An automated information security penetration testing platform

Abstract

The invention discloses an automated information security penetration testing platform, which relates to the field of information security technology. An asset discovery module is combined with active scanning and passive monitoring technologies to automatically identify assets in a network, and classify and sort them. A vulnerability scanning module integrates multiple tools to perform vulnerability scanning on these assets, and evaluates the security of system configuration based on a security baseline. A vulnerability exploitation module simulates vulnerability attack behaviors in a security sandbox, and evaluates their interference with the system. A comprehensive analysis module predicts and divides the security status of the system according to the system configuration and vulnerability impact, and dynamically adjusts the test strategy. When the system is in a low security state, the automated testing module triggers a comprehensive penetration test and issues an early warning, which greatly improves the efficiency and accuracy of the penetration test, can quickly respond to new attack methods, and promptly discover and repair potential security vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an automated information security penetration testing platform. Background Art

[0002] In the current information security field, with the rapid development of technology and the continuous evolution of network attack methods, the importance of information security penetration testing is increasing. Penetration testing is a key method to evaluate the security of computer systems, networks or web applications. It identifies and fixes potential security vulnerabilities by simulating attacker behavior. Traditional penetration testing methods mainly rely on manual operations. However, since manual testing requires manual configuration and execution of each test step, the entire process is very time-consuming and it is difficult to quickly cover all assets in the network. In addition, the rapid evolution of attack methods means that testing tools and methods need to be updated frequently, and manual testing often cannot respond to these changes in a timely manner, resulting in failure to identify the latest vulnerabilities. Summary of the invention

[0003] The purpose of the present invention is to provide an automated information security penetration testing platform to address the deficiencies in the background technology.

[0004] In order to achieve the above-mentioned object, the present invention provides the following technical solutions: an automated information security penetration testing platform, including an asset discovery module, a vulnerability scanning module, a vulnerability exploitation module, a comprehensive analysis module and an automated testing module;

[0005] The asset discovery module combines active scanning tools with passive monitoring techniques to automatically identify network assets and services in the system and to classify and sort the identified assets;

[0006] The vulnerability scanning module integrates several vulnerability scanning tools to scan the sorted assets for vulnerabilities, and evaluates the security of system configurations based on the in-depth analysis technology of the security baseline, automatically identifying potential risks that do not meet the security baseline;

[0007] The vulnerability exploitation module simulates vulnerability exploitation behavior in a secure sandbox environment through an integrated automated vulnerability exploitation tool, and evaluates the degree of interference of the vulnerability on the system based on the architecture and vulnerability characteristics of the target system;

[0008] The comprehensive analysis module predicts the security status of the monitoring system according to the security of the system configuration and the degree of interference of the vulnerability on the system, divides it into high security status and low security status, and adjusts the subsequent automated testing strategy according to the division results;

[0009] The automated testing module automatically triggers a comprehensive penetration test when the monitoring system is in a low security state, and provides early warning of possible risk events in the monitoring system based on the test results.

[0010] Preferably, in the vulnerability scanning module, the current configuration of the system is compared with the best practices of the security baseline, and a non-compliant item ratio fluctuation index is generated according to the comparison result. The method for obtaining the non-compliant item ratio fluctuation index is:

[0011] Extract the proportion of non-compliant items in time period S from the system configuration data. The calculation expression of the proportion of non-compliant items is: proportion of non-compliant items = number of configuration items that do not meet the baseline / total number of configuration items; where the number of configuration items that do not meet the baseline is the number of configuration items that do not meet the security baseline in the current time period, and the total number of configuration items is the total number of all configuration items in the system. Determine the sliding window size n, and calculate the proportion of non-compliant items in each time period according to the sliding window size. The expression is: ; In the formula, is the sliding average of the proportion of non-compliant items calculated at time t, In time The proportion of non-compliant items calculated at all times; each time a time period is slid, the data is updated and recalculated, and the sliding average of the proportion of non-compliant items in each time period is calculated and the weighted sum is calculated to obtain the non-compliant item proportion fluctuation index.

[0012] Preferably, in the vulnerability exploitation module, a system function degradation anomaly index is generated by vulnerability exploitation simulation to evaluate the interference degree of the vulnerability on the target system. The method for obtaining the system function degradation anomaly index is:

[0013] Before vulnerability exploitation simulation, collect the normal operation data of the system and obtain the key function performance values ​​before vulnerability exploitation , simulate vulnerability exploitation behavior in a sandbox environment and record the system's performance after the vulnerability is exploited ;use and Calculate the system function degradation value SFDI. The specific calculation expression is: ; Get the standard range of system function degradation values ​​under normal circumstances: ; If the calculated system function degradation value SFDI> , the calculation expression of the system function degradation abnormality index at this time is: ; If the calculated system function degradation value SFDI< , the calculation expression of the system function degradation abnormality index at this time is: ; In the formula, It is the abnormal index of system function degradation.

[0014] Preferably, in the comprehensive analysis module, the security status of the monitoring system is predicted based on the security of the system configuration and the degree of interference of the vulnerabilities on the system, specifically: the non-compliant item proportion fluctuation index and the system function degradation abnormality index are converted into a first eigenvector, and the first eigenvector is used as the input of the machine learning model. The machine learning model uses each group of first eigenvectors to predict the security status analysis value label of the monitoring system as the prediction target, and takes minimizing the sum of prediction errors of the security status analysis value labels of all monitoring systems as the training target. The machine learning model is trained until the sum of prediction errors converges, then the model training is stopped, and the security status analysis value of the monitoring system is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0015] Preferably, the acquired security status analysis value of the monitoring system is compared with a reference threshold of the security status analysis value of the monitoring system. If the security status analysis value of the monitoring system is greater than or equal to the reference threshold of the security status analysis value of the monitoring system, it indicates that the system configuration security is high and it is classified as a high security state. If the system is in a high security state, the automated testing strategy maintains a regular frequency. If the security status analysis value of the monitoring system is less than the reference threshold of the security status analysis value of the monitoring system, it indicates that there is an abnormality in the system configuration and it is classified as a low security state, then the test frequency is increased.

[0016] Preferably, in the automated testing module, when the monitoring system is in a low security state, a comprehensive penetration test is automatically triggered, and an early warning of possible risk events in the monitoring system is issued based on the test results, specifically:

[0017] When the system is in a low security state, that is, the security status analysis value of the monitoring system generated within a fixed time period is less than the reference threshold of the security status analysis value of the monitoring system, a comprehensive penetration test is automatically triggered, and the security status analysis values ​​generated within several fixed time periods during the comprehensive test that are less than the reference threshold of the security status analysis value of the monitoring system are collected, and a corresponding data set is established. The mean and standard deviation of the data set are calculated, and the risk level of the monitoring system is determined after analysis, so as to provide early warning of possible risk events that may occur in the monitoring system.

[0018] Preferably, if the mean value of the safety status analysis value in the data set is greater than or equal to the reference threshold value of the safety status analysis value mean value, and the standard deviation of the safety status analysis value is less than the reference threshold value of the safety status analysis value standard deviation, it means that the overall safety status of the system is within the normal range and the fluctuation of the safety status is small, and its risk level is marked as low risk. At this time, no warning signal is generated, the system performance is stable, and no additional processing is required;

[0019] If the mean value of the safety status analysis value is greater than or equal to the reference threshold value of the mean value of the safety status analysis value, and the standard deviation of the safety status analysis value is greater than or equal to the reference threshold value of the standard deviation of the safety status analysis value, it indicates that the overall safety status is still normal but the safety status of the system fluctuates greatly, and its risk level is marked as medium risk. At this time, a third-level warning signal is generated, and monitoring and analysis need to be strengthened;

[0020] If the mean value of the safety status analysis value is less than the reference threshold value of the mean value of the safety status analysis value, and the standard deviation of the safety status analysis value is greater than or equal to the reference threshold value of the standard deviation of the safety status analysis value, it means that the system safety status is poor, and the system safety status fluctuates significantly, and its risk level is marked as high risk. At this time, a first-level warning signal is generated, which requires immediate response and repair;

[0021] If the mean of the safety status analysis value is less than the reference threshold of the mean of the safety status analysis value, and the standard deviation of the safety status analysis value is less than the reference threshold of the standard deviation of the safety status analysis value, and the mean is lower than the reference threshold, the system is in a continuously unsafe state, and its risk level is marked as medium-high risk. At this time, a second-level warning signal is generated, requiring comprehensive repairs and improved safety.

[0022] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0023] 1. The present invention realizes automatic identification of network assets, vulnerability scanning and utilization, real-time monitoring of system security status and risk warning through modular design. Compared with traditional manual penetration testing, the asset discovery module combines active scanning and passive monitoring technology to ensure comprehensive coverage of network assets; the vulnerability scanning module integrates multiple tools and conducts in-depth assessment of the security of system configuration based on security baselines; the vulnerability exploitation module performs automated simulation in a sandbox environment to effectively assess the degree of interference of vulnerabilities on the system. The comprehensive analysis module predicts the security status of the system by analyzing the security of the system and the degree of interference of vulnerabilities, and dynamically adjusts the test strategy. If the system is in a low security state, the automated testing module will automatically trigger a comprehensive penetration test and warn of possible risks in advance.

[0024] 2. This invention not only greatly improves the efficiency and coverage of penetration testing and responds to rapidly evolving attack methods in a timely manner, but also predicts the security status of the system through intelligent analysis and machine learning models, reduces manual intervention, and ensures system security. By collecting and analyzing the mean and standard deviation of security status analysis values ​​in real time, the platform can accurately assess the risk level of the system and generate early warning signals of different levels, helping the security team to take timely repair and protection measures and effectively reduce potential security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0026] Figure 1 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] For examples, see Figure 1 As shown, an automated information security penetration testing platform described in this embodiment includes an asset discovery module, a vulnerability scanning module, a vulnerability exploitation module, a comprehensive analysis module and an automated testing module;

[0029] The asset discovery module combines active scanning tools with passive monitoring techniques to automatically identify network assets and services in the system and to classify and sort the identified assets;

[0030] The vulnerability scanning module integrates several vulnerability scanning tools to scan the sorted assets for vulnerabilities, and evaluates the security of system configurations based on the in-depth analysis technology of security baselines, automatically identifying potential risks that do not meet the security baselines;

[0031] The vulnerability exploitation module simulates vulnerability exploitation behavior in a secure sandbox environment through an integrated automated vulnerability exploitation tool, and evaluates the degree of interference of the vulnerability on the system based on the architecture and vulnerability characteristics of the target system;

[0032] The comprehensive analysis module predicts the security status of the monitoring system according to the security of the system configuration and the degree of interference of the vulnerability on the system, divides it into high security status and low security status, and adjusts the subsequent automated testing strategy according to the division results;

[0033] The automated testing module automatically triggers a comprehensive penetration test when the monitoring system is in a low security state, and provides early warning of possible risk events in the monitoring system based on the test results.

[0034] At the beginning of the asset discovery module, you must first determine the network range that needs to be scanned, such as IP address segments, subnets, or specific network nodes, and ensure complete coverage of all assets by configuring the parameters of the scanning tool (such as port range, protocol type). Select a suitable active scanning tool, such as Nmap for fine scanning, Masscan for large-scale and fast scanning, and configure its parameters to adapt to the network environment. In order to identify assets more widely, use passive monitoring technology (such as Zeek or Wireshark) to monitor real-time network traffic and capture hidden devices and services that active scanning cannot detect, especially dynamic IP devices or IoT devices.

[0035] During execution, active scanning tools actively send probe requests to identify the device's IP address, MAC address, open ports, operating system, and running services. Service fingerprinting technology can be used to further confirm the specific applications running on each port. For devices or services that are not fully identified by active scanning, special tools can be used for supplementary scanning, such as tools for Web services, wireless devices, etc. At the same time, passive monitoring tools monitor network traffic, analyze the device's communication mode, protocol type, and traffic pattern to discover hidden devices or devices with unopened ports in the network, and infer their network roles, such as servers or switches.

[0036] Finally, the results of active scanning and passive monitoring are combined and deduplicated to ensure that each device, port, and service is fully identified and a unified asset list is generated. Assets are classified and prioritized based on business importance, device type, risk level, and other dimensions. High-risk assets such as database servers and sensitive information storage systems are prioritized for detection, and the asset list is adjusted dynamically. When the network changes, the system automatically updates the classification and sorting to ensure real-time performance. The asset distribution map, service distribution map, and priority sorting are displayed through a visual interface to help the security team quickly understand the network situation and issue notifications to prompt new devices or changes.

[0037] In this application, by combining active scanning and passive monitoring, a comprehensive identification of all network assets and services in the system is achieved, and key assets are prioritized through classification and sorting. This multi-dimensional asset management method improves the coverage and efficiency of network security assessments, ensuring that every device and service in the network is fully identified and analyzed.

[0038] The vulnerability scanning module integrates several vulnerability scanning tools to scan the sorted assets for vulnerabilities, and evaluates the security of the system configuration based on the deep analysis technology of the security baseline, automatically identifying potential risks that do not meet the security baseline.

[0039] Choose multiple vulnerability scanning tools, such as OpenVAS, Nessus, Qualys, etc., to ensure that multiple types of vulnerabilities (known vulnerabilities, configuration vulnerabilities, outdated software, etc.) are covered. Different tools have different advantages, and integrating multiple tools can help improve detection coverage. Configure the parameters of the scanning tool according to the system and network environment to ensure that each tool can correctly scan and detect relevant assets. Scan the vulnerability list of high-priority risk assets (such as database servers, application servers, etc.) first through the asset list classified and sorted by the asset discovery module. Ensure that the risks of key assets are assessed first. Scan for known vulnerabilities that may exist in assets (such as CVE vulnerabilities in software versions). Check whether there are errors in the system configuration (such as insecure default configuration, incorrect permission settings, etc.). Identify outdated software or unupdated components used in the system and prompt for repairs.

[0040] Determine the security baseline standard according to the business needs of the organization, extract configuration data from the system, associate the collected configuration data with the network assets identified by the asset discovery module, compare the current configuration of the system with the best practices of the security baseline, and generate the non-compliant item ratio fluctuation index based on the comparison results. The method for obtaining the non-compliant item ratio fluctuation index is as follows:

[0041] Extract the proportion of non-compliant items in time period S from the system configuration data. The calculation expression of the proportion of non-compliant items is: proportion of non-compliant items = number of configuration items that do not meet the baseline / total number of configuration items; where the number of configuration items that do not meet the baseline is the number of configuration items that do not meet the security baseline in the current time period, and the total number of configuration items is the total number of all configuration items in the system. Determine the sliding window size n based on business needs. For example, use n=7 to calculate the average value of the proportion of non-compliant items in the past 7 days, or use n=30 to calculate the average value based on the past 30 days. According to the sliding window size, calculate the proportion of non-compliant items in each time period, and the expression is: ; In the formula, is the sliding average of the proportion of non-compliant items calculated at time t, In time The proportion of non-compliant items calculated at all times; each time a time period is slid, the data is updated and recalculated. As time goes by, the time period in the window changes continuously, and the sliding average is also adjusted accordingly. The sliding average of the proportion of non-compliant items in each time period is calculated, and the weighted summation is performed to calculate the non-compliant item proportion fluctuation index.

[0042] The larger the fluctuation index of the proportion of non-compliant items, the more unstable the security of the system configuration is, indicating that the configuration items that do not meet the security baseline in the system frequently change or increase, resulting in large fluctuations in compliance. This fluctuation may mean that the system configuration fails to maintain consistency with the security baseline and there are potential security risks. Frequent fluctuations may also indicate that the system management is not standardized, the configuration changes are frequent, and there is a lack of security control measures. Therefore, the system faces a higher risk of attack or vulnerability exploitation, and timely measures must be taken to stabilize the configuration and restore compliance.

[0043] The vulnerability exploitation module simulates vulnerability exploitation behavior in a secure sandbox environment through an integrated automated vulnerability exploitation tool, and evaluates the degree of interference of the vulnerability on the system based on the architecture of the target system and the characteristics of the vulnerability.

[0044] The sandbox environment is an isolated virtual environment that allows potentially dangerous operations to be performed safely without affecting the production system. Vulnerability exploits are performed in the sandbox to avoid damage or impact on the real system. Isolation mechanism: Virtualization technology (such as virtual machines and containers) is used to completely isolate vulnerability exploits from the production environment to ensure that any destructive operations are limited to the sandbox. All vulnerability exploits in the sandbox environment will be recorded in detail for subsequent analysis and improvement of exploit strategies.

[0045] Integrated automated vulnerability exploitation tools (such as Metasploit, Core Impact, Immunity Canvas, etc.) can automatically perform vulnerability exploitation. These tools support common vulnerability attack methods, such as remote code execution (RCE), privilege escalation, denial of service attacks, etc. Through known vulnerability databases and exploit modules (such as known vulnerabilities in the CVE library), tools can automatically test the exploitation behavior of identified vulnerabilities. The tools execute each step through automated scripts, including vulnerability scanning, exploitation attempts, result analysis, and generation of exploit reports.

[0046] The system function degradation anomaly index is generated by vulnerability exploitation simulation to evaluate the interference degree of the vulnerability on the target system. The method for obtaining the system function degradation anomaly index is as follows:

[0047] Determine key system function performance indicators, including request processing speed, response time, and CPU usage, as the basis for function degradation assessment. Performance indicators can be determined based on the specific application scenarios of the system. For example, a Web application may focus on evaluating response time and throughput, while a database system may focus on query processing time and CPU usage.

[0048] Before vulnerability exploitation simulation, collect the normal operation data of the system and obtain the key function performance values ​​before vulnerability exploitation You can collect data multiple times to get an average performance value as a benchmark. Example: Suppose a web server's request response time is = 200 ms.

[0049] Simulate vulnerability exploitation behavior in a sandbox environment and record the system's performance after the vulnerability is exploited At this point, the system may experience load, crash, or functional degradation due to the vulnerability exploitation. Example: After the vulnerability is exploited, the request response time of the web server = 400 ms. Use and Calculate the system function degradation value SFDI. The specific calculation expression is: ; Get the standard range of system function degradation values ​​under normal circumstances: ; If the calculated system function degradation value SFDI> , the calculation expression of the system function degradation abnormality index at this time is: ; If the calculated system function degradation value SFDI< , the calculation expression of the system function degradation abnormality index at this time is: ; In the formula, It is the abnormal index of system function degradation.

[0050] The larger the system function degradation anomaly index is, the more serious the vulnerability's interference with the target system is. This means that the system's core functions have experienced significant performance degradation after the vulnerability was exploited, which may cause key services to slow down, response delays to increase, processing capabilities to decrease, and even cause some functions to fail to operate normally. The larger the index is, the greater the degradation of the system function is, and the greater the impact on the system's stability, availability, and security, further indicating that the vulnerability is more harmful and may require urgent repair and enhanced protection.

[0051] The comprehensive analysis module predicts the security status of the monitoring system according to the security of the system configuration and the degree of interference of the vulnerability to the system, divides it into high-security state and low-security state, and adjusts the subsequent automated testing strategy according to the division results.

[0052] The non-compliance item proportion fluctuation index and the system function degradation abnormal index are converted into the first eigenvector, and the first eigenvector is used as the input of the machine learning model. The machine learning model predicts the safety status analysis value label of the monitoring system for each group of first eigenvectors as the prediction target, and takes minimizing the sum of prediction errors of the safety status analysis value labels of all monitoring systems as the training target. The machine learning model is trained until the sum of prediction errors converges and the model training is stopped. The safety status analysis value of the monitoring system is determined according to the model output results, wherein the machine learning model is a polynomial regression model.

[0053] The method for obtaining the safety status analysis value of the monitoring system is as follows: from the first feature vector training data of the trained machine learning model, the corresponding function expression is obtained: ; In the formula, is the output function of the model, is the volatility index of the proportion of non-compliant items, It is the abnormal index of system function degradation. Analyze the security status of the monitoring system.

[0054] Compare the acquired security status analysis value of the monitoring system with the reference threshold of the security status analysis value of the monitoring system. If the security status analysis value of the monitoring system is greater than or equal to the reference threshold of the security status analysis value of the monitoring system, it means that the system configuration security is high and the vulnerability exploitation has little interference with the system. It is classified as a high security state. If the system is in a high security state, the automated testing strategy maintains the regular frequency; if the security status analysis value of the monitoring system is less than the reference threshold of the security status analysis value of the monitoring system, it means that there is an anomaly in the system configuration and the security is low. It is classified as a low security state. It is necessary to increase the test frequency or even immediately trigger a deeper penetration test or security scan to quickly identify and fix potential vulnerabilities. The reference threshold is a security standard value preset based on historical data and business needs, reflecting the security status of the system under normal operation. This threshold can be adjusted according to the importance and risk tolerance of the system.

[0055] The automated testing module automatically triggers a comprehensive penetration test when the monitoring system is in a low security state, and provides early warning of possible risk events in the monitoring system based on the test results.

[0056] When the system is in a low security state, that is, the security status analysis value of the monitoring system generated within a fixed time period is less than the reference threshold of the security status analysis value of the monitoring system, a comprehensive penetration test is automatically triggered, and the security status analysis values ​​generated within several fixed time periods during the comprehensive test that are less than the reference threshold of the security status analysis value of the monitoring system are collected, and a corresponding data set is established. The mean and standard deviation of the data set are calculated, and the risk level of the monitoring system is determined after analysis, so as to provide early warning of possible risk events that may occur in the monitoring system.

[0057] If the mean value of the safety status analysis value in the data set is greater than or equal to the reference threshold value of the safety status analysis value mean value, and the standard deviation of the safety status analysis value is less than the reference threshold value of the safety status analysis value standard deviation, it means that the overall safety status of the system is within the normal range and the fluctuation of the safety status is small, and the system performance is stable. Its risk level is marked as low risk, and no warning signal is generated at this time; continue to maintain the existing monitoring frequency, and no additional operation is required for the time being;

[0058] If the mean value of the security status analysis value is greater than or equal to the reference threshold value of the mean value of the security status analysis value, and the standard deviation of the security status analysis value is greater than or equal to the reference threshold value of the standard deviation of the security status analysis value, it indicates that the overall security status is still normal, but the security status of the system fluctuates greatly, and there are unstable factors. Its risk level is marked as medium risk. At this time, a third-level warning signal is generated to strengthen the analysis and monitoring of fluctuations. It may be necessary to further investigate the causes of the security status fluctuations in the system, such as sudden events, configuration changes, etc.

[0059] If the mean value of the security status analysis value is less than the reference threshold value of the mean value of the security status analysis value, and the standard deviation of the security status analysis value is greater than or equal to the reference threshold value of the standard deviation of the security status analysis value, it means that the system security status is poor. At the same time, the system security status fluctuates significantly, and there may be multiple serious problems or multiple status changes in a short period of time. Its risk level is marked as high risk, and a first-level warning signal is generated at this time; the system may face major security threats, and in-depth penetration testing and vulnerability repairs should be carried out immediately. It may be necessary to speed up the repair process and monitor the system status in real time to prevent security incidents;

[0060] If the mean of the security status analysis value is less than the reference threshold of the mean of the security status analysis value, and the standard deviation of the security status analysis value is less than the reference threshold of the standard deviation of the security status analysis value, and the mean is lower than the reference threshold, it indicates that the overall security status of the system is poor, and the system security status has not changed much, that is, the system is in a continuously unsafe state, and its risk level is marked as medium-high risk. At this time, a secondary warning signal is generated; it is necessary to give priority to existing vulnerabilities or configuration issues, conduct comprehensive penetration testing and remediation measures, and track the repair effect until the security status is improved.

[0061] It should be noted here that the importance of the first-level warning signal is greater than that of the second-level warning signal, and the importance of the second-level warning signal is greater than that of the third-level warning signal. Relevant personnel can take corresponding management measures according to different warning signal levels.

[0062] In this embodiment, the asset discovery module automatically identifies network assets and services in the system through a combination of active scanning tools and passive monitoring technologies, and classifies and sorts them; the vulnerability scanning module integrates multiple scanning tools to perform vulnerability scans on sorted assets, and evaluates the system configuration based on the security baseline, and automatically identifies risk items that do not meet the baseline; the vulnerability exploitation module uses automated tools to simulate vulnerability exploitation behavior in a secure sandbox environment, and evaluates the degree of interference with the system based on the architecture and vulnerability characteristics of the target system; the comprehensive analysis module predicts and monitors the security status of the system based on the security of the system configuration and the interference of the vulnerability, divides it into a high security state or a low security state, and adjusts subsequent automated testing strategies; when the system is in a low security state, the automated testing module automatically triggers a comprehensive penetration test, and warns of possible risk events in advance based on the test results.

[0063] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0064] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0065] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0066] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0067] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0068] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0069] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. An automated information security penetration testing platform, characterized by: It includes asset discovery module, vulnerability scanning module, vulnerability exploitation module, comprehensive analysis module and automated testing module; The asset discovery module combines active scanning tools with passive monitoring techniques to automatically identify network assets and services in the system and to classify and sort the identified assets; The vulnerability scanning module integrates several vulnerability scanning tools to scan the sorted assets for vulnerabilities, and evaluates the security of system configurations based on the in-depth analysis technology of the security baseline, automatically identifying potential risks that do not meet the security baseline; The vulnerability scanning module specifically includes: comparing the current configuration of the system with the best practices of the security baseline, and generating a non-compliant item ratio fluctuation index according to the comparison result. The method for obtaining the non-compliant item ratio fluctuation index is: The proportion of non-compliant items in time period S is extracted from the system configuration data. The calculation expression of the proportion of non-compliant items is: proportion of non-compliant items = number of configuration items that do not meet the baseline / total number of configuration items; where the number of configuration items that do not meet the baseline is the number of configuration items that do not meet the security baseline in the current time period, and the total number of configuration items is the total number of all configuration items in the system. The sliding window size n is determined, and the proportion of non-compliant items in each time period is calculated according to the sliding window size. The expression is: Wherein, MAt is the sliding average of the proportion of non-compliant items calculated at time t, and Pt-i is the proportion of non-compliant items calculated at time ti; each time a time period is slid, the data is updated and recalculated, and the sliding average of the proportion of non-compliant items in each time period is calculated and weighted summed to obtain the non-compliant item proportion fluctuation index; The vulnerability exploitation module simulates vulnerability exploitation behavior in a secure sandbox environment through an integrated automated vulnerability exploitation tool, and evaluates the degree of interference of the vulnerability on the system based on the architecture and vulnerability characteristics of the target system; The vulnerability exploitation module specifically includes: generating a system function degradation anomaly index through vulnerability exploitation simulation, and the method for obtaining the system function degradation anomaly index is: Before vulnerability exploitation simulation, collect the normal operation data of the system, obtain the key function performance value Fbefore before vulnerability exploitation, simulate vulnerability exploitation behavior in the sandbox environment, and record the system performance Fafter after vulnerability exploitation; use Fbefore and Fafter to calculate the system function degradation value SFDI. The specific calculation expression is: Get the standard range of system function degradation values ​​under normal circumstances: SFDI min ~SFDI max ; If the calculated system function degradation value SFDI>SFDI max At this time, the calculation expression of the system function degradation abnormality index is: WF = SFDI-SFDI max |; If the calculated system function degradation value SFDI <SFDI min At this time, the calculation expression of the system function degradation abnormality index is: WF=|SFDI-SFDI min |;WF is the system function degradation abnormality index; The comprehensive analysis module predicts the security status of the monitoring system according to the security of the system configuration and the degree of interference of the vulnerability on the system, divides it into high security status and low security status, and adjusts the subsequent automated testing strategy according to the division results; The comprehensive analysis module specifically includes: converting the non-compliant item proportion fluctuation index and the system function degradation abnormality index into a first eigenvector, taking the first eigenvector as the input of the machine learning model, the machine learning model uses each group of first eigenvectors to predict the safety status analysis value label of the monitoring system as the prediction target, and takes minimizing the sum of the prediction errors of the safety status analysis value labels of all monitoring systems as the training target, training the machine learning model until the sum of the prediction errors reaches convergence, stopping the model training, and determining the safety status analysis value of the monitoring system according to the model output result, wherein the machine learning model is a polynomial regression model; Compare the acquired security status analysis value of the monitoring system with the reference threshold of the security status analysis value of the monitoring system. If the security status analysis value of the monitoring system is greater than or equal to the reference threshold of the security status analysis value of the monitoring system, it indicates that the configuration security of the system is high, and it is classified as a high security state. If the system is in a high security state, the automated testing strategy maintains a regular frequency. If the security status analysis value of the monitoring system is less than the reference threshold of the security status analysis value of the monitoring system, it indicates that there is an abnormality in the system configuration, and it is classified as a low security state, and the test frequency is increased. The automated testing module automatically triggers a comprehensive penetration test when the monitoring system is in a low security state, and provides early warning of possible risk events in the monitoring system based on the test results.

2. An automated information security penetration testing platform according to claim 1, characterized in that: In the automated testing module, when the monitoring system is in a low security state, a comprehensive penetration test is automatically triggered, and based on the test results, early warnings are issued for possible risk events in the monitoring system, specifically: When the system is in a low security state, that is, the security status analysis value of the monitoring system generated within a fixed time period is less than the reference threshold of the security status analysis value of the monitoring system, a comprehensive penetration test is automatically triggered, and the security status analysis values ​​generated within several fixed time periods during the comprehensive test that are less than the reference threshold of the security status analysis value of the monitoring system are collected, and a corresponding data set is established. The mean and standard deviation of the data set are calculated, and the risk level of the monitoring system is determined after analysis, so as to provide early warning of possible risk events that may occur in the monitoring system.

3. An automated information security penetration testing platform according to claim 2, characterized in that: If the mean value of the safety status analysis value in the data set is greater than or equal to the reference threshold value of the safety status analysis value mean, and the standard deviation of the safety status analysis value is less than the reference threshold value of the safety status analysis value standard deviation, it means that the overall safety status of the system is within the normal range and the fluctuation of the safety status is small, and its risk level is marked as low risk. At this time, no warning signal is generated, the system performance is stable, and no additional processing is required; If the mean value of the safety status analysis value is greater than or equal to the reference threshold value of the mean value of the safety status analysis value, and the standard deviation of the safety status analysis value is greater than or equal to the reference threshold value of the standard deviation of the safety status analysis value, it indicates that the overall safety status is still normal but the safety status of the system fluctuates greatly, and its risk level is marked as medium risk. At this time, a third-level warning signal is generated, and monitoring and analysis need to be strengthened; If the mean value of the safety status analysis value is less than the reference threshold value of the mean value of the safety status analysis value, and the standard deviation of the safety status analysis value is greater than or equal to the reference threshold value of the standard deviation of the safety status analysis value, it means that the system safety status is poor, and the system safety status fluctuates significantly, and its risk level is marked as high risk. At this time, a first-level warning signal is generated, which requires immediate response and repair; If the mean of the safety status analysis value is less than the reference threshold of the mean of the safety status analysis value, and the standard deviation of the safety status analysis value is less than the reference threshold of the standard deviation of the safety status analysis value, and the mean is lower than the reference threshold, the system is in a continuously unsafe state, and its risk level is marked as medium-high risk. At this time, a second-level warning signal is generated, requiring comprehensive repairs and improved safety.

Images