Penetration testing methods, apparatus, equipment and media

Abstract

This application discloses a penetration testing method, apparatus, device, and medium. The method includes: performing network mapping processing on a target object to obtain first network asset data and first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; determining unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data, and an attack prediction model; generating a target attack graph of the target object based on the first network asset data, the first vulnerability data, and the unknown vulnerability data; inputting the target attack graph into a trained deep learning engine to obtain the optimal attack path of the target attack graph; and performing automated penetration testing on the target object based on the optimal attack path of the target attack graph. According to the embodiments of this application, the limitations of penetration testing schemes can be reduced and the penetration testing effect can be improved.

Description

Technical Field

[0001] This application belongs to the field of cybersecurity technology, and in particular relates to a penetration testing method, apparatus, equipment and medium. Background Technology

[0002] Currently, enterprises across various industries are increasingly emphasizing cybersecurity vulnerability discovery and penetration testing to prevent potential threats. However, due to the learning curve of attack techniques, time costs, and relatively high personnel requirements, penetration testing service personnel have long been in short supply, resulting in a significant supply-demand imbalance. Artificial intelligence-enabled cybersecurity penetration testing technology can, to some extent, lower the professional technical threshold, transforming primarily manual penetration testing into automated or semi-automated operations.

[0003] In related technologies, traditional automated penetration testing solutions obtain known vulnerability information from public channels and then plan penetration paths based on this information. However, they cannot identify unknown vulnerabilities and therefore cannot plan penetration paths for them. This results in significant limitations and poor penetration testing effectiveness. Summary of the Invention

[0004] The purpose of this application is to provide a penetration testing method and apparatus that can reduce the limitations of penetration testing schemes and improve penetration testing results.

[0005] In a first aspect, embodiments of this application provide a penetration testing method, which includes: performing network mapping processing on a target object to obtain first network asset data and first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; determining unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data, and an attack prediction model; generating a target attack graph of the target object based on the first network asset data, the first vulnerability data, and the unknown vulnerability data; inputting the target attack graph into a trained deep learning engine to obtain the optimal attack path of the target attack graph; and performing automated penetration testing on the target object based on the optimal attack path of the target attack graph.

[0006] In some possible implementations of the first aspect, the unknown vulnerability data of the target object is determined based on the first network asset data, the first vulnerability data, and the attack prediction model. This includes: constructing a network security knowledge graph and a set of relationship paths based on the first network asset data and the first vulnerability data; obtaining historical attack data from the first network asset data; constructing attack sample data based on the historical attack data; inputting the network security knowledge graph, the set of relationship paths, and the attack sample data into the attack prediction model to obtain a set of attack paths output by the attack prediction model, wherein the set of attack paths includes multiple unknown vulnerability attack paths; and using fuzz testing technology to perform vulnerability mining on the target network asset data in the first network asset data to obtain the unknown vulnerability data of the target object. The first network asset data includes the asset data of each network node corresponding to the target object, the network nodes covered by the multiple unknown vulnerability attack paths are the target network nodes, and the target network asset data is the asset data of the target network nodes.

[0007] In some possible implementations of the first aspect, before determining the unknown vulnerability data of the target object, the method further includes: constructing a first classifier and a second classifier, wherein the first classifier is used to determine whether an attack has occurred, and the second classifier is used to determine whether the attack is a 0-day vulnerability attack if an attack has occurred; and generating an attack prediction model based on the first classifier and the second classifier.

[0008] In some possible implementations of the first aspect, inputting a target attack graph into a trained deep learning engine to obtain the optimal attack path of the target attack graph includes: inputting the target attack graph into the trained deep learning engine so that the deep learning engine assigns a first score to all network nodes within the target attack graph, and determines a second score for multiple target attack paths corresponding to the target attack graph based on the first scores of all network nodes, and outputs the target attack path with the highest second score as the optimal attack path of the target attack graph; wherein, the first score is used to characterize the vulnerability exploitability of network nodes, and the second score is determined based on the first scores of network nodes covered by the target attack path.

[0009] In some possible implementations of the first aspect, before inputting the target attack graph into the trained deep learning engine, the method further includes: constructing multiple experimental topologies based on the traffic sample data obtained; scanning the multiple experimental topologies to obtain scan data for each experimental topology; converting the scan data for each experimental topology into sample attack graphs to obtain multiple sample attack graphs; using the multiple sample attack graphs as input data and the optimal attack path of the sample attack graphs as output data to train the deep learning engine to obtain a trained deep learning engine.

[0010] In some possible implementations of the first aspect, multiple experimental topologies are constructed based on traffic sample data, including: extracting key feature data from the traffic sample data; obtaining second network asset data based on the key feature data; and constructing experimental topologies based on the second network asset data and pre-set known vulnerability data.

[0011] In some possible implementations of the first aspect, after determining the unknown vulnerability data of the target object, the method further includes: writing the unknown vulnerability data and its exploitation methods into a vulnerability database and a penetration testing tool database, respectively, wherein the penetration testing tool is used to perform penetration testing on the target object.

[0012] Secondly, embodiments of this application provide a penetration testing apparatus, comprising: a mapping processing module for performing network mapping processing on a target object to obtain first network asset data and first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; a determination module for determining unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data, and an attack prediction model; a generation module for generating a target attack graph of the target object based on the first network asset data, the first vulnerability data, and the unknown vulnerability data; an input module for inputting the target attack graph into a trained deep learning engine to obtain the optimal attack path of the target attack graph; and a testing module for performing automated penetration testing on the target object based on the optimal attack path of the target attack graph.

[0013] In some possible implementations of the second aspect, the determining module includes: a construction unit for constructing a network security knowledge graph and a set of relationship paths based on the first network asset data and the first vulnerability data; an acquisition unit for acquiring historical attack data from the first network asset data; the construction unit is also used to construct attack sample data based on the historical attack data; an input unit for inputting the network security knowledge graph, the set of relationship paths, and the attack sample data into the attack prediction model to obtain a set of attack paths output by the attack prediction model, the set of attack paths including multiple unknown vulnerability attack paths; and a vulnerability mining unit for using fuzz testing technology to perform vulnerability mining on the target network asset data in the first network asset data to obtain unknown vulnerability data of the target object; wherein, the first network asset data includes asset data of each network node corresponding to the target object, the network nodes covered by multiple unknown vulnerability attack paths are target network nodes, and the target network asset data are asset data of the target network nodes.

[0014] In some possible implementations of the second aspect, the apparatus further includes: a construction module for constructing a first classifier and a second classifier before determining unknown vulnerability data of the target object, wherein the first classifier is used to determine whether an attack has occurred, and the second classifier is used to determine whether the attack is a 0-day vulnerability attack if an attack has occurred; and a generation module for generating an attack prediction model based on the first classifier and the second classifier.

[0015] In some possible implementations of the second aspect, the input module is specifically used to: input the target attack graph into the trained deep learning engine, so that the deep learning engine assigns a first score to all network nodes in the target attack graph, and determines the second scores of multiple target attack paths corresponding to the target attack graph based on the first scores of all network nodes, and outputs the target attack path with the highest second score as the optimal attack path of the target attack graph; wherein, the first score is used to characterize the vulnerability exploitability of the network nodes, and the second score is determined based on the first scores of the network nodes covered by the target attack path.

[0016] In some possible implementations of the second aspect, the apparatus further includes: a construction module for constructing multiple experimental topologies based on traffic sample data, provided that traffic sample data has been acquired, before inputting the target attack graph into the trained deep learning engine; a scanning module for scanning the multiple experimental topologies to obtain scan data for each experimental topology; a conversion module for converting the scan data of each experimental topology into sample attack graphs to obtain multiple sample attack graphs; and a training module for training the deep learning engine using the multiple sample attack graphs as input data and the optimal attack path of the sample attack graphs as output data to obtain a trained deep learning engine.

[0017] In some possible implementations of the second aspect, the construction module includes: an extraction unit for extracting key feature data from traffic sample data; an acquisition unit for acquiring second network asset data based on the key feature data; and a construction unit for constructing an experimental topology environment based on the second network asset data and preset known vulnerability data.

[0018] In some possible implementations of the second aspect, the device further includes: a writing module, used to write the unknown vulnerability data and its exploitation method into a vulnerability database and a penetration testing tool database respectively after determining the unknown vulnerability data of the target object, wherein the penetration testing tool is used to perform penetration testing on the target object.

[0019] Thirdly, embodiments of this application provide an electronic device, including: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the steps of the penetration testing method as described in the first aspect.

[0020] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the steps of the penetration testing method as described in the first aspect.

[0021] Fifthly, embodiments of this application provide a computer program product stored in a non-volatile storage medium, which is executed by at least one processor to implement the steps of the penetration testing method as described in the first aspect.

[0022] In a sixth aspect, embodiments of this application provide a chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the steps of the penetration testing method as described in the first aspect.

[0023] This application provides a penetration testing method, apparatus, device, and medium. The target object is the penetration testing target. In a scenario where penetration testing is performed on the target object, network mapping is first performed on the target object to obtain first network asset data and known first vulnerability data. Based on this, and using the first network asset data, first vulnerability data, and an attack prediction model, unknown vulnerability data existing in the target object can be determined. Based on this, combining the first network asset data, first vulnerability data, and unknown vulnerability data, a target attack graph of the target object can be generated. By inputting the target attack graph into a trained deep learning engine, the optimal attack path of the target attack graph can be obtained. This application can comprehensively probe the target object through an attack prediction model to obtain data on possible unknown vulnerabilities in the target object, overcoming the limitation of traditional solutions that can only obtain known vulnerability information through public channels. Furthermore, after accurately obtaining the network asset data, known vulnerability data, and unknown vulnerability data required for this penetration test, a target attack map with a broad vulnerability coverage can be generated by combining these three types of data. Through this target attack map, the optimal attack path can be searched within the range of known vulnerabilities and the range of unknown vulnerabilities. This optimal attack path is the penetration path for the target object. Therefore, penetration path planning for known and unknown vulnerabilities can be realized, which improves the limitation of traditional solutions that can only search for the optimal attack path within the range of known vulnerabilities, enhances the comprehensiveness of penetration testing on the target object, and thus improves the penetration testing effect. Attached Figure Description

[0024] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below.

[0025] Figure 1 This is a schematic flowchart of a penetration testing method provided in an embodiment of this application;

[0026] Figure 2 This is a schematic flowchart of a penetration testing method provided in another embodiment of this application;

[0027] Figure 3 This is a schematic flowchart of a penetration testing method provided in another embodiment of this application;

[0028] Figure 4 This is a schematic diagram of the structure of a penetration testing device provided in an embodiment of this application;

[0029] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0031] Currently, enterprises across various industries are increasingly emphasizing cybersecurity vulnerability discovery and penetration testing to prevent potential threats. However, due to the learning curve of attack techniques, time costs, and relatively high personnel requirements, penetration testing service personnel have long been in short supply, resulting in a significant supply-demand imbalance. Artificial intelligence-enabled cybersecurity penetration testing technology can, to some extent, lower the professional technical threshold, transforming primarily manual penetration testing into automated or semi-automated operations.

[0032] In related technologies, traditional automated penetration testing solutions typically obtain known vulnerability information from publicly available sources and then plan penetration paths based on this information. However, they cannot identify unknown vulnerabilities and therefore cannot plan penetration paths for them. This results in significant limitations and poor penetration testing effectiveness. For example, traditional automated penetration testing solutions will not be effective against uncertain penetration targets and defenses such as mimicry defenses and honeypots.

[0033] To address the issues in related technologies, this application provides a penetration testing method that effectively reduces transaction risks, enhances user transaction security, and thus improves the problem that online sales in related technologies are highly risky and cannot effectively reduce transaction risks for users.

[0034] The penetration testing method provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0035] Figure 1 This is a schematic flowchart of a penetration testing method provided in an embodiment of this application. The subject executing the penetration testing method can be an electronic device.

[0036] The electronic device may be a mobile phone, tablet computer, smart wearable device, edge device, cloud service device, server or server cluster, etc., and this application does not specifically limit it.

[0037] The penetration testing method of this application is illustrated below using electronic devices as the subject of the penetration testing method. It should be noted that the aforementioned subject and application scenario do not constitute a limitation on this application.

[0038] like Figure 1 As shown, the penetration testing method provided in this application embodiment may include steps 110-150.

[0039] Step 110: Perform network mapping on the target object to obtain the target object's first network asset data and first vulnerability data.

[0040] The target object is the penetration test object, and the first vulnerability data is known vulnerability data.

[0041] Step 120: Based on the first network asset data, the first vulnerability data, and the attack prediction model, determine the unknown vulnerability data of the target object.

[0042] Step 130: Based on the first network asset data, the first vulnerability data, and the unknown vulnerability data, generate a target attack graph of the target object.

[0043] Step 140: Input the target attack graph into the trained deep learning engine to obtain the optimal attack path of the target attack graph.

[0044] Step 150: Based on the optimal attack path of the target attack graph, perform automated penetration testing on the target object.

[0045] The penetration testing method provided in this application, in a scenario of penetration testing a target object, first performs network mapping processing on the target object to obtain the target object's first network asset data and known first vulnerability data. Based on this, and using the first network asset data, the first vulnerability data, and an attack prediction model, unknown vulnerability data existing in the target object can be determined. Based on this, combining the first network asset data, the first vulnerability data, and the unknown vulnerability data, a target attack graph of the target object can be generated. By inputting the target attack graph into a trained deep learning engine, the optimal attack path of the target attack graph can be obtained. This application can comprehensively probe the target object through an attack prediction model to obtain potential unknown vulnerability data, overcoming the limitation of traditional solutions that can only obtain known vulnerability information through public channels. Furthermore, after accurately acquiring the network asset data, known vulnerability data, and unknown vulnerability data required for this penetration test, a target attack map with broad vulnerability coverage can be generated by combining these three types of data. This target attack map allows for the search for optimal attack paths within both known and unknown vulnerability ranges. This optimal attack path is the penetration path for the target object, thus enabling penetration path planning for both known and unknown vulnerabilities. This overcomes the limitations of traditional solutions that can only search for optimal attack paths within known vulnerability ranges, improving the comprehensiveness of penetration testing and consequently enhancing the effectiveness of the penetration test. Simultaneously, this application eliminates the need for traversal vulnerability attempts, significantly reducing time costs and avoiding numerous imprecise vulnerability attack attempts, thereby improving the stealth and accuracy of the penetration test operation.

[0046] The specific implementation of the above steps will be described in detail below with reference to specific embodiments.

[0047] Step 110 involves performing network mapping on the target object to obtain the target object's first network asset data and first vulnerability data.

[0048] The target object is the operating environment, such as the device under test or the system under test.

[0049] In some embodiments, the target object may correspond to various network nodes, and the first network asset data may include the asset data of each network node corresponding to the target object. The asset data may include, but is not limited to: Internet Protocol (IP) address, service protocol, service port, operating system type, application software type, middleware, application software, and network routing information.

[0050] In some embodiments, the first vulnerability data may include, but is not limited to: the vulnerability identifier of the target object and vulnerability evaluation information from the Common Vulnerability Scoring System (CVSS).

[0051] Step 120 involves determining the unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data, and the attack prediction model.

[0052] Known vulnerability data refers to vulnerability data that can be obtained through public channels, while unknown vulnerability data refers to vulnerability data that cannot be obtained through public channels.

[0053] In some embodiments of this application, before step 120, the method may further include the following steps: constructing a first classifier and a second classifier, wherein the first classifier is used to determine whether an attack has occurred, and the second classifier is used to determine whether the attack is a 0-day vulnerability attack if an attack has occurred; and generating an attack prediction model based on the first classifier and the second classifier.

[0054] Thus, by constructing a first classifier and a second classifier, an attack prediction model can be generated that can judge single-step attacks and output possible unknown vulnerability attack paths.

[0055] In some embodiments, the electronic device can acquire attack data as a first positive sample and non-attack data as a first negative sample to train a first classifier; the attack data can be further divided into known vulnerability attack data and unknown vulnerability attack data, and the electronic device can use unknown vulnerability attack data as a second positive sample and known vulnerability attack data as a second negative sample to train a second classifier.

[0056] Among them, the unknown vulnerability attack data may be, for example, 0-day vulnerability attack data. 0-day vulnerability refers to the general term for system vulnerabilities that have not been discovered by security vendors but may be exploited by hacker groups. Correspondingly, 0-day vulnerability attack refers to a network attack launched by an attacker using a known 0-day vulnerability.

[0057] In some embodiments, the attack prediction model uses a Logistic Regression model to construct a binary classifier to perform link prediction. Based on the calculation of path features, a scoring function is designed to integrate different path features and calculate a score indicating the validity of the relationship. A higher score indicates a higher probability of the relationship being valid. The training process involves finding the optimal solution by selecting the set of parameters that minimizes the loss function on the sample set.

[0058] In some embodiments of this application, Figure 2This is a flowchart illustrating a penetration testing method provided in another embodiment of this application. Step 120 described above may include... Figure 2 Steps 210-250 are shown.

[0059] Step 210: Based on the first network asset data and the first vulnerability data, construct a network security knowledge graph and a set of relationship paths.

[0060] Step 220: Obtain historical attack data from the first network asset data.

[0061] The historical attack data refers to the data on the target object that was attacked before the current moment.

[0062] Step 230: Construct attack sample data based on historical attack data.

[0063] The attack sample data may include first sample data and second sample data. The first sample data includes all data of the target object that has been attacked, and the second sample data can be obtained from the first sample data. The second sample data is the data of the target object that has been attacked by a 0-day vulnerability.

[0064] Step 240: Input the network security knowledge graph, relationship path set and attack sample data into the attack prediction model to obtain the attack path set output by the attack prediction model.

[0065] The attack path set includes multiple unknown vulnerability attack paths predicted by the attack prediction model. These unknown vulnerability attack paths are the paths that attackers may use to launch attacks on target objects by exploiting unknown vulnerabilities in network nodes. These unknown vulnerability attack paths can be 0-day vulnerability attack paths.

[0066] The relation path set RP is obtained based on the relation type set R and the attribute type set P.

[0067] Step 250: Using fuzz testing technology, perform vulnerability mining on the target network asset data in the first network asset data to obtain unknown vulnerability data of the target object.

[0068] The first network asset data includes the asset data of each network node corresponding to the target object. The network nodes covered by multiple unknown vulnerability attack paths in the above attack path set are the target network nodes, and the target network asset data is the asset data of the target network nodes.

[0069] In the embodiments of this application, the integration method of fuzzing vulnerability mining based on unknown vulnerability attack path prediction and penetration testing attack path planning technology based on deep reinforcement learning not only avoids the blindness of fuzzing testing, but also improves the existing technology's scheme of searching for the optimal attack path only within the scope of known vulnerabilities.

[0070] In some embodiments, an acyclic attack sequence consisting of a set of sequentially dependent single-step attacks containing a 0-day vulnerability attack is represented as (A, E). Here, A is the set of single-step attacks, and E is the set of directed edges linking the single-step attacks. Using knowledge graph principles, the Cybersecurity Knowledge Graph (CKG) is represented by triples (CSO, FACT, T). Here, CSO = (C, R, P) is the cybersecurity ontology, C is the class set, R is the relation type set, P is the attribute type set, FACT is the set of data knowledge represented in Resource Description Framework (RDF) triple format, and T is the set of type dependencies between classes in CSO and entity objects in FACT. Furthermore, the 0-day vulnerability attack graph (0day-AG) is represented as (A, Priv, L, Prob). Where A = {a0} ∪ {ak} is the set of single-step attacks consisting of 0-day vulnerability attacks and known attacks. A single-step attack 'a' is represented by a tuple (host, vul), where host is the target object, vul is the vulnerability to be exploited, Priv is the set of prerequisite and preceding permissions for the single-step attack, L = {A × Priv} ∪ {Priv × A} represents the links between single-step attacks and permissions, indicating their prerequisite and preceding relationships, and Prob is the set of probabilities of a single-step attack occurring. The sequence label composed of a set of relation types in the aforementioned network security knowledge graph CKG is rp. The knowledge graph CKG and the attack graph 0day-AG form the following relationship: CKG, as a knowledge base, is the input to the attack prediction algorithm, providing the necessary knowledge for attack prediction; the 0-day vulnerability attack graph 0-AG is the graphical representation of the attack prediction results. The difference between relational path and attack path is as follows: RP is used as a feature in the logistic regression model in the path ranking algorithm to perform attack prediction; 0day vulnerability attack path 0day-AP is the attack path prediction result extracted by taking 0day-AG as a reference and combining the probability of multi-step attack occurrence.

[0071] In some embodiments, after inputting a cybersecurity knowledge graph, a set of relationship paths, and attack sample data into the attack prediction model, the attack prediction model may perform the following steps:

[0072] 1) Initialize variables: A, L, Prob, Priv, Thr, Cons, 0day-AP, and the overall utilization rate set.

[0073] 2) Select attacker: at = selectAttacker(CKG);

[0074] 3) Extract system device set: Host ← selectHost(CKG);

[0075] 4) Query the attacker's initial privilege set: Init_Priv ← Query_Privilege(att, CKG);

[0076] 5) Execute training for the first classifier LCA and the second classifier LCZ: LCA.fit(D1); LCZ.fit(D2); D1 is the training sample data for the first classifier, and D2 is the training sample data for the second classifier;

[0077] 6) Execute the following logic:

[0078] 6.1. Execute a while loop, first calculate the features. If the first classifier determines that the attack has not occurred, exit the current loop; otherwise, continue.

[0079] 6.2. If the second classifier determines that the attack is a 0-day vulnerability attack, then query the network security knowledge graph for the 0-day vulnerability entity used by the 0-day vulnerability attack, and query the attacker's attack intent against the target object.

[0080] 6.3. Create an authorization entity that satisfies the attack intent as a post-attack authorization. Query the known vulnerability entities exploited by the attack in the network security knowledge graph to query the consequences of the vulnerability exploitation, and evaluate the authorization obtained by the attacker as a post-attack authorization based on the consequences.

[0081] 6.4. Then construct a single-step attack. If it is determined that the attack is not a new attack, then exit the current loop.

[0082] 6.5 Further extract the probability of the attack occurring, query the prerequisite permissions for the attack, update the permissions obtained by the attacker in the network security knowledge graph, and end the prediction if no new attack occurs in this round of prediction.

[0083] 6.6. If it occurs, check the target permissions, extract the attack path, and output the 0-day vulnerability attack path set 0day-AP.

[0084] In some embodiments, after inputting the network security knowledge graph, relation path set and attack sample data into the attack prediction model in step 240, the attack prediction model can also output a 0-day attack graph 0day-AG = (A, Priv, L, Prob), a comprehensive utilization set CE, and an optimal attack path 0day-AP-Final.

[0085] In this embodiment of the application, after completing the attack prediction, the query function of the graph database is used to mine the vulnerability and preconditions of the attack based on the start and end entities and relationship paths, construct a single-step attack, and generate a 0-day attack graph.

[0086] In some embodiments, after step 250, the method may further include: writing unknown vulnerability data and its exploitation methods into the vulnerability database and the penetration testing tool's database EXP, respectively.

[0087] The penetration testing tool is used to perform penetration testing on the target object.

[0088] In this way, expanding the knowledge of unknown vulnerabilities in the known vulnerability database enhances the penetration testing capabilities of penetration testing tools. New vulnerability knowledge and exploitation methods can continuously improve the capabilities of the vulnerability database and penetration testing tools, and also improve the effectiveness of penetration testing.

[0089] In the embodiments of this application, in the penetration testing operation scenario, for the penetration testing operation environment (i.e. target object), network mapping is first performed, then known vulnerabilities are scanned based on the network asset data obtained from the network mapping, and then unknown vulnerabilities are further explored based on the known vulnerabilities. Finally, attack graph generation, attack path planning and automated penetration testing are performed to complete the predetermined penetration testing operation.

[0090] Step 130 involves generating a target attack graph of the target object based on the first network asset data, the first vulnerability data, and the unknown vulnerability data.

[0091] The target attack graph can be an attack tree used to represent the interdependencies between attack behaviors and attack steps; each node in the attack tree represents an attack behavior or a network node, and the root node represents the final target of the attack behavior. As long as one child node is attacked, the parent node can also be attacked.

[0092] A target attack graph can reflect the attack path by which an attacker uses network nodes in the target object that have known and / or unknown vulnerabilities to launch an attack on the target object. Each attack path can cover at least one network node.

[0093] In step 140, the target attack graph is input into the trained deep learning engine to obtain the optimal attack path of the target attack graph.

[0094] Among them, the optimal attack path has the highest vulnerability exploitation rate. Therefore, the optimal attack path is the attack path that an attacker is most likely to use when launching an attack on a target object.

[0095] In some embodiments of this application, step 140 may specifically include: inputting a target attack graph into a trained deep learning engine, so that the deep learning engine assigns a first score to all network nodes in the target attack graph, and determines the second scores of multiple target attack paths corresponding to the target attack graph based on the first scores of all network nodes, and outputs the target attack path with the highest second score as the optimal attack path of the target attack graph.

[0096] The first score is used to characterize the vulnerability exploitability of network nodes, and the second score is determined based on the first score of network nodes covered by the target attack path.

[0097] In some embodiments, the second score of the target attack path can be the sum of the first scores of all network nodes covered by the target attack path.

[0098] In other embodiments, the second score of the target attack path can be the ratio of the sum of the first scores of all network nodes covered by the target attack path to a first number, where the first number is the number of all network nodes covered by the target attack path.

[0099] In some embodiments of this application, in order for the deep learning engine to accurately output the optimal attack path with the highest vulnerability exploitation rate, Figure 3 This is a schematic flowchart of a penetration testing method provided in another embodiment of this application. Before step 140, the method may further include... Figure 3 Steps 310-340 are shown.

[0100] Step 310: After obtaining traffic sample data, construct multiple experimental topologies based on the traffic sample data.

[0101] Step 320: Scan multiple experimental topologies to obtain scan data for each experimental topology.

[0102] Step 330: Convert the scan data of each experimental topology environment into sample attack graphs to obtain multiple sample attack graphs.

[0103] Step 340: Using multiple sample attack graphs as input data and the optimal attack path of the sample attack graphs as output data, train the deep learning engine to obtain a trained deep learning engine.

[0104] In some embodiments of this application, step 310 may specifically include the following steps: extracting key feature data from traffic sample data; obtaining second network asset data based on the key feature data; and constructing an experimental topology environment based on the second network asset data and preset known vulnerability data.

[0105] In some embodiments of this application, to meet the training data targets for deep reinforcement learning, it is necessary to accumulate data samples through collection and generation methods. This involves collaborating with network test ranges, crawling shared sample websites, and accumulating proprietary data to obtain a large amount of sample data. This data is then used in the next module to build a test network topology, and based on this topology, targets are constructed, the required data is scanned, and combined with vulnerability information, it is used as input for the attack tree generation program.

[0106] In some embodiments, traffic sample data may include asset datasets, security vulnerability datasets, and background traffic datasets, and the traffic sample data may be stored as files on a sample data server.

[0107] The asset dataset can be collected through various channels such as probes or collaborations to gather network asset information in various network environments. This includes hardware information, software information (basic software, middleware, application software, etc.), network information (IP addresses, open ports and network protocols, network topology), application information, supply chain information, and security information (vulnerabilities and vulnerabilities) based on the above types of information.

[0108] The security vulnerability dataset is formed by merging mainstream vulnerability databases (NVD, CNVD, CNNVD, CVE), including vulnerability identifiers and CVSS general vulnerability evaluation information (including basic score, time score, and environment score, as well as a comprehensive score based on these three dimensions).

[0109] Background traffic datasets can contain a large amount of traffic data from effective attacks, log data, and business traffic data, and are mainly used to build verification environments.

[0110] In some embodiments, the extraction of key feature data from traffic sample data may specifically include: acquiring data to be processed from the traffic sample data; and processing the data to be processed to obtain key feature data.

[0111] In some embodiments, the processing flow may specifically include the following steps:

[0112] 1) Read the feature information of various data packets (more than 80 dimensions in total) from the pcap file, and output it in CSV table format after parsing. Extract the main statistical information of network traffic data samples, taking a Transmission Control Protocol (TCP) stream or a User Datagram Protocol (UDP) stream as a unit. TCP streams end with the FIN (finish) flag, while UDP streams are considered terminated after a set flow timeout. A TCP stream contains many data packets, undergoing a three-way handshake followed by data transmission and then a four-way handshake. Statistical information from a stream is used as extracted features. These features are divided into forward and reverse directions, with source to destination being considered forward and destination to source being reverse. A flag is constructed for each stream.

[0113] 2) Read each data packet from the pcap file one by one, add them to the corresponding stream, and set the stream variable to store all TCP and UDP streams that have not yet ended.

[0114] 3) During the process of adding data packets to the stream, the statistical characteristics of each stream are continuously updated, and the final values ​​are recorded in a CSV file.

[0115] 3) Determine whether the newly added data packet belongs to any of the current unfinished flows. If it belongs to the current flow, determine whether it is forward or reverse. Then, determine whether the timeout has occurred. If it does not time out, determine whether it contains the FIN flag. If neither condition is met, the data packet is added to the corresponding flow.

[0116] 4) If the previous judgment is not in any of the current unfinished streams, then create a new stream containing only the current data packet and store it in the stream variable.

[0117] 5) If it belongs to a current unfinished flow and times out or has a FIN flag, it means that the current flow has ended. If it times out, the corresponding flow is removed from the flow variable and a new flow is created and stored in the flow variable. If it has a FIN flag, the corresponding flow is directly removed from the flow variable.

[0118] 6) When the flow ends, directly call the flow variable function to dump the flow data.

[0119] 7) Based on the above steps, obtain the following key feature data from the network traffic sample data: IP address, service protocol, service port, operating system type, application software type (middleware), application software, and network routing information.

[0120] In this embodiment, the sample data processing and synthesis method based on deep reinforcement learning training of optimal attack paths supports the extraction of network asset information from discrete multi-source samples, further simulates real network conditions to build diverse target environments, uses the OVAL scanner to obtain scanning data, and converts it into attack graph description files required to generate attack graphs, thus solving the problem of massive sample data required for deep reinforcement learning training engines.

[0121] In some embodiments of this application, step 320 may specifically include: performing vulnerability scanning on the experimental topology using Nessus system vulnerability scanning and analysis software or a scanner that supports the Open Vulnerability Assessment Language (OVAL); and receiving the scan data returned by the scanner.

[0122] The scan data may include information about the actual IP address, the port and protocol used, known vulnerabilities, and other relevant data about the real network server.

[0123] In some embodiments, step 330 above converts the scan data of each experimental topology environment into sample attack graphs to obtain multiple sample attack graphs. Specifically, this may include: saving the scan data as a service dataset file; converting the service dataset file into an attack graph description file; and calling an attack graph generation tool (multihost, multistage, vulnerability analysis, mulval) to convert the attack graph description file into an attack graph esp file to obtain sample attack graphs.

[0124] Among them, the sample attack graph can be a tree structure used to represent the interdependence between attack behaviors and attack steps, and this tree structure is the attack tree.

[0125] In some embodiments, the service dataset file may be saved as .nessus or a file with the corresponding extension, as shown in Table (1):

[0126] Table (1)

[0127]

[0128] In some embodiments of this application, Deep Reinforcement Learning (DRL) is a product of combining deep learning and reinforcement learning. It integrates the powerful understanding capabilities of deep learning with the decision-making capabilities of reinforcement learning, achieving end-to-end learning. The emergence of deep reinforcement learning has made reinforcement learning technology truly practical, enabling the solution of complex problems in real-world scenarios. Offensive and defensive confrontation is a complex system. Based on the above analysis, we introduce a relatively advanced DQN model algorithm to provide intelligent decision support for penetration testing tools.

[0129] From an algorithmic perspective, reinforcement learning (deep Q-network, DQN) algorithms originate from classic Q-learning. In Q-learning, the Q-value (i.e., quality value) of a state-action pair is estimated through iterative updates based on experiences. That is, for each action that can be taken in a given state, we can update the value estimate of the original state-action pair using the immediate reward received and the value estimate of the new state.

[0130] The DQN algorithm trains to minimize the mean squared error (MSE) of the temporal difference error (TD-error). DQN employs two key strategies to adapt Q-Learning to deep neural networks: first, "experience replay," where each state-action pair is stored in a memory replay buffer and randomly sampled for network training, enabling reuse of training data and removing correlations in continuous trajectory samples; second, the use of a separate "target network" to stabilize training, so the TD-error is not calculated based on a constantly changing target derived from the training network, but rather on a stable target generated by a relatively fixed network.

[0131] The training process of the DQN algorithm simulates a penetration attack. Its core idea is that the attacker acts as an agent within the DQN model, the target environment for the penetration test is described by a simplified attack matrix, and the attack path is equivalent to moving from one node in the attack matrix to another, ultimately reaching the target server. The reward score Q(s, a), which plays a crucial role throughout the training process, is derived from the CVSS of vulnerabilities contained in each node of the target network, ranging from 0 to 100. This value needs to be adjusted based on the verification results.

[0132] The typical steps of applying the Deep Reinforcement Learning (DQN) algorithm to attack path generation are as follows:

[0133] Step 1: Based on the attack graph generated in Step 320 above, and combined with the security vulnerability database information, generate the transition matrix required by the DRL algorithm, and assign a reward score to each node according to the attack tree nodes. The assignment method is as follows: 1) Set the reward score of the starting node to 0.01 and the reward score of the target node to 100; 2) For each node that exploits a vulnerability, use the exploit value of the vulnerability as the reward score; 3) Considering that nodes that execute code or access files have a high exploit value in penetration testing, set a reward score of 1.5 for them; 4) For any other node on the attack tree, set the reward score to 0. If there is no path between two nodes, the reward score is -1; 5) Use the transition matrix as input to the DQN model for training to determine the total reward of all possible attack paths.

[0134] Step 2: In the above training algorithm, 100 attack trees are grouped into each batch and input into the algorithm engine as training data. Since the reward score represents the exploitability of the vulnerability, it is necessary to adjust the reward score according to the actual situation based on the verification results of manual spot checks or penetration testing tools, and correct its rationality.

[0135] Step 3: During the training iteration process, the DQN model measures the change in the average reward of a certain attack path in the experimental topology. Generally, the reward value is very small at the beginning, and gradually increases after multiple iterations. When the reward stabilizes, the optimal attack path can be output.

[0136] Step 150 involves performing automated penetration testing on the target object based on the optimal attack path of the target attack graph.

[0137] In some embodiments, electronic devices can invoke automated penetration testing tools to perform automated penetration testing on target objects and complete the penetration testing task.

[0138] In this application, the goal of training attack paths in a penetration testing scenario is to generate a large number of attack graphs based on various network environments, and then feed these attack graphs into a deep reinforcement learning engine for training to obtain the optimal attack path. Specifically, this involves collecting a large number of network data samples, refining and synthesizing the samples, simulating real network conditions to build diverse target environments, calling a vulnerability scanner that supports the OVAL standard to scan the target environments, obtaining OVAL format scan results data, converting the scan data into Mulval-compatible attack graphs, inputting them into the DQN deep reinforcement learning engine for training to obtain the optimal attack path, and finally calling an automated penetration testing tool to verify the attack path.

[0139] In penetration testing scenarios, the goal is to discover as many security vulnerabilities as possible in the operating environment. Therefore, based on asset mapping of the target network, a vulnerability discovery module is further integrated to predict attack paths for unknown zero-day vulnerabilities. When the possibility of zero-day vulnerability attacks is predicted, vulnerability discovery is performed on the relevant systems. Then, a deep reinforcement learning engine that has been trained and validated in the scenario is used to obtain the optimal attack path. Finally, an automated penetration testing tool is called to complete the penetration testing job.

[0140] It is understood that the penetration testing method provided in this application embodiment can be executed by an electronic device or a control module in a penetration testing apparatus for executing the penetration testing method. The penetration testing apparatus will now be described in detail.

[0141] Figure 4 This is a schematic diagram of the structure of a penetration testing device provided in an embodiment of this application. Figure 4 As shown, the penetration testing device 400 may include: a mapping processing module 410, a determination module 420, a generation module 430, an input module 440, and a testing module 450.

[0142] The system includes: a mapping processing module 410 for performing network mapping processing on the target object to obtain first network asset data and first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; a determination module 420 for determining unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data and the attack prediction model; a generation module 430 for generating a target attack graph of the target object based on the first network asset data, the first vulnerability data and the unknown vulnerability data; an input module 440 for inputting the target attack graph into a trained deep learning engine to obtain the optimal attack path of the target attack graph; and a testing module 450 for performing automated penetration testing on the target object based on the optimal attack path of the target attack graph.

[0143] In some possible implementations of the second aspect, the determining module 420 includes: a construction unit for constructing a network security knowledge graph and a set of relational paths based on the first network asset data and the first vulnerability data; an acquisition unit for acquiring historical attack data from the first network asset data; the construction unit is also used to construct attack sample data based on the historical attack data; an input unit for inputting the network security knowledge graph, the set of relational paths, and the attack sample data into the attack prediction model to obtain a set of attack paths output by the attack prediction model, the set of attack paths including multiple unknown vulnerability attack paths; and a vulnerability mining unit for using fuzz testing technology to perform vulnerability mining on the target network asset data in the first network asset data to obtain unknown vulnerability data of the target object; wherein, the first network asset data includes asset data of each network node corresponding to the target object, the network nodes covered by multiple unknown vulnerability attack paths are target network nodes, and the target network asset data are asset data of the target network nodes.

[0144] In some possible implementations of the second aspect, the apparatus further includes: a construction module for constructing a first classifier and a second classifier before determining unknown vulnerability data of the target object, wherein the first classifier is used to determine whether an attack has occurred, and the second classifier is used to determine whether the attack is a 0-day vulnerability attack if an attack has occurred; and a generation module 430 for generating an attack prediction model based on the first classifier and the second classifier.

[0145] In some possible implementations of the second aspect, the input module 440 is specifically used to: input the target attack graph into the trained deep learning engine, so that the deep learning engine assigns a first score to all network nodes in the target attack graph, and determines the second scores of multiple target attack paths corresponding to the target attack graph based on the first scores of all network nodes, and outputs the target attack path with the highest second score as the optimal attack path of the target attack graph; wherein, the first score is used to characterize the vulnerability exploitability of the network nodes, and the second score is determined based on the first scores of the network nodes covered by the target attack path.

[0146] In some possible implementations of the second aspect, the apparatus further includes: a construction module for constructing multiple experimental topologies based on traffic sample data, provided that traffic sample data has been acquired, before inputting the target attack graph into the trained deep learning engine; a scanning module for scanning the multiple experimental topologies to obtain scan data for each experimental topology; a conversion module for converting the scan data of each experimental topology into sample attack graphs to obtain multiple sample attack graphs; and a training module for training the deep learning engine using the multiple sample attack graphs as input data and the optimal attack path of the sample attack graphs as output data to obtain a trained deep learning engine.

[0147] In some possible implementations of the second aspect, the construction module includes: an extraction unit for extracting key feature data from traffic sample data; an acquisition unit for acquiring second network asset data based on the key feature data; and a construction unit for constructing an experimental topology environment based on the second network asset data and preset known vulnerability data.

[0148] In some possible implementations of the second aspect, the device further includes: a writing module, used to write the unknown vulnerability data and its exploitation method into a vulnerability database and a penetration testing tool database respectively after determining the unknown vulnerability data of the target object, wherein the penetration testing tool is used to perform penetration testing on the target object.

[0149] The penetration testing apparatus provided in this application targets a specific object. In a scenario where penetration testing is conducted on the target object, network mapping is first performed to obtain the target object's first network asset data and known first vulnerability data. Based on this, and using the first network asset data, the first vulnerability data, and an attack prediction model, unknown vulnerability data existing in the target object can be determined. Based on this, combining the first network asset data, the first vulnerability data, and the unknown vulnerability data, a target attack graph for the target object can be generated. By inputting the target attack graph into a trained deep learning engine, the optimal attack path for the target attack graph can be obtained. This application can comprehensively probe the target object through an attack prediction model to obtain potentially unknown vulnerability data, overcoming the limitation of traditional solutions that can only obtain known vulnerability information through public channels. Furthermore, after accurately obtaining the network asset data, known vulnerability data, and unknown vulnerability data required for this penetration test, a target attack map with a broad vulnerability coverage can be generated by combining these three types of data. Through this target attack map, the optimal attack path can be searched within the range of known vulnerabilities and the range of unknown vulnerabilities. This optimal attack path is the penetration path for the target object. Therefore, penetration path planning for known and unknown vulnerabilities can be realized, which improves the limitation of traditional solutions that can only search for the optimal attack path within the range of known vulnerabilities, enhances the comprehensiveness of penetration testing on the target object, and thus improves the penetration testing effect.

[0150] The penetration testing device provided in this application embodiment can achieve Figure 1-3 The various processes implemented by the electronic device in the method embodiment can achieve the same technical effect, and will not be described again here to avoid repetition.

[0151] Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application.

[0152] like Figure 5As shown, the electronic device 500 in this embodiment may include a processor 501 and a memory 502 storing computer program instructions.

[0153] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0154] Memory 502 may include mass storage for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 502 is non-volatile solid-state memory. Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, a memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) containing computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform operations described with reference to the methods according to embodiments of this application.

[0155] The processor 501 implements any of the penetration testing methods described in the above embodiments by reading and executing computer program instructions stored in the memory 502.

[0156] In one example, electronic device 500 may also include communication interface 503 and bus 510. For example, Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0157] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0158] Bus 510 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0159] The electronic device provided in this application embodiment is capable of achieving Figure 1-3 The various processes implemented by the electronic device in the method embodiment can achieve the same technical effect, and will not be described again here to avoid repetition.

[0160] In conjunction with the penetration testing methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement the steps of any of the penetration testing methods in the above embodiments.

[0161] In conjunction with the penetration testing methods in the above embodiments, this application embodiment can provide a computer program product to implement them. This (computer) program product is stored in a non-volatile storage medium, and when executed by at least one processor, it implements the steps of any of the penetration testing methods in the above embodiments.

[0162] This application also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled. The processor is used to run programs or instructions to implement the various processes of the above penetration testing method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0163] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0164] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0165] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0166] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0167] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0168] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A penetration testing method, characterized in that, The method includes: The target object is subjected to network mapping processing to obtain the first network asset data and the first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; Based on the first network asset data, the first vulnerability data, and the attack prediction model, the unknown vulnerability data of the target object is determined. Specifically, a network security knowledge graph and a set of relationship paths are constructed based on the first network asset data and the first vulnerability data; Obtain historical attack data from the first network asset data; Based on the historical attack data, attack sample data is constructed; The network security knowledge graph, the relationship path set, and the attack sample data are input into the attack prediction model to obtain the attack path set output by the attack prediction model. The attack path set includes multiple unknown vulnerability attack paths. Using fuzz testing techniques, vulnerability mining is performed on the target network asset data in the first network asset data to obtain unknown vulnerability data of the target object; Wherein, the first network asset data includes the asset data of each network node corresponding to the target object, the network nodes covered by the multiple unknown vulnerability attack paths are the target network nodes, and the target network asset data is the asset data of the target network nodes; Based on the first network asset data, the first vulnerability data, and the unknown vulnerability data, a target attack graph of the target object is generated. The target attack graph is input into the trained deep learning engine to obtain the optimal attack path of the target attack graph; Based on the optimal attack path of the target attack graph, an automated penetration test is performed on the target object.

2. The method according to claim 1, characterized in that, Before determining the unknown vulnerability data of the target object, the method further includes: Construct a first classifier and a second classifier, wherein the first classifier is used to determine whether an attack has occurred, and the second classifier is used to determine whether the attack is a 0-day vulnerability attack if an attack has occurred. The attack prediction model is generated based on the first classifier and the second classifier.

3. The method according to claim 1, characterized in that, The step of inputting the target attack graph into the trained deep learning engine to obtain the optimal attack path of the target attack graph includes: The target attack graph is input into the trained deep learning engine so that the deep learning engine assigns a first score to all network nodes in the target attack graph, and determines the second score of multiple target attack paths corresponding to the target attack graph based on the first score of all network nodes, and outputs the target attack path with the highest second score as the optimal attack path of the target attack graph. The first score is used to characterize the vulnerability exploitability of the network node, and the second score is determined based on the first score of the network nodes covered by the target attack path.

4. The method according to claim 1, characterized in that, Before inputting the target attack map into the trained deep learning engine, the method further includes: Having obtained traffic sample data, multiple experimental topology environments are constructed based on the traffic sample data; Scan the multiple experimental topologies to obtain scan data for each experimental topology. The scan data of each experimental topology environment is converted into sample attack graphs, resulting in multiple sample attack graphs; The deep learning engine is trained by using the multiple sample attack graphs as input data and the optimal attack path of the sample attack graphs as output data, thus obtaining a trained deep learning engine.

5. The method according to claim 4, characterized in that, The construction of multiple experimental topology environments based on the traffic sample data includes: Extract key feature data from the traffic sample data; Based on the aforementioned key feature data, second network asset data is obtained; The experimental topology environment is constructed based on the second network asset data and the preset known vulnerability data.

6. The method according to claim 1, characterized in that, After determining the unknown vulnerability data of the target object, the method further includes: The unknown vulnerability data and its exploitation methods are written into the vulnerability database and the database of the penetration testing tool, respectively. The penetration testing tool is used to perform penetration testing on the target object.

7. A penetration testing device, characterized in that, The device includes: The mapping and processing module is used to perform network mapping and processing on the target object to obtain the first network asset data and the first vulnerability data of the target object, wherein the first vulnerability data is known vulnerability data; The determination module is used to determine the unknown vulnerability data of the target object based on the first network asset data, the first vulnerability data, and the attack prediction model; Specifically, a network security knowledge graph and a set of relationship paths are constructed based on the first network asset data and the first vulnerability data; Obtain historical attack data from the first network asset data; Based on the historical attack data, attack sample data is constructed; The network security knowledge graph, the relationship path set, and the attack sample data are input into the attack prediction model to obtain the attack path set output by the attack prediction model. The attack path set includes multiple unknown vulnerability attack paths. Using fuzz testing techniques, vulnerability mining is performed on the target network asset data in the first network asset data to obtain unknown vulnerability data of the target object; Wherein, the first network asset data includes the asset data of each network node corresponding to the target object, the network nodes covered by the multiple unknown vulnerability attack paths are the target network nodes, and the target network asset data is the asset data of the target network nodes; The generation module is used to generate a target attack graph of the target object based on the first network asset data, the first vulnerability data, and the unknown vulnerability data; The input module is used to input the target attack graph into the trained deep learning engine to obtain the optimal attack path of the target attack graph; The testing module is used to perform automated penetration testing on the target object based on the optimal attack path of the target attack graph.

8. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the steps of the penetration testing method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the steps of the penetration testing method as described in any one of claims 1-6.

Images