A behavior tree-based automated penetration testing method and device
By using an automated penetration testing method based on behavior trees, penetration testing activities are abstracted into a behavior tree model, enabling automated decision-making and execution. This solves the problems of existing tools relying on expert knowledge and having high learning costs, and improves the efficiency and accuracy of penetration testing.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 30 INST OF CHINA ELECTRONIC TECH GRP CORP
- Filing Date
- 2023-12-15
- Publication Date
- 2026-07-21
AI Technical Summary
Existing penetration testing tools rely on expert knowledge, have high learning costs, and are diverse, making it difficult to integrate and use them efficiently.
An automated penetration testing method based on behavior trees is adopted, which abstracts penetration testing activities into a behavior tree model, making decisions from top to bottom and executing from bottom to top. It integrates multiple penetration testing tools to achieve automated decision-making, scheduling and control.
Improve penetration testing efficiency, enhance vulnerability detection rate, reduce false positive rate, and achieve efficient, comprehensive, and accurate penetration testing.
Smart Images
Figure CN117714159B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security, and in particular to an automated penetration testing method and device based on behavior trees. Background Technology
[0002] With the development of information technology, security problems caused by network system vulnerabilities are becoming increasingly prominent. Penetration testing, which simulates attacks to assess system vulnerabilities, is an effective method for verifying defense performance and evaluating network security.
[0003] Modern enterprise or organizational computer network systems are vast and complex, with the various software running within them constantly being updated, modified, deleted, and migrated. Relying solely on security experts and analysts to conduct penetration testing is impractical. Currently common penetration testing tools suffer from two main problems. Firstly, they heavily rely on expert knowledge, requiring operators to possess relevant penetration testing expertise to effectively utilize the tools. Secondly, the sheer variety of testing tools means that a large number of tools with different functionalities are needed throughout the penetration testing process. The learning curve for mastering these tools is steep, making it difficult for testers to integrate the characteristics of various tools for efficient testing. Summary of the Invention
[0004] To address the problems existing in the prior art, an automated penetration testing method and device based on behavior trees are provided. The penetration testing activity is abstractly represented as a behavior tree model, with decision-making behavior from top to bottom and execution process from bottom to top. By utilizing the jumps in the behavior tree and integrating a large number of penetration testing tools, the automated decision-making, scheduling, control and execution of penetration testing tasks can be realized, making penetration testing more efficient, comprehensive and accurate.
[0005] The first aspect of this invention proposes an automated penetration testing method based on behavior trees, comprising:
[0006] Behavior tree model construction: Based on requirements, the penetration attack process is summarized and extracted from various testing business scenarios; the penetration attack process is classified and decomposed into different levels of behavior actions; based on the logical relationship between the behavior actions, various types of nodes are used to construct behavior subtrees; according to the classification process, the subtrees are clustered to form a complete behavior tree model;
[0007] Automated penetration testing: Receives control commands, executes penetration attack actions, instantiates a behavior tree model for each penetration test attack, and obtains attack feedback data. The attack feedback data then continues to trigger attacks until no new attack feedback data can be obtained. The data is then collected to generate a penetration test report.
[0008] Furthermore, the extraction process is summarized as follows: ATT&CK or Kill-Chain is used to sort out the processes, tactics, techniques and patterns involved in the penetration attack process in the actual testing business scenario, and the attack patterns are standardized by combining the leaf nodes of the behavior tree, and the corresponding flowcharts are drawn.
[0009] Furthermore, the classification and decomposition process is as follows: behaviors of the same nature are grouped into one category, specifically decomposed into penetration stage - attack tactics - attack techniques - attack patterns - layer 1 sub-behavior - layer 2 sub-behavior - ... - n layers of sub-behavior.
[0010] Furthermore, the method for constructing the behavior subtree is as follows: constructing the behavior subtree using various types of nodes based on the classification results; controlling the traversal path by using composite nodes and decorator nodes when constructing the behavior subtree; and executing the behavior action by using leaf nodes.
[0011] Furthermore, during the construction of the behavior subtree, if the general nodes cannot meet the requirements, new nodes are defined, with the node type and logical function clearly defined during the definition process.
[0012] Furthermore, after constructing the behavior subtree, the sub-behaviors are clustered. The clustering method corresponds to the classification method, and clustering is performed layer by layer from bottom to top and from leaf to root until the behavior tree model is successfully constructed.
[0013] Furthermore, the clustering process is consistent with the classification results and has a correct logical structure.
[0014] Furthermore, the automated penetration test is specifically as follows: Each penetration test will instantiate a new behavior tree model, traverse the behavior tree, and take adaptive attack actions to obtain more attack feedback data. Based on the more attack feedback data, more attacks will be triggered, so that the penetration test will continuously advance from the intelligence gathering stage to the penetration attack stage and to the post-penetration attack stage, until no new attack feedback data can be obtained. Finally, the data is collected and a penetration test report is generated.
[0015] Furthermore, during the traversal of the behavior tree, the traversal is performed in a depth-first manner and at a fixed frequency.
[0016] A second aspect of the present invention provides an apparatus comprising a memory and a processor, wherein the memory stores a computer program capable of being loaded by the processor and executing the aforementioned behavior tree-based automated penetration testing method.
[0017] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows: This invention formally describes attack techniques and patterns using behavior tree node combinations. Based on the attack process and tactics, it clusters the attack techniques and pattern subtrees layer by layer from bottom to top and from leaf to root, abstracting penetration testing activities into a behavior tree model. Utilizing the behavior tree model to make decisions and invoke penetration testing tools automates the completion of each stage of the penetration attack task, improving penetration testing efficiency, vulnerability detection rate, and test comprehensiveness, while reducing the false positive rate. Attached Figure Description
[0018] Figure 1 This is a schematic diagram of the behavior tree model construction process in one embodiment of the present invention.
[0019] Figure 2 This is a schematic diagram illustrating the interaction between a behavior tree model and a penetration testing tool in one embodiment of the present invention.
[0020] Figure 3 This is a flowchart of a port scanning process in one embodiment of the present invention.
[0021] Figure 4 This is a behavioral breakdown of a port scanning attack mode in one embodiment of the present invention.
[0022] Figure 5 This is a precondition subtree diagram in one embodiment of the present invention.
[0023] Figure 6 This is an example of an attack action subtree in one embodiment of the present invention.
[0024] Figure 7 This is a subtree representing a port scanning attack pattern in one embodiment of the present invention. Detailed Implementation
[0025] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.
[0026] To achieve penetration testing, this invention proposes an automated penetration testing method based on behavior trees. This method automates the penetration testing process, including intelligence gathering, threat modeling, vulnerability analysis, penetration attack, post-penetration attack, and report generation, making penetration testing more efficient, comprehensive, and accurate. The method comprises two parts: behavior tree model construction and automated penetration testing. Specifically:
[0027] A behavior tree is a directed tree structure with a root node. A behavior tree typically includes sequence, selection, and parallel control nodes, condition and action leaf nodes, and decoration nodes. It decomposes complex tasks in a hierarchical manner and describes the switching between task logics of an agent in a modular way.
[0028] Please refer to Figure 1 Before constructing the behavior tree model, the penetration attack process is summarized and extracted from various testing business scenarios according to the requirements; the penetration attack process is classified and decomposed into different levels of behavior actions; behavior subtrees are constructed using various nodes according to the logical relationship between the behavior actions; and the subtrees are clustered according to the classification process to form a complete behavior tree model.
[0029] During penetration testing, control commands are received, and penetration attack actions are executed. Each penetration test attack instantiates a behavior tree model and obtains attack feedback data. This attack feedback data then triggers further attacks until no new attack feedback data can be obtained. The data is then collected to generate a penetration test report. The interaction between the behavior tree model and the penetration testing tool is as follows: Figure 1 As shown.
[0030] The following section provides a detailed explanation of behavior tree model construction and automated penetration testing.
[0031] (I) Construction of Behavior Tree Model
[0032] 1. Process refinement
[0033] Because actual penetration testing is usually complex and varied, it is not linear but a repetitive attack process, such as intelligence gathering -> threat modeling -> vulnerability analysis -> more intelligence gathering -> more threat modeling -> more vulnerability analysis -> penetration attack -> more threat modeling -> ... -> ..., direct modeling is too complex and difficult to implement.
[0034] Therefore, in this embodiment, starting from actual penetration testing scenarios, the process, tactics and techniques are sorted out by combining frameworks / models such as ATT&CK or Kill-Chain, and the attack patterns are standardized by combining behavioral tree leaf nodes, and corresponding flowcharts are drawn.
[0035] The following section uses port scanning as an example to further describe the detailed process. The purpose of port scanning attacks is to bypass firewalls and, as covertly as possible, probe the open port status on the target host. Please refer to [link / reference]. Figure 3 The specific attack process is as follows: obtain the target host IP from the blackboard, filter active hosts, use the Nmap tool with ACK low-frequency scanning parameters to probe the active hosts, obtain and parse the probe results, and set relevant data on the blackboard.
[0036] 2. Behavioral breakdown
[0037] To facilitate the construction and combination of behavior subtrees, in this embodiment, after analyzing the penetration attack process, the behaviors involved in the process need to be broken down into simple and easily implemented actions level by level. This decomposition makes the penetration process more detailed and easier for programmers to implement in code. When classifying behaviors, empirical rules are often used. Different behavior tree designers have different classification principles and standards, resulting in different classification results and constructed behavior trees. However, the general principle should be to group behaviors of the same nature into one category to avoid overlap, contradictions, and mutual exclusion. In this embodiment, the penetration process can be decomposed into "penetration phase—attack tactics—attack techniques—attack mode—(1st layer sub-behavior)—(2nd layer sub-behavior)…(nth layer sub-behavior)". The higher the level of behavior decomposition, the higher the granularity of the constructed model and the higher the control precision.
[0038] Continuing with port scanning as an example, the behavioral breakdown process will be described further. Please refer to [link / reference]. Figure 4 Based on the defined task, the aforementioned attack flow is represented as a port scanning attack pattern subtree, which includes preconditions and attack actions. These two types of actions are then categorized: preconditions are divided into obtaining active host IPs and verifying preconditions; attack actions are divided into concatenating Nmap command-line parameters, calling tools to execute attack actions, obtaining and parsing results, and setting relevant data on the blackboard.
[0039] 3. Construction of the behavior subtree
[0040] After behavior decomposition, behavior subtrees can be constructed using various types of nodes based on the classification results. When constructing behavior subtrees, it is necessary to use composite nodes and decorator nodes to control the traversal path and leaf nodes to execute behavior actions.
[0041] In one embodiment, if the general node cannot meet the requirements, a new node is defined. When defining the node, the node type and logical function must be clearly defined to support the node implementation by subsequent behavior tree developers.
[0042] Continuing with port scanning as an example, the construction process of the behavior subtree will be further described. Based on the behavior class partitioning graph and the complexity of the actual subtree, precondition and attack action subtrees can be constructed separately. Figure 5 The precondition subtree is shown, including the sequence node: precondition, the behavior node: get active host IP, and the condition node: check the precondition. Figure 6 The attack action subtree is shown, including sequence nodes: attack actions, and behavior nodes: concatenating Nmap command line parameters, calling tools to execute attack actions, obtaining and parsing results, and setting relevant data on the blackboard.
[0043] 4. Behavior Tree Model Construction
[0044] After constructing the behavior subtree, the sub-behaviors need to be clustered to implement the specific command and control process. The clustering method corresponds to the classification method, using a bottom-up, leaf-to-root approach to cluster layer by layer until the entire command and control process behavior tree model is successfully constructed. It is important to note that the clustering process should ensure consistency with the classification results and the correctness of the logical structure.
[0045] Continuing with port scanning as an example, the process of building a behavior tree model will be described further. Please refer to [link / reference]. Figure 7 It shows a subtree diagram of port scanning attack patterns, including sequence nodes: port scanning, sequence nodes: preconditions and attack actions, precondition nodes include action nodes: obtaining active host IPs, and condition nodes: verifying preconditions; attack action nodes include: action nodes: concatenating Nmap command line parameters, calling tools to execute attack actions, obtaining and parsing results, and setting relevant data on the blackboard.
[0046] This completes the construction of the behavior tree model.
[0047] (II) Automated Penetration Testing
[0048] In this embodiment, please refer to Figure 2 The behavior tree model is mainly responsible for decision-making, scheduling and control of penetration attack tasks, while the penetration testing tool is responsible for receiving control instructions and executing penetration attack actions.
[0049] During each penetration test, a new behavior tree model is instantiated and traversed at a fixed frequency (e.g., 5Hz) using a depth-first approach. This allows for periodic reassessment and analysis of attack feedback data, enabling adaptive attack actions to acquire even more data. As attacks gather data and trigger further attacks, the penetration test continuously progresses from the intelligence gathering phase to the penetration attack phase and then to the post-penetration attack phase, until no more new attack feedback data can be obtained. Finally, the data is aggregated and a penetration test report is generated.
[0050] This invention uses behavior tree node combinations to formally describe various attack processes, tactics, techniques, patterns, and methods, abstracting penetration testing activities into a behavior tree model. The behavior tree model is used to automatically make decisions, schedule and control, and call various tools to complete penetration testing tasks at each stage.
[0051] Furthermore, the present invention proposes an apparatus including a memory and a processor, wherein the memory stores a computer program capable of being loaded by the processor and executing the aforementioned behavior tree-based automated penetration testing method.
[0052] In particular, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts.
[0053] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.
[0054] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0055] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.
[0056] In another aspect, this application also provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the behavior tree-based automated penetration testing method described in the above embodiments.
[0057] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to implement the behavior tree-based automated penetration testing method described in the above embodiments.
[0058] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.
[0059] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application. For those skilled in the art, the specific meaning of the above terms in this invention can be understood according to the specific circumstances; the accompanying drawings in the embodiments are used to clearly and completely describe the technical solutions in the embodiments of this invention. Obviously, the described embodiments are only some embodiments of this invention, not all embodiments. The components of the embodiments of this invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0060] Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of this application.
Claims
1. An automated penetration testing method based on behavior trees, characterized in that, include: Behavior tree model construction: Based on requirements, the penetration attack process is summarized and extracted from various testing business scenarios; The penetration attack process is categorized and broken down into different levels of actions; based on the logical relationships between these actions, various types of nodes are used to construct action subtrees; and the subtrees are clustered according to the classification process to form a complete action tree model. Automated penetration testing: Receives control commands, executes penetration attack actions, instantiates a behavior tree model for each penetration test attack, and obtains attack feedback data. The attack feedback data then continues to trigger attacks until no new attack feedback data can be obtained. The data is then collected to generate a penetration test report. The inductive extraction process is as follows: ATT&CK or Kill-Chain is used to sort out the processes, tactics, techniques and patterns involved in the penetration attack process in the actual test business scenario, and the attack patterns are described in a standardized manner by combining the leaf nodes of the behavior tree, and the corresponding flowcharts are drawn. The classification and decomposition process is as follows: behaviors of the same nature are grouped into one category, specifically decomposed into penetration stage - attack tactics - attack techniques - attack patterns - layer 1 sub-behavior - layer 2 sub-behavior - ... - n layer behaviors; After constructing the behavior subtree, the sub-behaviors are clustered. The clustering method corresponds to the classification method. Clustering is carried out layer by layer from bottom to top and from leaf to root until the behavior tree model is successfully constructed. The automated penetration test is as follows: Each penetration test will instantiate a new behavior tree model, traverse the behavior tree, and take adaptive attack actions to obtain more attack feedback data. Based on the more attack feedback data, more attacks will be triggered, so that the penetration test will continuously advance from the intelligence gathering stage to the penetration attack stage and to the post-penetration attack stage until no new attack feedback data can be obtained. Finally, the data is collected and a penetration test report is generated. The behavior tree is traversed in a depth-first manner at a fixed frequency.
2. The automated penetration testing method based on behavior trees according to claim 1, characterized in that, The method for constructing the behavior subtree is as follows: construct the behavior subtree using various types of nodes based on the classification results. When constructing the behavior subtree, use composite nodes and decorator nodes to control the traversal path and use leaf nodes to execute the behavior action.
3. The automated penetration testing method based on behavior trees according to claim 2, characterized in that, During the construction of the behavior subtree, if the general node cannot meet the requirements, a new node is defined, specifying the node type and logical function.
4. The automated penetration testing method based on behavior trees according to claim 1, characterized in that, The clustering process is consistent with the classification results and has a correct logical structure.
5. An electronic device, characterized in that, It includes a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and executed as described in any one of claims 1-4, which is an automated penetration testing method based on behavior trees.