Method, system and device for updating response strategy based on automated simulated attack

Abstract

A response strategy update method based on automated simulated attacks, S1 asset scanning: perform automated asset scanning and automated penetration of the agreed scope and target from the attacker's perspective to complete asset collection; S2 capture sunken assets: locate the asset device corresponding to each IP address through asset scanning and identification, capture sunken assets missed by users in the corner and repair them; S3 automated vulnerability retrieval: automatically retrieve vulnerabilities while scanning assets; S4 lateral attack vulnerabilities: verify the discovered vulnerabilities, launch lateral vulnerability attacks on the verified vulnerabilities, and repair the vulnerabilities discovered by the lateral vulnerability attacks; S5 update asset structure: update the changed asset structure after the repair is completed. This design not only automatically scans and collects assets to capture these missed assets, but also automatically simulates attacks to capture new threats and attack patterns in real time in a real environment.

Description

Technical Field

[0001] The present invention relates to a response strategy update method, system and device based on automated simulated attack, which are specifically suitable for optimizing system vulnerabilities. Background Art

[0002] Attack methods are constantly changing and evolving. It is difficult to get accurate answers to the security defense effects of these devices and whether the latest security defense programs have been loaded and upgraded in a timely manner under the security operation and maintenance model with audit reports as the main form. Currently, hacker attacks are mainly implemented through audit reports issued by the security audit system or security alarms set, while advanced attack methods are often very covert and bypass security protection measures. Therefore, it is urgent to use active hunting methods to promote defense through attack, simulate hackers to verify the security defense of existing security defense systems, and verify the defense effects of security devices based on attack results, thereby improving threat hunting defense capabilities.

[0003] Traditional network attack detection methods mostly match the security rule library, set security policies, and immediately issue an alarm or block when a threat matching the security rules is detected in the access traffic or access behavior. This method is effective for known security threats, but it is helpless against aspects such as 0Day vulnerability exploitation attacks, detailed WebRce command line execution content, and system malicious command execution detection. However, through multi-anchor intrusion detection methods, the detailed attack behavior and attack command line content of the attacker landing on the host can be completely and clearly captured, and the detection results are real-time and the alarm content is accurate.

[0004] The asset detection mechanism of the multi-anchor intrusion method has the technical principle and logic of studying the attacker's attack behavior and habits. It does not rely solely on one detection mechanism and means to capture all network attack behaviors, but sets multiple behavior detection anchor points on the hacker attack path, such as rebound behavior detection, user privilege escalation detection, Web command execution detection, system command execution detection, memory backdoor attack detection, etc. Through detailed detection methods, the attacker's operation behavior on the host is captured, so it is very effective in detecting attack methods that bypass firewalls and other boundaries.

[0005] Through the above analysis, the problems and defects of the prior art are as follows:

[0006] (1) Currently, hacker attacks are mainly prevented through audit reports issued by security audit systems or security alerts set up. However, advanced attack techniques are often very covert and bypass security protection measures.

[0007] (2) Traditional network attack detection methods are often helpless in terms of zero-day vulnerability exploitation attacks, detailed WebRce command line execution content, and system malicious command execution detection. Summary of the invention

[0008] The purpose of the present invention is to overcome the problem of single protection means in the prior art, and to provide a response strategy update method, system and device based on automated simulated attack.

[0009] To achieve the above objectives, the technical solution of the present invention is:

[0010] A method for updating a response strategy based on automated simulated attacks comprises the following steps:

[0011] S1 Asset Scanning: Automated asset scanning and penetration of the agreed scope and target from the attacker’s perspective to complete asset collection;

[0012] S2 captures sunken assets: by scanning and identifying assets, locates the asset device corresponding to each IP address, captures sunken assets that are missed by users and repairs them;

[0013] S3 automated vulnerability retrieval: Automatically retrieve vulnerabilities while scanning assets;

[0014] S4 Horizontal attack vulnerabilities: Verify discovered vulnerabilities, launch lateral vulnerability attacks on verified vulnerabilities, and repair vulnerabilities discovered by lateral vulnerability attacks;

[0015] S5 updates the asset structure: after the repair is completed, the changed asset structure is updated. If the last scan found sunken assets or vulnerabilities, return to S1 to scan the assets again; if the last scan did not find sunken assets or vulnerabilities, the update is completed.

[0016] The S1 asset scan uses various known attack and penetration methods to automatically penetrate the agreed scope and target, and completes the collection of assets such as IP addresses, domain names, hosts, services, credentials, operating systems, applications, plug-ins, network devices, etc.

[0017] The various attack penetration methods known in S1 include: full-scenario penetration attack, website penetration attack, intranet environment penetration attack, and WAF attack simulation.

[0018] In the S2, when an asset scanning attack is performed by itself, the asset list obtained by the intrusion scan is compared with the actual asset list to capture the sunken assets that are missed by the user. The unknown potential threats in the system can be known and repaired.

[0019] In the S3 automated retrieval vulnerability, various known automated penetration attack methods are used to automatically retrieve vulnerabilities;

[0020] In the S4 lateral attack vulnerability, the discovered vulnerability is verified, and the attack control authority is upgraded by obtaining access rights, escalating permissions, or obtaining control permissions. After the vulnerability is successfully verified, the attack method of vulnerability exploitation is simulated to carry out lateral attacks on assets at the same network level; all verified vulnerabilities are repaired.

[0021] A response strategy update system based on automated simulated attack, comprising:

[0022] The asset scanning module is used to perform automated asset scanning and automated penetration of the agreed scope and target from the attacker's perspective to complete asset collection;

[0023] The simulated attack module is used to locate the asset device corresponding to each IP address through asset scanning and identification, and to capture the sunken assets that are missed by users and repair them;

[0024] Vulnerability retrieval module, which automatically retrieves vulnerabilities while scanning assets;

[0025] The lateral vulnerability attack module verifies discovered vulnerabilities, launches lateral vulnerability attacks on verified vulnerabilities, and repairs the vulnerabilities discovered by lateral vulnerability attacks;

[0026] The asset update module is used to update the dynamically changing asset structure.

[0027] The asset scanning module uses network sniffing tools to capture data packets on the network and collects system logs and application logs of each asset; it processes the captured data packets and logs to extract key features;

[0028] The vulnerability retrieval module uses known data packets and known attack patterns to train a supervised machine learning model, extracts key feature data into the trained model, predicts vulnerabilities and attack methods, and automatically retrieves vulnerabilities;

[0029] The horizontal vulnerability attack module verifies the discovered vulnerabilities. For the verified vulnerabilities, it automatically determines which attack strategy to simulate by using vulnerability examples, and selects the best attack path to carry out horizontal attacks on assets at the same network layer. Once the simulated attack is successful, it automatically analyzes the reasons for the success and automatically proposes repair suggestions or directly triggers the automated repair process.

[0030] The asset update module feeds the attack data and results of the simulated attack back into the model to update the supervised machine learning model.

[0031] A device for updating a coping strategy based on automated simulated attacks, comprising a memory and a processor, wherein the memory is used to store computer program codes and transmit the computer program codes to the processor;

[0032] The processor is used to execute a response strategy update method based on automated simulated attacks according to instructions in the computer program code.

[0033] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a response strategy update method based on automated simulated attacks.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1. The present invention provides a response strategy update method based on automated simulated attacks, which can simulate and capture new threats and attack patterns in real time in a real environment through automated simulated attacks, thereby providing instant information to the security team.

[0036] 2. The present invention captures these missed assets through automatic scanning and asset collection in a response strategy update method based on automated simulated attacks. In traditional methods, many sunken assets left in corners will be ignored, and the present application analyzes and penetrates sunken assets to further enhance network security.

[0037] 3. In the response strategy update system based on automated simulated attack of the present invention, as the simulated attack continues, the system will continuously collect feedback from the attack, learn and optimize the model, so that the strategy and effect of the simulated attack are closer to the real environment, providing enterprises with more accurate security assessments. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a method flow chart of an embodiment of the present invention.

[0039] Figure 2 It is a vulnerability attack flow chart of an embodiment of the present invention.

[0040] Figure 3 It is a system structure diagram of an embodiment of the present invention.

[0041] Figure 4 It is a device structure diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0042] The present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0043] Embodiment 1:

[0044] See also Figure 1 to Figure 4 , a response strategy update method based on automated simulated attack, comprising the following steps:

[0045] S1 Asset Scanning: Automated asset scanning and penetration of the agreed scope and target from the attacker’s perspective to complete asset collection;

[0046] S2 captures sunken assets: by scanning and identifying assets, locates the asset device corresponding to each IP address, captures sunken assets that are missed by users and repairs them;

[0047] S3 automated vulnerability retrieval: Automatically retrieve vulnerabilities while scanning assets;

[0048] S4 Horizontal attack vulnerabilities: Verify discovered vulnerabilities, launch lateral vulnerability attacks on verified vulnerabilities, and repair vulnerabilities discovered by lateral vulnerability attacks;

[0049] S5 updates the asset structure: after the repair is completed, the changed asset structure is updated. If the last scan found sunken assets or vulnerabilities, return to S1 to scan the assets again; if the last scan did not find sunken assets or vulnerabilities, the update is completed.

[0050] The S1 asset scan uses various known attack and penetration methods to automatically penetrate the agreed scope and target, and completes the collection of assets such as IP addresses, domain names, hosts, services, credentials, operating systems, applications, plug-ins, network devices, etc.

[0051] The various attack penetration methods known in S1 include: full-scenario penetration attack, website penetration attack, intranet environment penetration attack, and WAF attack simulation.

[0052] In the S2, when an asset scanning attack is performed by itself, the asset list obtained by the intrusion scan is compared with the actual asset list to capture the sunken assets that are missed by the user. The unknown potential threats in the system can be known and repaired.

[0053] In the S3 automated retrieval vulnerability, various known automated penetration attack methods are used to automatically retrieve vulnerabilities;

[0054] In the S4 lateral attack vulnerability, the discovered vulnerability is verified, and the attack control authority is upgraded by obtaining access rights, escalating permissions, or obtaining control permissions. After the vulnerability is successfully verified, the attack method of vulnerability exploitation is simulated to carry out lateral attacks on assets at the same network level; all verified vulnerabilities are repaired.

[0055] A response strategy update system based on automated simulated attack, comprising:

[0056] The asset scanning module is used to perform automated asset scanning and automated penetration of the agreed scope and target from the attacker's perspective to complete asset collection;

[0057] The simulated attack module is used to locate the asset device corresponding to each IP address through asset scanning and identification, and to capture the sunken assets that are missed by users and repair them;

[0058] Vulnerability retrieval module, which automatically retrieves vulnerabilities while scanning assets;

[0059] The lateral vulnerability attack module verifies discovered vulnerabilities, launches lateral vulnerability attacks on verified vulnerabilities, and repairs the vulnerabilities discovered by lateral vulnerability attacks;

[0060] The asset update module is used to update the dynamically changing asset structure.

[0061] The asset scanning module uses network sniffing tools to capture data packets on the network and collects system logs and application logs of each asset; it processes the captured data packets and logs to extract key features;

[0062] The vulnerability retrieval module uses known data packets and known attack patterns to train a supervised machine learning model, extracts key feature data into the trained model, predicts vulnerabilities and attack methods, and automatically retrieves vulnerabilities;

[0063] The horizontal vulnerability attack module verifies the discovered vulnerabilities. For the verified vulnerabilities, it automatically determines which attack strategy to simulate by using vulnerability examples, and selects the best attack path to carry out horizontal attacks on assets at the same network layer. Once the simulated attack is successful, it automatically analyzes the reasons for the success and automatically proposes repair suggestions or directly triggers the automated repair process.

[0064] The asset update module feeds the attack data and results of the simulated attack back into the model to update the supervised machine learning model.

[0065] A device for updating a coping strategy based on automated simulated attacks, comprising a memory and a processor, wherein the memory is used to store computer program codes and transmit the computer program codes to the processor;

[0066] The processor is used to execute a response strategy update method based on automated simulated attacks according to instructions in the computer program code.

[0067] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements a response strategy update method based on automated simulated attacks.

[0068] Embodiment 2:

[0069] 1. Asset scanning and collection: Use the API and SDK tools provided by the public cloud to automatically scan and collect all virtual machines, storage buckets, and database instances running in the cloud environment.

[0070] 2. Vulnerability retrieval: Use cloud-specific security tools, such as AWS Inspector or Azure Security Center, to perform deep vulnerability scans on assets.

[0071] 3. Simulate attacks: Use open source penetration testing tools such as Metasploit, combined with the characteristics of the cloud environment, to simulate lateral attacks, such as attempting to further attack other cloud resources through a virtual machine with a weak security configuration.

[0072] 4. Policy update: Based on the results of simulated attacks, use the security policy management tools provided by the cloud to automatically update and strengthen relevant security policies, such as IAM policies, security group rules, etc.

[0073] Embodiment 3:

[0074] 1. Asset scanning and collection: Use network scanning tools, such as Nmap, to scan the local network and automatically identify and collect information about all connected IoT devices.

[0075] 2. Vulnerability retrieval: Use IoT-specific vulnerability scanning tools, such as Shodan or Censys, to perform in-depth vulnerability scans on the collected devices.

[0076] 3. Simulate attacks: Use known IoT device vulnerability libraries to simulate lateral attacks on these devices, such as trying to exploit a vulnerability in a smart light bulb to attack other devices on the same network.

[0077] 4. Policy update: Automatically update the security configuration and policies of IoT devices based on the results of simulated attacks, such as changing default passwords, closing unnecessary ports, etc.

[0078] These two embodiments demonstrate how to implement a response strategy update method based on automated simulated attacks in different application environments.

[0079] like Figure 1 As shown, the present invention provides an overview of the steps and an explanation of the relevant network security principles:

[0080] 1. Automated asset scanning and penetration (S1):

[0081] This step involves scanning and penetration testing targets within a specific scope from an attacker’s perspective. This helps to discover overlooked assets that could become potential security vulnerabilities.

[0082] 2. Scanning and identification of assets (S2):

[0083] In this step, scans are performed to determine which physical or virtual devices correspond to each IP address. This helps catch assets that are overlooked, forgotten, or no longer in use.

[0084] 3. Automated vulnerability retrieval (S3):

[0085] Perform asset scanning and vulnerability detection simultaneously to promptly identify and fix exploited weaknesses.

[0086] 4. Horizontal vulnerability attack (S4):

[0087] Attacks on discovered vulnerabilities simulate lateral movement attack methods, which helps understand how attackers can use these vulnerabilities to spread in the network.

[0088] 5. Asset structure update (S5):

[0089] Update and strengthen asset structures based on information collected and vulnerabilities discovered.

[0090] 6. Full-scenario penetration testing:

[0091] It includes comprehensive penetration testing of networks, applications, internal systems, etc., simulating various attack scenarios, such as website attacks, intranet environment attacks, simulated WAF (Web Application Firewall) attacks, etc.

[0092] Through these steps, you can better understand and enhance the organization's cybersecurity defense capabilities. This approach emphasizes continuous security testing and evaluation, as well as constantly updating and improving security policies based on the information collected. In actual operations, compliance, privacy and ethical issues also need to be considered to ensure that all testing activities are carried out within a secure and legal framework.

[0093] To combine code or programs to implement a response strategy update method based on automated simulated attacks, use cybersecurity tools and programming languages ​​to implement these steps.

[0094] Tool and language selection:

[0095] Python: Python is an ideal choice for this type of task due to its powerful libraries and concise syntax.

[0096] Nmap: For network scanning and asset discovery.

[0097] Metasploit: For penetration testing and vulnerability exploitation.

[0098] OpenVAS or Nessus: For automated vulnerability scanning.

[0099] Overview of steps to achieve this:

[0100] #S1: Automated Asset Scanning

[0101] Use Python scripts to call Nmap to perform asset scans.

[0102] ```Python

[0103] import nmap

[0104] def scan_targets(targets):

[0105] scanner = nmap.PortScanner()

[0106] scanner.scan(targets,'1-1024')

[0107] return scanner.all_hosts()

[0108] #Example: Scan a specific IP or IP range

[0109] hosts=scan_targets('192.168.1.1 / 24')

[0110] print(hosts)

[0111] #S2: Asset Identification

[0112] The output of Nmap can be analyzed after a scan to extract detailed information about each asset.

[0113] #S3: Vulnerability retrieval

[0114] Use OpenVAS or Nessus API to automate vulnerability scanning.

[0115] #S4: Simulated Attack

[0116] Use the Metasploit Framework to simulate attacks. This requires complex scripting and in-depth knowledge of Metasploit.

[0117] #S5: Asset structure update

[0118] Update the asset database based on the results of scans and attacks.

[0119] Security and Compliance:

[0120] When implementing these steps, it is very important to ensure that all actions are in compliance with legal and ethical standards. Only test in authorized environments and ensure that all activities are carried out within the control to avoid any impact on the production environment.

[0121] The actual implementation requires more in-depth planning and development, especially when it comes to vulnerability scanning and attack simulation. It is important to ensure that these operations are carried out in a secure, controlled environment and that appropriate authorizations are obtained when conducting penetration testing or any form of attack simulation.

[0122] The S1 provided in the embodiment of the present invention performs automated asset scanning on the agreed scope and target from the attacker's perspective, and automatically penetrates the agreed scope and target by using attack methods such as full-scenario penetration attacks, website penetration attacks, intranet environment penetration attacks, and WAF attack simulations, thereby completing the collection of assets such as IP addresses, domain names, hosts, services, credentials, operating systems, applications, plug-ins, network devices, etc.

[0123] According to S2 provided in the embodiment of the present invention, when we conduct an asset scanning attack by ourselves, by comparing the asset list obtained by the intrusion scanning with the actual assets, we can know the unknown potential threats in the system and repair them accordingly.

[0124] The S3 provided in the embodiment of the present invention uses automated penetration attacks to automatically search for vulnerabilities while scanning assets using cross-site scripting attacks, weak passwords, SQL injections, and the like.

[0125] like Figure 2 As shown, the vulnerability attacks of S4 provided in the embodiment of the present invention include:

[0126] Gain access rights, escalate rights, and gain control rights to improve attack control rights for discovered vulnerabilities, and conduct lateral vulnerability attacks;

[0127] Utilize verified vulnerabilities and combine them with vulnerability exploit component theory to launch lateral attacks on assets at the same network level.

[0128] In S5 provided by the embodiment of the present invention, each simulated penetration scan can update the dynamically changing asset structure, gradually strengthen the weak links, and verify the effectiveness of the last repair, thereby establishing the first line of defense for the enterprise's network security.

[0129] like Figure 3 As shown, the response strategy update system based on automated simulated attack provided by the embodiment of the present invention includes:

[0130] Simulated attack module, used to perform asset scanning attacks and automated penetration from the attacker's perspective;

[0131] Vulnerability retrieval module, used to automatically retrieve vulnerabilities;

[0132] Vulnerability remediation module, used to launch lateral vulnerability attacks on discovered vulnerabilities;

[0133] The asset update module is used to update the dynamically changing asset structure.

[0134] The method for updating a response strategy based on automated simulated attacks provided by an application embodiment of the present invention is applied to a computer device, wherein the computer device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method for updating a response strategy based on automated simulated attacks.

[0135] The method for updating a coping strategy based on automated simulated attacks provided by an application embodiment of the present invention is applied to an information data processing terminal, and the information data processing terminal is used to implement the coping strategy updating system based on automated simulated attacks.

[0136] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0137] Embodiment 4:

[0138] In order to achieve more intelligent simulation attack strategy updates, we can consider introducing machine learning and artificial intelligence technologies to improve the system's adaptability, prediction capabilities, and response speed. The following is an improved solution:

[0139] Intelligent asset identification: Through deep learning technology, non-standard assets can be automatically identified, such as unknown IoT devices, hidden servers, etc.

[0140] Intelligent vulnerability prediction: Use machine learning to learn known vulnerabilities and attack patterns and predict new vulnerabilities and attack methods.

[0141] Adaptive attack simulation: Based on the results of previous simulated attacks, the system can self-adjust and select more successful attack strategies.

[0142] Real-time asset structure update: By monitoring network traffic and log data in real time, the asset structure is dynamically updated to capture any newly added or removed assets.

[0143] The detailed signal and data processing process of the intelligent solution provided by the present invention is as follows:

[0144] 1. Data collection: Use network sniffing tools to capture data packets on the network and collect system logs and application logs of each asset.

[0145] 2. Feature extraction: Process the captured data packets and logs to extract key features, such as IP address, port, protocol, operating system, application type, etc.

[0146] 3. Model training: Using previously collected data and known attack patterns, train a supervised machine learning model such as a decision tree, support vector machine, or neural network.

[0147] 4. Vulnerability prediction: Input the newly collected feature data into the trained model to predict vulnerabilities and attack methods.

[0148] 5. Intelligent decision-making: Based on the predicted results, the system automatically decides which attack strategy to simulate and selects the best attack path.

[0149] 6. Response and Update: Once the simulated attack is successful, the system will automatically analyze the reasons for the success, such as which vulnerability or configuration error it is due to, and automatically make repair suggestions or directly trigger the automated repair process.

[0150] 7. Feedback loop: Feedback the results of simulated attacks into the model so that the model can continuously learn and optimize to adapt to changes in the network environment and new attack patterns.

[0151] In summary, by combining artificial intelligence and machine learning technologies, the accuracy and efficiency of simulated attack strategy updates can be greatly improved, making them more intelligent and adaptive.

Claims

1. A method for updating a response strategy based on automated simulated attacks, characterized in that: The steps include: S1 Asset Scanning: Automated asset scanning and penetration of the agreed scope and target from the attacker’s perspective to complete asset collection; S2 captures sunken assets: by scanning and identifying assets, locates the asset device corresponding to each IP address, captures sunken assets that are missed by users and repairs them; S3 automated vulnerability retrieval: Automatically retrieve vulnerabilities while scanning assets; S4 Horizontal attack vulnerabilities: Verify discovered vulnerabilities, launch lateral vulnerability attacks on verified vulnerabilities, and repair vulnerabilities discovered by lateral vulnerability attacks; S5 updates the asset structure: after the repair is completed, the changed asset structure is updated. If the last scan found sunken assets or vulnerabilities, return to S1 to scan the assets again; if the last scan did not find sunken assets or vulnerabilities, the update is completed; The S1 asset scan uses various known attack penetration methods to automatically penetrate the agreed scope and target, and completes the collection of assets such as IP addresses, domain names, hosts, services, credentials, operating systems, applications, plug-ins, and network devices; The various attack penetration methods known in S1 include: full-scenario penetration attack, website penetration attack, intranet environment penetration attack, and WAF attack simulation; In the S2, when an asset scanning attack is performed by itself, the asset list obtained by the intrusion scan is compared with the actual asset list to capture the sunken assets that are missed by the user. The unknown potential threats in the system can be known and repaired.

2. The method for updating a response strategy based on automated simulated attacks according to claim 1, characterized in that: In the S3 automated retrieval vulnerability, various known automated penetration attack methods are used to automatically retrieve vulnerabilities.

3. The method for updating a response strategy based on automated simulated attacks according to claim 2, characterized in that: In the S4 lateral attack vulnerability, the discovered vulnerability is verified, and the attack control authority is upgraded by obtaining access rights, escalating permissions, or obtaining control permissions. After the vulnerability is successfully verified, the attack method of vulnerability exploitation is simulated to carry out lateral attacks on assets at the same network level; all verified vulnerabilities are repaired.

4. A response strategy update system based on automated simulated attack, characterized in that: The strategy updating system is used to implement the response strategy updating method based on automated simulated attack according to any one of claims 1 to 3, comprising: The asset scanning module is used to perform automated asset scanning and automated penetration of the agreed scope and target from the attacker's perspective to complete asset collection; The simulated attack module is used to locate the asset device corresponding to each IP address through asset scanning and identification, and to capture the sunken assets that are missed by users and repair them; Vulnerability retrieval module, which automatically retrieves vulnerabilities while scanning assets; The lateral vulnerability attack module verifies discovered vulnerabilities, launches lateral vulnerability attacks on verified vulnerabilities, and repairs the vulnerabilities discovered by lateral vulnerability attacks; The asset update module is used to update the dynamically changing asset structure.

5. The system for updating coping strategies based on automated simulated attacks according to claim 4, characterized in that: The asset scanning module uses network sniffing tools to capture data packets on the network and collects system logs and application logs of each asset; it processes the captured data packets and logs to extract key features; The vulnerability retrieval module uses known data packets and known attack patterns to train a supervised machine learning model, extracts key feature data into the trained model, predicts vulnerabilities and attack methods, and automatically retrieves vulnerabilities; The horizontal vulnerability attack module verifies the discovered vulnerabilities. For the verified vulnerabilities, it automatically determines which attack strategy to simulate by using vulnerability examples, and selects the best attack path to carry out horizontal attacks on assets at the same network layer. Once the simulated attack is successful, it automatically analyzes the reasons for the success and automatically proposes repair suggestions or directly triggers the automated repair process. The asset update module feeds the attack data and results of the simulated attack back into the model to update the supervised machine learning model.

6. A device for updating a response strategy based on automated simulated attacks, characterized in that: The method comprises a memory and a processor, wherein the memory is used to store computer program code and transmit the computer program code to the processor; The processor is used to execute the response strategy updating method based on automated simulated attack according to any one of claims 1 to 3 according to the instructions in the computer program code.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for updating a response strategy based on automated simulated attacks described in any one of claims 1 to 3 is implemented.

Images