Penetration test attack path planning method, device, electronic device and storage medium

Abstract

The present invention provides a penetration test attack path planning method, which can be applied to the network security field or the financial field, collects node information of nodes in a target network environment layer by layer, determines candidate nodes in the nodes of the current layer that have connectivity, trustworthy relationship and vulnerability exploitation conditions with the node currently obtaining control right according to the node information of the nodes of the current layer, and the candidate nodes are nodes that have not been attacked currently; if there are multiple candidate nodes, quantify the attack and defense parameters of the candidate nodes based on a static game model, select one of the candidate nodes in turn according to the attack and defense parameters to attack, so as to obtain control right of the node, and collect node information of nodes in the target network environment layer by layer again; if there is only one candidate node, select the candidate node to attack, so as to obtain control right of the node, and collect node information of nodes in the target network environment layer by layer again; and generate a penetration test attack path according to the attack order of the nodes in the target network environment.

Description

Technical Field

[0001] The present invention relates to the field of software technology, and more specifically, to a penetration test attack path planning method, device, electronic device and storage medium. Background Art

[0002] While network information technology improves the service efficiency of various industries and provides convenience for daily life, it also faces increasing security threats. The emergence of APT (Advanced Persistent Threat) attacks has made cyberspace security issues more severe. Penetration testing is a security testing and evaluation method that simulates the attack techniques that the attacker may use to explore the vulnerabilities in the network system, thereby obtaining access control rights and discovering network security risks. For target network environments with complex network systems and a large number of target nodes, it is particularly important to use attack path planning technology to determine the attack path with the highest attack success rate and the greatest benefit.

[0003] Existing attack path planning mostly adopts the method of constructing attack graphs, which obtains complete information of the target network by scanning the network environment in advance, and is suitable for penetration testing under the condition that the network environment is fully observable. For the attacker, the target network environment is like a black box, and the attacker cannot fully perceive and analyze the network environment before the penetration test. In addition, the actual penetration test process is often accompanied by a game between the attacker and the defender, that is, while the attacker attacks the network environment, the defender uses its own network system functions and technical means to protect the network and equipment from successful attacks. Summary of the invention

[0004] In view of this, in order to solve the above problems, the present invention provides a penetration test attack path planning method, device, electronic device and storage medium, and the technical solution is as follows:

[0005] A penetration test attack path planning method, the method comprising:

[0006] Collect node information of nodes in the target network environment layer by layer, and determine candidate nodes in the current layer that have connectivity, trustworthiness, and vulnerability exploitation conditions with the node currently controlling the node based on the node information of the current layer. The candidate nodes are nodes that have not been attacked at present.

[0007] If there are multiple candidate nodes, the attack and defense parameters of the candidate nodes are quantified based on a static game model, and one of the candidate nodes is selected in turn according to the attack and defense parameters to attack, so as to gain control of the node, and the step of collecting node information of nodes in the target network environment layer by layer is returned to be executed;

[0008] If there is only one candidate node, the candidate node is selected to attack to obtain control of the node, and the step of collecting node information of nodes in the target network environment layer by layer is returned to be executed;

[0009] Until there are no unattacked nodes in the target network environment, a penetration test attack path is generated according to the attack order of the nodes in the target network environment.

[0010] Preferably, the step of collecting node information of nodes in the target network environment layer by layer includes:

[0011] Using a hierarchical task approach and a depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer.

[0012] Preferably, the quantifying the attack and defense parameters of the candidate nodes based on a static game model includes:

[0013] Based on the general vulnerability scoring system, quantitative parameters of the candidate nodes in four dimensions, namely, the attack success rate of the attacker, the attack benefit of the attacker, the irreparable rate of the defender, and the defense cost of the defender, are extracted respectively;

[0014] The extracted quantization parameters in the four dimensions are processed to obtain the quantization index of the candidate node.

[0015] Preferably, the selecting one of the candidate nodes to attack in turn according to the attack and defense parameters includes:

[0016] A node with the highest quantitative index is selected from the candidate nodes for attack.

[0017] A penetration test attack path planning device, the device comprising:

[0018] A node information collection module is used to collect node information of nodes in the target network environment layer by layer, and determine candidate nodes in the nodes of the current layer that have connectivity, trustworthiness and vulnerability exploitation conditions with the node currently obtaining control, according to the node information of the nodes of the current layer. The candidate nodes are nodes that have not been attacked at present;

[0019] The attack path planning module is used to quantify the attack and defense parameters of the candidate nodes based on a static game model if there are multiple candidate nodes, and select one of the candidate nodes in turn according to the attack and defense parameters to attack in order to gain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; if there is only one candidate node, select the candidate node to attack in order to gain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; until there are no unattacked nodes in the target network environment, a penetration test attack path is generated according to the attack order of the nodes in the target network environment.

[0020] Preferably, the node information collection module for collecting node information of nodes in the target network environment layer by layer is specifically used for:

[0021] Using a hierarchical task approach and a depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer.

[0022] Preferably, the attack path planning module for quantifying the attack and defense parameters of the candidate nodes based on a static game model is specifically used to:

[0023] Based on the universal vulnerability scoring system, quantitative parameters of the candidate node in four dimensions, namely, the attack success rate of the attacker, the attack benefit of the attacker, the irreparable rate of the defender, and the defense cost of the defender, are extracted respectively; the quantitative parameters in the four dimensions are processed to obtain the quantitative index of the candidate node.

[0024] Preferably, the attack path planning module for sequentially selecting one of the candidate nodes to attack according to the attack and defense parameters is specifically used to:

[0025] A node with the highest quantitative index is selected from the candidate nodes for attack.

[0026] An electronic device comprises: at least one memory and at least one processor; the memory stores an application program, the processor calls the application program stored in the memory, and the application program is used to implement the penetration test attack path planning method.

[0027] A storage medium stores computer program code, which implements the penetration test attack path planning method when executed.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] The present invention provides a penetration test attack path planning method, device, electronic device and storage medium, which collect node information of nodes in a target network environment layer by layer, and determine candidate nodes in the nodes of the current layer that have connectivity, trustworthy relationship and vulnerability exploitation conditions with the node that currently obtains control according to the node information of the nodes in the current layer, wherein the candidate nodes are nodes that have not been attacked at present; further, if there are multiple candidate nodes, the attack and defense parameters of the candidate nodes are quantified based on a static game model, and one of the candidate nodes is selected in turn according to the attack and defense parameters to attack in order to obtain control of the node, and the node information of the nodes in the target network environment is collected again layer by layer; of course, if there is only one candidate node, the candidate node is selected to attack in order to obtain control of the node, and the node information of the nodes in the target network environment is collected again layer by layer; finally, the penetration test attack path is generated according to the attack order of the nodes in the target network environment.

[0030] Based on the present invention, it is possible to start from the perspective of the attacker and, under the premise that the target network environment cannot be fully predicted, fully consider the influencing factors of both the attacker and the defender on the attack path planning, select nodes for attack based on the static game model layer by layer, and generate an attack path with the optimal attack strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0032] Figure 1 A method flow chart of a penetration test attack path planning method provided by an embodiment of the present invention;

[0033] Figure 2 A network topology diagram of a target network environment provided by an embodiment of the present invention;

[0034] Figure 3 A schematic diagram of the structure of a penetration test attack path planning device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0037] Attack path planning for automated penetration testing belongs to the research field of cyberspace security, which aims to discover the action sequence from the attack entry to the target node in the target network environment. Traditional attack path discovery mainly relies on the testing experience of information security personnel. After obtaining information about the target network, they select the appropriate attack payload to form the corresponding attack path. This process requires a lot of manpower and time costs. The existing intelligent path planning method is mainly based on attack graph path discovery. The attack graph provides a visual solution to represent the attack process. The main purpose is to help the defender analyze the network security status and more efficiently prevent the attacker from exploiting network vulnerabilities to attack.

[0038] Existing technologies mainly serve the defender in network security protection. The defender (network administrator) can obtain complete information about the network environment:

[0039] (1) Existing attack path planning mostly adopts the method of constructing an attack graph, which obtains complete information of the target network by scanning the network environment in advance, and is suitable for penetration testing under the condition that the network environment is fully observable. For the attacker, the target network environment is like a black box. The attacker cannot fully perceive and analyze the network environment before the penetration test, and cannot plan the attack path by first constructing an attack graph and then determining the attack path;

[0040] (2) In the actual penetration test process, there is often a game between the attacker and the defender. That is, while the attacker is attacking the network environment, the defender uses its own network system functions and technical means to protect its own network and equipment from successful attacks. The existing technical solutions do not consider the impact of the actions of the attacker and the defender on the attack path planning at the same time.

[0041] To solve the above problems, the present invention starts from the perspective of the attacker, is close to the real attack scenario, and under the condition of limited perception of the network environment, considers the influencing factors of both the attacker and the defender on the attack path planning, and proposes a penetration test attack path planning method based on the static game model.

[0042] The present invention is applicable to black box penetration test scenarios, that is, the attacker cannot fully perceive and analyze the network environment before the penetration test. In the actual penetration test process, it is often accompanied by a game between the attacker and the defender, and the target network environment is similar to a black box. The attacker cannot fully perceive and analyze the network environment before the penetration test. The penetration test attack path planning method based on the static game model in the present invention is closer to the real attack scenario, and can consider the influencing factors of the attacker and the defender on the attack path planning while having limited perception of the network environment, thereby selecting the optimal attack strategy and attack path. The present invention is also of great significance for improving the degree of automation of penetration testing.

[0043] See also Figure 1 , Figure 1 A method flow chart of a penetration test attack path planning method provided by an embodiment of the present invention, the penetration test attack path planning method comprises the following steps:

[0044] S10, collecting node information of nodes in the target network environment layer by layer, and determining candidate nodes in this layer that have connectivity, trust relationship and vulnerability exploitation conditions with the node currently gaining control based on the node information of this layer nodes, and the candidate nodes are nodes that have not been attacked at present.

[0045] In an embodiment of the present invention, the target network environment, i.e., the network environment for penetration test path planning, can collect node information of nodes in the target network environment layer by layer in a hierarchical task manner. Specifically, the node layer belonging to the next layer is collected based on the node that currently obtains control, and the nodes in the node layer are the nodes of the current layer that are currently collected.

[0046] The node information collected for the nodes of this layer includes but is not limited to the node IP, port, operating system, script type, database type, etc. Based on the node information, the vulnerabilities of the nodes of this layer can be detected, and the connectivity and trust relationship between the nodes of this layer and the nodes that currently have control rights can be further considered. The nodes that have connectivity, trust relationship and vulnerability exploitation conditions with the nodes that currently have control rights can be determined from the nodes of this layer, and the determined nodes can be used as candidate nodes.

[0047] It should be noted that the candidate nodes are nodes that have not been attacked at present. That is to say, if a node in this layer has been attacked, even if the control of the node is not obtained, the node will not be used as a candidate node.

[0048] It should also be noted that the collection of node information and vulnerability detection are important steps in the penetration test process. Based on the collected node information, targeted methods can be used to detect vulnerabilities. For example, if the node information is collected and port 22 is opened, weak password blasting can be used to exploit the next vulnerability. For example, if the database type used by the node is MySQL, MySQL-related CVE and tools can be used to detect vulnerabilities.

[0049] It should also be noted that connectivity means that there is network connectivity between two nodes (i.e., two hosts), that is, whether the node with a specified address is reachable can be tested through tools such as ping; a trusted relationship means that there is a trust relationship between two nodes, for example, one node can log in to another node through ssh without a password; the prerequisites for vulnerability exploitation refer to some requirements that need to be met for a successful node attack, including but not limited to the ability to reach an open port of the candidate node from the node that has gained control and the need to run a service that can be exploited on the host.

[0050] See also Figure 2 , Figure 2 The network topology diagram of the target network environment provided by the embodiment of the present invention assumes that the nodes connected by the arrows meet the prerequisites of connectivity between hosts, trusted relationships between hosts, and vulnerability exploitation conditions. The attacker determines the node layer where node 1 (node ​​1 is the entry node) is located through the Internet and the firewall as the first-layer task, and then collects the node information of node 1, and uses the node information of node 1 to detect the vulnerability of node 1, and then uses the vulnerability to attack node 1. After obtaining the control of node 1 (that is, the node currently obtaining the control is node 1), the node layer where nodes 2, node 3 and node 4 are located is determined as the second-layer task, and then the node information of nodes 2, node 3 and node 4 is collected, and the node information of nodes 2, node 3 and node 4 is used to detect the vulnerabilities of nodes 2, node 3 and node 4 respectively. In addition, it is necessary to determine the connectivity and trusted relationship between node 2 and node 1, between node 3 and node 1, and between node 4 and node 1, so as to select candidate nodes with connectivity, trusted relationship and vulnerability exploitation conditions with node 1 from nodes 2, node 3 and node 4.

[0051] In the specific implementation process, the "collecting node information of nodes in the target network environment layer by layer" in step S10 can be performed using the following steps:

[0052] Using a hierarchical task approach and a depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer.

[0053] Since the attacker cannot perceive all the node information of the target network environment before the penetration test, the embodiment of the present invention adopts a layered task method, combined with the idea of ​​depth-first search algorithm, to obtain the relevant information of the node layer by layer. In a network system, the deeper the node and the closer it is to the intranet, the more core it is. Therefore, the present invention adopts a depth-first search algorithm to perform a cyclic search, that is, to give priority to collecting the node information of the node layer below the node that currently obtains control. If the node that currently obtains control does not have a lower layer, it will fall back to the node layer where the node that currently obtains control is located to continue selecting candidate nodes.

[0054] S20, if there are multiple candidate nodes, the attack and defense parameters of the candidate nodes are quantified based on the static game model, and one of the candidate nodes is selected in turn according to the attack and defense parameters to attack in order to gain control of the node, and the step of collecting node information of the nodes in the target network environment layer by layer is returned to be executed.

[0055] In an embodiment of the present invention, when there are multiple candidate nodes, the attack and defense parameters of each candidate node can be quantified based on a static game model, and then one of the candidate nodes is selected in turn to attack according to the attack and defense parameters, in order to gain control of the node.

[0056] It should be noted that the static in the static game model means that the strategy selection and benefits of the attacker and defender remain unchanged; the attack and defense parameters are used to characterize the factors affecting the attack path planning by the attacker and defender.

[0057] In the specific implementation process, the "quantifying the attack and defense parameters of the candidate nodes based on the static game model" in step S20 can be performed using the following steps:

[0058] Based on the general vulnerability scoring system, quantitative parameters of candidate nodes in four dimensions, namely, the attacker's attack success rate, the attacker's attack benefit, the defender's irreparable rate, and the defender's defense cost, are extracted respectively; the quantitative parameters in the four dimensions are processed to obtain the quantitative indicators of the candidate nodes.

[0059] In the embodiment of the present invention, the node most likely to be successfully attacked among the candidate nodes can be quantified from four dimensions: the attack success rate of the attacker, the attack benefit of the attacker, the irreparable rate of the defender, and the defense cost of the defender.

[0060] The attack success rate of the attacker is used to measure the possibility of the attacker's successful attack; the attack benefit of the attacker is used to evaluate the benefit obtained by the attacker after the attack; the unrepair rate of the defender is used to reflect the possibility of the vulnerability being successfully repaired by the defender; the defense cost of the defender is used to evaluate the cost incurred by the defender after taking defensive actions, such as occupying the limited physical resources of the system. The quantification method of the four parameters extracts the relevant values ​​of the Common Vulnerability Scoring System (CVSS) and combines it with actual exploitability.

[0061] The following is an explanation of the quantitative parameters of the candidate nodes in four dimensions: the attacker's attack success rate, the attacker's attack revenue, the defender's irreparable rate, and the defender's defense cost:

[0062] 1) The quantitative parameter of the attacker's attack success rate S can be calculated according to the following formula (1):

[0063] S=AV*AC*UI*EC*OS (1)

[0064] Among them, AV represents the score of the attack vector in the CVSS system, which describes the environment required for vulnerability exploitation; AC represents the score of the attack complexity in the CVSS system, which describes the conditions required for the attacker to successfully exploit the vulnerability; UI represents the score of user interaction in the CVSS system, which describes the degree of interaction required by other users during the attack; OS represents the operating system type of the node, which reflects the environmental factors of the node host; EC represents the exploitability of the vulnerability code. Since the exploitability of the vulnerability code increases with the increase in the length of time the vulnerability is disclosed and obeys the Pareto distribution, EC can be calculated according to the following formula (2):

[0065] EC=1-(k / x)α, k=0.00161, α=0.26 (2)

[0066] Here, x represents the total number of days from the assessment date to the vulnerability disclosure date.

[0067] As shown in the following table (1), table (1) shows the scoring values ​​of various parameters that constitute the attack success rate of the attacker.

[0068] Table (1)

[0069] parameter Optional parameter values Parameter score value AV Network / Neighborhood / Local / Physical 0.85 / 0.62 / 0.55 / 0.2 AC Low / High 0.77 / 0.44 UI Not needed / Needed 0.85 / 0.62 EC See formula (2) OS Windows / Linux 0.85 / 0.75

[0070] 2) The quantitative parameter of the attacker's attack profit index P can be calculated according to the following formula (3):

[0071] P=a*(1-(1-C)*(1-I)*(1-A))+R, a=10.41 (3)

[0072] Among them, C, I and A represent the scores of confidentiality, integrity and availability in the CVSS system, respectively, describing the impact on asset confidentiality, integrity and availability after the attack; R represents the privilege escalation index, reflecting the privilege escalation of the attacker before and after the attack on the node, which can be calculated according to the following formula (4):

[0073] R=R post -R pre (4)

[0074] Among them, R pre Indicates the permissions before the vulnerability is exploited, R post Indicates the permissions after a successful exploit.

[0075] As shown in the following table (2), table (2) shows the score values ​​of each parameter that constitutes the attack benefit index.

[0076] Table (2)

[0077]

[0078]

[0079] 3) The quantitative parameter of the defender's irreparable rate U can be calculated according to the following formula (5):

[0080] U=1-RL (5)

[0081] Among them, RL represents the exploitability of the patch. Similar to EC, the RL value changes dynamically with the number of days since the vulnerability was disclosed. According to the references, this value conforms to the Weibull distribution and can be calculated according to the following formula (6):

[0082] RL=1-exp(-x / λ) k ,λ=0.209,k=4.04 (6)

[0083] 4) The quantitative parameters under the dimension of the defender's defense cost D can be divided according to the defense actions, as shown in the following table (3). Table (3) contains some examples:

[0084] Table (3)

[0085] Defensive moves Defense costs Disable the RDP service on Windows 20 Update Exchange to the latest version 90 Set a complex password 20 Restricting ordinary users from using system calls 40 Repair network services 60 Disable SMB service 20 Repair SMB service 60 Repair RDP service 60 Disable external connections 20 Installing Patches on SQL Server 40

[0086] Based on the quantitative parameters of the candidate nodes in the four dimensions of the attacker's attack success rate, the attacker's attack benefit, the defender's irreparable rate, and the defender's defense cost, the quantitative indicators of the candidate nodes can be calculated according to the following formula (7):

[0087] G=S*P*U*D (7)

[0088] Therefore, when selecting one of the candidate nodes for attack according to the attack and defense parameters, the node with the highest quantitative index can be selected from the candidate nodes for attack. In other words, for multiple candidate nodes in the same layer in the target network environment, their quantitative indexes G are calculated respectively, and the node with the highest G value is preferentially selected for attack.

[0089] For ease of understanding, see Figure 2 , assuming that nodes 2, 3, and 4 are all candidate nodes that have connectivity, trustworthiness, and vulnerability exploitation conditions with node 1, that is, the candidate nodes include nodes 2, 3, and 4. At this time, the quantitative indicators of nodes 2, 3, and 4 can be calculated based on the above steps, that is, the G value of node 2 (i.e. Figure 2 G in 节点2 ), the G value of node 3 (i.e. Figure 2 G in 节点3 ), the G value of node 4 (i.e. Figure 2 G in 节点4 ), continue to assume that G 节点4 >G 节点3 >G 节点2 , then node 4 with the highest G value is selected as the attacker's next attack node, and node 4 is attacked. After obtaining control of node 4, node 4 is the node that currently obtains control. According to the depth-first search algorithm, since the lower-layer nodes of node 4 are not searched, and there are unattacked nodes in the layer where node 4 is located, the second layer is returned to select node 3 with the highest G value as the attacker's next attack node, and node 3 is attacked. By analogy, the final penetration test attack path of the target network environment is "node 1→node 4→node 3→node 5→node 6→node 7→node 2".

[0090] It should be noted that if the node that currently obtains control has no lower-level nodes and there are no unattacked nodes in its layer, it will fall back to the node layer where there are still unattacked nodes, and continue to select the node with the highest G value in this layer as the next attack node of the attacker.

[0091] S30, if there is only one candidate node, then the candidate node is selected for attack to gain control of the node, and the step of collecting node information of nodes in the target network environment layer by layer is returned to be executed.

[0092] Continue to see Figure 2, assuming that the node currently taking control is node 4, and node 5 has connectivity, a trusted relationship, and a candidate node with vulnerability exploitation conditions with node 4, node 5 is used as a candidate node. In the case where there is only one candidate node, node 5 can be used as the next attack node of the attacker to attack node 5. After taking control of node 5, node 5 is the node currently taking control, and the process returns to step S10 to continue searching for the next layer of nodes.

[0093] S40, until there is no unattacked node in the target network environment, generate a penetration test attack path according to the attack order of the nodes in the target network environment.

[0094] In an embodiment of the present invention, the nodes in each node layer in the target network environment are attacked cyclically according to the above-mentioned steps S20 and S30 until there are no unattacked nodes in the target network environment, that is, all nodes in the target network environment have been attacked, which indicates that the penetration test has been completed, and the final penetration test attack path can be generated according to the attack order of the nodes.

[0095] The penetration test attack path planning method provided by the present invention selects attack nodes from the perspective of the attacker, under the premise that the target network environment cannot be fully predicted, using a hierarchical task method and a depth-first search algorithm. For the node that has currently obtained control, if there are multiple candidate nodes that meet the connectivity, trust relationship and vulnerability exploitation conditions, a static game model is provided to quantify the attacker's attack success rate, the attacker's attack revenue, the defender's irreparable rate and the defender's defense cost, while considering the factors affecting the attack path planning by both the attacker and the defender, so as to select the optimal attack strategy and attack path.

[0096] Based on the penetration test attack path planning method provided in the above embodiment, an embodiment of the present invention provides a device for executing the penetration test attack path planning method. The structural diagram of the device is shown in FIG. Figure 3 As shown, including:

[0097] The node information collection module 10 is used to collect node information of nodes in the target network environment layer by layer, and determine candidate nodes in the nodes of the current layer that have connectivity, trust relationship and vulnerability exploitation conditions with the node currently obtaining control, according to the node information of the nodes of the current layer, and the candidate nodes are nodes that have not been attacked at present;

[0098] The attack path planning module 20 is used to quantify the attack and defense parameters of the candidate nodes based on the static game model if there are multiple candidate nodes, and select one of the candidate nodes in turn according to the attack and defense parameters to attack in order to gain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; if there is only one candidate node, select the candidate node to attack in order to gain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; until there are no unattacked nodes in the target network environment, a penetration test attack path is generated according to the attack order of the nodes in the target network environment.

[0099] Optionally, the node information collection module 10 for collecting node information of nodes in the target network environment layer by layer is specifically used for:

[0100] Using a hierarchical task approach and a depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer.

[0101] Optionally, the attack path planning module 20 for quantifying the attack and defense parameters of the candidate nodes based on the static game model is specifically used for:

[0102] Based on the general vulnerability scoring system, quantitative parameters of candidate nodes in four dimensions, namely, the attacker's attack success rate, the attacker's attack benefit, the defender's irreparable rate, and the defender's defense cost, are extracted respectively; the quantitative parameters in the four dimensions are processed to obtain the quantitative indicators of the candidate nodes.

[0103] Optionally, the attack path planning module 20 for sequentially selecting one of the candidate nodes to attack according to the attack and defense parameters is specifically used to:

[0104] Select the node with the highest quantitative index from the candidate nodes to attack.

[0105] It should be noted that the detailed functions of each module in the embodiment of the present invention can be found in the corresponding public part of the above-mentioned penetration test attack path planning method embodiment, which will not be repeated here.

[0106] Based on the penetration test attack path planning method provided in the above embodiment, an embodiment of the present invention also provides an electronic device, the electronic device includes: at least one memory and at least one processor; the memory stores an application, the processor calls the application stored in the memory, and the application is used to implement the penetration test attack path planning method.

[0107] Based on the penetration test attack path planning method provided in the above embodiment, an embodiment of the present invention further provides a storage medium, which stores computer program code, and the penetration test attack path planning method is implemented when the computer program code is executed.

[0108] It should be noted that the penetration test attack path planning method, device, electronic device and storage medium provided by the present invention can be used in the field of network security, chip field, virtual reality field or financial field. The above is only an example and does not limit the application field of the penetration test attack path planning method, device, electronic device and storage medium provided by the present invention.

[0109] The above is a detailed introduction to a penetration test attack path planning method, device, electronic device and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0110] It should be noted that each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0111] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device that includes a series of elements is inherent to the elements, or also includes elements inherent to these processes, methods, articles or devices. In the absence of further restrictions, the elements defined by the sentence "including a..." do not exclude the presence of other identical elements in the process, method, article or device that includes the elements.

[0112] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A penetration test attack path planning method, characterized in that: The method comprises: Collect node information of nodes in the target network environment layer by layer, and determine candidate nodes in the current layer that have connectivity, trustworthiness, and vulnerability exploitation conditions with the node currently controlling the node based on the node information of the current layer. The candidate nodes are nodes that have not been attacked at present. If there are multiple candidate nodes, the attack and defense parameters of the candidate nodes are quantified based on a static game model, and one of the candidate nodes is selected in turn according to the attack and defense parameters to attack, so as to gain control of the node, and the step of collecting node information of nodes in the target network environment layer by layer is returned to be executed; If there is only one candidate node, the candidate node is selected to attack to obtain control of the node, and the step of collecting node information of nodes in the target network environment layer by layer is returned to be executed; Until there are no unattacked nodes in the target network environment, generating a penetration test attack path according to the attack order of the nodes in the target network environment; The step of collecting node information of nodes in the target network environment layer by layer includes: Adopting the hierarchical task approach and depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer; Wherein, the quantification of the attack and defense parameters of the candidate nodes based on the static game model includes: Based on the general vulnerability scoring system, quantitative parameters of the candidate nodes in four dimensions, namely, the attack success rate of the attacker, the attack benefit of the attacker, the irreparable rate of the defender, and the defense cost of the defender, are extracted respectively; The extracted quantization parameters in the four dimensions are processed to obtain the quantization index of the candidate node.

2. The method according to claim 1, characterized in that The step of sequentially selecting one of the candidate nodes to attack according to the attack and defense parameters includes: A node with the highest quantitative index is selected from the candidate nodes in turn for attack.

3. A penetration test attack path planning device, characterized in that: The device comprises: A node information collection module is used to collect node information of nodes in the target network environment layer by layer, and determine candidate nodes in the nodes of the current layer that have connectivity, trustworthiness and vulnerability exploitation conditions with the node currently obtaining control, according to the node information of the nodes of the current layer. The candidate nodes are nodes that have not been attacked at present; An attack path planning module is used to quantify the attack and defense parameters of the candidate nodes based on a static game model if there are multiple candidate nodes, and select one of the candidate nodes to attack in turn according to the attack and defense parameters to obtain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; if there is only one candidate node, select the candidate node to attack to obtain control of the node, and return to execute the step of collecting node information of nodes in the target network environment layer by layer; until there are no unattacked nodes in the target network environment, generate a penetration test attack path according to the attack order of the nodes in the target network environment; The node information collection module for collecting node information of nodes in the target network environment layer by layer is specifically used for: Adopting the hierarchical task approach and depth-first search algorithm, node information of nodes in the target network environment is collected layer by layer; The attack path planning module for quantifying the attack and defense parameters of the candidate nodes based on a static game model is specifically used to: Based on the general vulnerability scoring system, quantitative parameters of the candidate node in four dimensions, namely, the attack success rate of the attacker, the attack benefit of the attacker, the irreparable rate of the defender, and the defense cost of the defender, are extracted respectively; the quantitative parameters in the four dimensions are processed to obtain the quantitative index of the candidate node.

4. The device according to claim 3, characterized in that The attack path planning module is used to select one of the candidate nodes to attack in turn according to the attack and defense parameters, and is specifically used to: A node with the highest quantitative index is selected from the candidate nodes in turn for attack.

5. An electronic device, characterized in that: The electronic device includes: at least one memory and at least one processor; the memory stores an application, the processor calls the application stored in the memory, and the application is used to implement the penetration test attack path planning method described in any one of claims 1-2.

6. A storage medium, characterized in that: The storage medium stores computer program code, and when the computer program code is executed, the penetration test attack path planning method according to any one of claims 1-2 is implemented.

Images