledge data, the general vulnerability information and common vulnerability information of the target system are determined, forming a structured general vulnerability list and common vulnerability list; The business document is semantically parsed using a BERT pre-trained language model to extract key elements related to penetration testing and form structured penetration testing terminology. The key elements include the attack subject, prerequisites, attack operations, and expected results. The structured penetration data is obtained by combining the potential vulnerability list, the general vulnerability list, the common vulnerability list, and the penetration testing terminology.

2. The method according to claim 1, characterized in that, The method of vulnerability association analysis using the same source and origin involves comparing and classifying the potential vulnerabilities with the vulnerability knowledge base, POC script library, and EXP script library in the external knowledge data to identify the vulnerability family corresponding to the potential vulnerability and obtain vulnerability family analysis results, specifically including: Extract the feature information of the potential vulnerability, and construct the target vulnerability feature vector based on the feature information; Extract the key features of known vulnerabilities from the vulnerability knowledge base to form a known vulnerability feature vector; Calculate the similarity between the target vulnerability feature vector and the known vulnerability feature vector to obtain a similarity matrix; Based on the similarity matrix, a clustering algorithm is used to cluster the potential vulnerabilities and the known vulnerabilities to obtain multiple clusters, wherein each cluster corresponds to a vulnerability family; Based on the clusters, the vulnerability families corresponding to the potential vulnerabilities are determined; By integrating the POC script library and the EXP script library, the vulnerability family is identified, and the common attack surface and attack chain path of the vulnerability family are obtained, thus obtaining the vulnerability family analysis results.

3. The method according to claim 1, characterized in that, The step involves using a BERT pre-trained language model to perform semantic parsing on the business documents, extracting key elements related to penetration testing, and forming structured penetration testing terminology, specifically including: Based on the vocabulary of the penetration testing field, the vocabulary of the BERT pre-trained language model is expanded to obtain the BERT-BiLSTM-CRF named entity recognition model, which includes a BERT layer, a BiLSTM layer and a CRF layer. The business document is divided into multiple word segmentation units, and each word segmentation unit is input into the BERT layer. The semantic vector corresponding to each word segmentation unit is extracted by the BERT layer to obtain a semantic vector sequence. The semantic vector sequence is input into the BiLSTM layer and the CRF layer. The BiLSTM layer learns the sequence dependency relationship between the word segmentation units, and the CRF layer is used to annotate the word segmentation units to obtain a tag sequence containing key terms for penetration testing. The tag sequence is post-processed to extract key terms from the business document and to calculate the attention weight of the key terms. Based on the attention weight, target key terms are selected from the key terms, and the attribute information of the target key terms is represented in a structured manner to form structured penetration testing terms.

4. The method according to claim 1, characterized in that, The preset reinforcement learning algorithm includes a state awareness layer, an Actor decision layer, a Critic value assessment layer, and a prior knowledge fusion layer. The generation of attack paths based on the penetration testing strategy using the preset reinforcement learning algorithm specifically includes: The real-time status data of the target system is organized through the state awareness layer. The real-time status data, the output data of the prior knowledge fusion layer, and the penetration testing strategy are input into the Actor decision layer to generate the next attack action. The next attack action is input into the Critic value evaluation layer to calculate the value evaluation score of the next attack action. The value assessment score is fed back to the Actor decision layer and the prior knowledge fusion layer to optimize the policy network parameters of the preset reinforcement learning algorithm; The output of the Actor decision layer is adjusted according to the policy network parameters, and the attack action sequence output by the Actor decision layer is used as the attack path.

5. The method according to claim 1, characterized in that, The step of inputting the original attack code corresponding to the attack path into a preset generative adversarial network to generate obfuscated attack code specifically includes: The original attack code is used as a conditional input to the preset generative adversarial network, which includes a generator and a discriminator. The generator combines random noise to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code, generating transformation attack code. The discriminator analyzes the characteristics of the transformation attack code and calculates the quality score of the transformation attack code. If the quality score is determined to be greater than or equal to a preset score threshold, then the transformation attack code is determined to be the obfuscation attack code.

6. The method according to claim 5, characterized in that, The process of generating transformed attack code by combining the generator with random noise to perform syntax transformation, semantic obfuscation, and encoding conversion on the original attack code specifically includes: The original attack code and the random noise vector are concatenated to form the input vector of the generator; The generator uses a built-in syntax transformation rule library to randomly replace code elements in the original attack code to generate syntax-transformed attack code. The code elements include variable names, function names, and class names. The generator uses a built-in semantic obfuscation rule library to insert redundant code fragments into the attack code after syntax transformation, generating semantically obfuscated attack code. The redundant code fragments include invalid instructions, redundant code blocks, and unreachable branches, which are paths that will not be executed. The generator uses a built-in encoding conversion rule library to encode the semantically obfuscated attack code using a preset encoding method, thereby forming the transformed attack code.

7. The method according to claim 1, characterized in that, The penetration test conducted on the target system based on the attack path and the obfuscated attack code, to obtain the penetration test results, specifically includes: Based on the attack path, the attack execution layer is controlled to execute each attack action in a set order; During the execution of each of the aforementioned attack actions, the corresponding obfuscated attack code is invoked to initiate an attack request; After initiating an attack request, monitor the response status and behavioral changes of the target system; If the expected response status or abnormal behavior is detected, the penetration is considered successful, the penetration success status is output, and the penetration process log is recorded. If the expected response or abnormal behavior is not detected, the penetration is deemed to have failed, the penetration failure status is output, and the penetration process log is recorded.

8. A multi-model collaborative penetration testing device, characterized in that, The apparatus is used to perform the method as described in any one of claims 1-7, the apparatus comprising a data acquisition module (201), a penetration testing data extraction module (202), a large model generation testing strategy module (203), an attack path generation module (204), a code obfuscation module (205), and a penetration testing module (206), wherein: The data acquisition module (201) is used to acquire target asset information and external knowledge data of the target system, wherein the target system is the object to be penetrated and tested; The penetration test data extraction module (202) is used to analyze the target asset information by combining the external knowledge data to obtain the corresponding structured penetration data; The large model generating test strategy module (203) is used to obtain the current state of the target system, input the current state and the structured penetration data into a preset large language model, and generate a penetration test strategy. The attack path generation module (204) is used to generate an attack path based on the penetration testing strategy and using a preset reinforcement learning algorithm. The code obfuscation module (205) is used to input the original attack code corresponding to the attack path into a preset generative adversarial network to generate obfuscated attack code; The penetration testing module (206) is used to perform penetration testing on the target system based on the attack path and the obfuscated attack code, and obtain penetration testing results.

9. An electronic device, characterized in that, The device includes a processor (301), a memory (305), a user interface (303), and a network interface (304). The memory (305) is used to store instructions. The user interface (303) and the network interface (304) are used to communicate with other devices. The processor (301) is used to execute the instructions stored in the memory (305) to cause the electronic device (300) to perform the method as described in any one of claims 1-7.

Images