Automatic penetration testing method and system based on machine learning and electronic equipment

Abstract

The invention provides an automatic penetration testing method and system based on machine learning and electronic equipment, and is applied to the technical field of network security testing. The method comprises the following steps: performing target information collection on a test target by using a sniffing tool to obtain a target information file; carrying out content screening on the target information file based on an information label in the target information file to obtain a target key information list; performing vulnerability utilization information matching of each piece of key information in the target key information list based on a machine learning model to obtain vulnerability utilization information corresponding to each piece of key information; and based on the obtained test information, the target key information list and the vulnerability utilization information corresponding to each piece of key information, generating a corresponding penetration test case, and executing the penetration test case. The problems that test accuracy and efficiency cannot be guaranteed by experience-dependent penetration test, and automatic penetration test is large in data demand quantity, time-consuming and resource-consuming are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security testing, and in particular to an automated penetration testing method and system based on machine learning, and electronic equipment. Background Art

[0002] Penetration testing is a commonly used security assessment method that aims to evaluate the security of computer systems, networks and applications and verify the effectiveness of network defense measures. Penetration testing simulates real attack behaviors to discover weaknesses, vulnerabilities and security risks in cyberspace and reports on the problems found. Penetration testing is a very complex process, including information collection, vulnerability scanning, test plan formulation and vulnerability exploitation. This process requires a lot of experience. Lack of experience can easily lead to misjudgment, thus affecting the accuracy and efficiency of the test.

[0003] Automated penetration testing refers to the technology of completing penetration testing by replacing human experience with models or rules. Currently, most automated penetration testing is based on deep reinforcement learning, which has problems such as large data requirements, long training time and high computing resource consumption. Summary of the invention

[0004] In order to overcome the problems that the above-mentioned experience-based penetration testing cannot guarantee test accuracy and efficiency and that automated penetration testing requires large amounts of data and is time-consuming and resource-consuming, the present invention provides an automated penetration testing method and system, and an electronic device based on machine learning.

[0005] In one aspect, the present invention provides an automated penetration testing method based on machine learning, comprising:

[0006] Use the sniffing tool to collect target information of the test target and obtain the target information file;

[0007] Filter the content of the target information file based on the information tags in the target information file to obtain a target key information list;

[0008] Match vulnerability exploitation information of each key information in the target key information list based on the machine learning model to obtain vulnerability exploitation information corresponding to each key information;

[0009] Based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, a corresponding penetration test case is generated, and the penetration test case is executed.

[0010] Optionally, the use of a sniffing tool to collect target information of a test target to obtain a target information file includes:

[0011] Obtaining input test target information and sniffing configuration information associated with the test target;

[0012] Generate a sniffing test instruction based on the test target information and the sniffing configuration information; call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information;

[0013] The sniffing information is stored as an XML file to obtain the target information file.

[0014] Optionally, the screening of the content of the target information file based on the information tags in the target information file to obtain a target key information list includes:

[0015] Traversing the content of the target information file, and filtering out content data of a data type corresponding to the tag feature based on the tag feature of the target information file to form a plurality of key information;

[0016] A plurality of key information are stored based on a table data structure to obtain the target key information list.

[0017] Optionally, each key information includes at least a target port, a target system type, a target service, a target product, and a vulnerability identifier.

[0018] Optionally, the machine learning model is a decision tree model, and the training process of the machine learning model includes:

[0019] Build a training dataset based on Metasploit's Exploits module;

[0020] Dividing the training data set into data subsets based on the entropy of the training data set for the vulnerability exploit category until the entropy of each divided data subset is 0, and the training is completed;

[0021] Each of the data subsets and its corresponding vulnerability exploitation category is taken as a subtree to form the decision tree model.

[0022] Optionally, the training process of the machine learning model further includes:

[0023] If the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset;

[0024] For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset;

[0025] The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

[0026] Optionally, the filtering out the segmentation feature from each of the label features based on the information gain of the data subset before and after the segmentation includes:

[0027] Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset;

[0028] Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation;

[0029] The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

[0030] Optionally, the information gain of the data subset before and after segmentation is calculated as follows:

[0031]

[0032] Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation;

[0033] The calculation formula of the entropy of the data subset is:

[0034]

[0035] Where n represents the total number of vulnerability exploit categories in the data subset, i represents the ordinal number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset.

[0036] Optionally, matching vulnerability exploitation information of each key information in the target key information list based on a machine learning model to obtain vulnerability exploitation information corresponding to each key information includes:

[0037] The target key information list is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to the decision rule until the leaf node of the decision tree model is moved to obtain vulnerability exploitation information of each key information.

[0038] Optionally, before matching vulnerability exploitation information of each key information in the target key information list based on the machine learning model, the method further includes:

[0039] Deleting redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list;

[0040] Each key information in the preprocessed target key information list is encoded with respect to a character string to obtain a corresponding numerical target key information list.

[0041] Optionally, executing the penetration test case includes:

[0042] In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case;

[0043] Generate a corresponding target test instruction based on the use case information of the target test case;

[0044] Call the msfconsole tool to execute the target test instructions to perform a preliminary penetration test.

[0045] Optionally, executing the penetration test case further includes:

[0046] If the initial penetration test is successful, continue with in-depth testing until the test is completed;

[0047] If the preliminary penetration test fails, the remaining penetration test cases except the target test case are automatically executed until all the remaining penetration test cases are completed, and a security assessment of the test target is performed based on the execution results.

[0048] On the other hand, the present invention also provides an automated penetration testing system based on machine learning, comprising:

[0049] The information collection module is used to collect target information of the test target using a sniffing tool to obtain a target information file;

[0050] A screening module, used for screening the content of the target information file based on the information tags in the target information file to obtain a target key information list;

[0051] An information matching module, used to match vulnerability exploitation information of each key information in the target key information list based on a machine learning model to obtain vulnerability exploitation information corresponding to each key information;

[0052] The penetration testing module is used to generate corresponding penetration testing cases based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, and execute the penetration testing cases.

[0053] Optionally, the information collection module includes:

[0054] An information acquisition submodule, used to acquire input test target information and sniffing configuration information associated with the test target;

[0055] The sniffing submodule is used to generate a sniffing test instruction based on the test target information and the sniffing configuration information; and to call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information;

[0056] The information storage submodule is used to store the sniffing information as an XML file to obtain the target information file.

[0057] Optionally, the screening module includes:

[0058] A tag filtering submodule, used to traverse the content of the target information file, and based on the tag features of the target information file, filter out content data of a data type corresponding to the tag features to form a plurality of key information;

[0059] The table storage submodule is used to store multiple key information based on the table data structure to obtain the target key information list.

[0060] Optionally, each key information includes at least a target port, a target system type, a target service, a target product, and a vulnerability identifier.

[0061] Optionally, the machine learning model is a decision tree model, and the system further includes a model training module, which includes:

[0062] The dataset construction submodule is used to build a training dataset based on the Exploits module of Metasploit;

[0063] A subset division submodule, used to divide the data subsets of the training data set based on the entropy of the training data set for the vulnerability exploitation category, until the entropy of each divided data subset is 0, and the training is completed;

[0064] The decision tree forming submodule is used to take each of the data subsets and its corresponding vulnerability exploitation category as a subtree to form the decision tree model.

[0065] Optionally, the subset division submodule is further used for:

[0066] If the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset;

[0067] For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset;

[0068] The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

[0069] Optionally, the subset division submodule is further used for:

[0070] Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset;

[0071] Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation;

[0072] The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

[0073] Optionally, the information gain of the data subset before and after segmentation is calculated as follows:

[0074]

[0075] Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation;

[0076] The calculation formula of the entropy of the data subset is:

[0077]

[0078] Where n represents the total number of vulnerability exploit categories in the data subset, i represents the ordinal number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset.

[0079] Optionally, the information matching module is specifically used to:

[0080] The target key information is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to a decision rule until it moves to a leaf node of the decision tree model to obtain vulnerability exploitation information of each key information.

[0081] Optionally, the system further comprises:

[0082] A preprocessing module, used to delete redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list;

[0083] The encoding module is used to encode each key information in the preprocessed target key information list to obtain a corresponding numerical target key information list.

[0084] Optionally, the penetration testing module is further used to:

[0085] In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case;

[0086] Generate a corresponding target test instruction based on the use case information of the target test case;

[0087] Call the msfconsole tool to execute the target test instructions to perform a preliminary penetration test.

[0088] Optionally, the penetration testing module is further used to:

[0089] If the initial penetration test is successful, continue with in-depth testing until the test is completed;

[0090] If the preliminary penetration test fails, the remaining penetration test cases except the target test case are automatically executed until all the remaining penetration test cases are completed, and a security assessment of the test target is performed based on the execution results.

[0091] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0092] The memory is used to store one or more programs;

[0093] When the one or more programs are executed by the at least one processor, any one of the above-mentioned automated penetration testing methods based on machine learning is implemented.

[0094] On the other hand, the present invention also provides a readable storage medium having an execution program stored thereon, and when the execution program is executed, any one of the above-mentioned automated penetration testing methods based on machine learning is implemented.

[0095] Compared with the prior art, the present invention has the following beneficial effects:

[0096] The present invention provides an automated penetration testing method and system based on machine learning. On the one hand, a sniffing tool is used to collect target information of a test target to obtain a target information file, and the content of the target information file is screened based on the information tag in the target information file to obtain a target key information list, which can automatically extract key information before vulnerability exploitation information matching, reduce the dependence of information collection on the professionalism and experience of testers, reduce the error rate of key information extraction, and at the same time, the information in the form of a list is easy to read and process automatically, thereby improving the accuracy and efficiency of the test. On the other hand, a machine learning model is used to simulate the process of manual vulnerability exploitation selection, thereby avoiding the situation where manual operation produces misjudgment, thereby improving the accuracy of vulnerability selection and the test efficiency. At the same time, compared with the deep reinforcement learning method, the computing resource consumption of the test process is reduced, the test efficiency is improved, and the requirements of the model training process on the amount of data, computing resources and training time are reduced, thereby greatly reducing the test cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 This is one of the flow charts of an automated penetration testing method based on machine learning of the present invention;

[0098] Figure 2 A schematic diagram of a construction process of an exemplary decision tree model of the present invention;

[0099] Figure 3 The second flowchart of an automated penetration testing method based on machine learning of the present invention;

[0100] Figure 4 It is a schematic structural diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0101] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0102] Embodiment 1:

[0103] The present invention provides an automated penetration testing method based on machine learning, as shown in the schematic diagram Figure 1 As shown, including:

[0104] Step S110, using a sniffing tool to collect target information of the test target to obtain a target information file;

[0105] Step S120, screening the content of the target information file based on the information tags in the target information file to obtain a target key information list;

[0106] Step S130, matching vulnerability exploitation information of each key information in the target key information list based on the machine learning model to obtain vulnerability exploitation information corresponding to each key information;

[0107] Step S140, based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, a corresponding penetration test case is generated, and the penetration test case is automatically executed.

[0108] In this example implementation, this example combines the Metasploit framework to perform automated penetration testing. Metasploit is one of the most commonly used penetration testing frameworks in the world. It is rich in functions and provides many functional modules. This method can be executed on the device where the penetration test system is located. The test target can be a computer system, network or application to be tested, the sniffer tool can be Nmap, and the target information file can be a file format with information tags, such as an XML file. The machine learning model can be a trained decision tree model, support vector machine, random forest, K nearest neighbor model, etc. The machine learning model is used to simulate the selection process of artificially performing corresponding vulnerability exploitation based on the target information file, that is, a mapping relationship is established between the key information in the target key information list and the vulnerability exploitation information through the machine learning model, and the vulnerability exploitation information includes information such as vulnerability exploitation type and name. Each key information in the target key information list can include multiple key information such as target IP address information, target port, target system type, service, product, product version, CVE (Common Vulnerabilities and Exposures, Common Vulnerability List) identification and CVSS (Common Vulnerability Scoring System, Common Vulnerability Scoring System) score. CVE is a public list of network security vulnerabilities and exposures. The CVE list assigns a unique identifier to each known vulnerability, aiming to help organizations and individuals identify and fix security issues in software. CVSS is a standardized framework for assessing the severity of software security vulnerabilities. CVSS measures the severity of vulnerabilities through a series of indicators and converts these indicators into a numerical score from 0 to 10, with the higher the score, the more severe the vulnerability. The test information may include the IP address and listening port of the listening side (test end). The listening side IP address and port information may be entered in the test system, and the test case may be generated by clicking on the test system. The test system may construct a penetration test case for penetration testing based on the test information, the target key information list, and the vulnerability exploitation information corresponding to each key information. The content of the penetration test case may include the target system type, target IP address, target port, target service type, target service version, CVE identifier, listening IP address, listening port number, and vulnerability exploitation information, etc. The generated penetration test case may be displayed in the form of a list on the system interface. The present invention aims to solve the problems of current manual penetration testing, which relies on experience, is inefficient, prone to human errors, and has high costs. By applying machine learning algorithms, the present invention improves the automation level of penetration testing, reduces the requirements for technology and experience in testing, and reduces unnecessary human and material consumption. By combining the machine learning model with the sniffing tool and the common penetration testing framework Metasploit, the method is guaranteed to have the ability to obtain information and implement penetration testing.At the same time, the use of common machine learning algorithms requires less data and can greatly shorten training time and reduce training costs.

[0109] In an example implementation, step S110 of collecting target information of a test target using a sniffing tool to obtain a target information file includes the following process:

[0110] Obtaining input test target information and sniffing configuration information associated with the test target;

[0111] Generate a sniffing test instruction based on the test target information and the sniffing configuration information; call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information;

[0112] The sniffing information is stored as an XML file to obtain the target information file.

[0113] In this example implementation, the tester can input the test target information and sniffing configuration information in the test interface, the test target information can include the IP address and port of the test target, the sniffing configuration information can be the sniffing mode of the configuration, and the test system automatically reads the test target information input and the sniffing configuration information of the configuration. Afterwards, the system judges the correctness of the format of the reading information, if the format is incorrect, a prompt box pops up to report the cause of the error, if the format is correct, information processing is performed, i.e., corresponding character strings are generated according to the sniffing mode or the sniffing mode name, and instructions (sniffing test instructions) for sniffing tool testing are generated in conjunction with the test target information. Afterwards, the test system automatically creates corresponding processes, and calls the sniffing tool (such as Nmap) to automatically execute the sniffing test instructions, and monitors the sniffing results. After the execution ends, the target information sniffed can be stored as an XML file form, and the target information is displayed in the test system interface. XML is a file format that allows data storage and exchange of self-defined tags, and is also a data format that Nmap supports. Based on this file storage form, subsequent key information screening process can be carried out.

[0114] In an example implementation, since the sniffed target information contains a lot of descriptive information and useless information, it is necessary to further screen the target information. In the manual screening process, it is necessary to rely on experience to judge which information is useful, which is easy to make mistakes and cause the problem of key information loss. Based on this, the step S120 of screening the content of the target information file based on the information tag in the target information file to obtain the target key information list includes the following process:

[0115] Traversing the content of the target information file, and filtering out content data of a data type corresponding to the tag feature based on the tag feature of the target information file to form a plurality of key information;

[0116] A plurality of key information are stored based on a table data structure to obtain the target key information list.

[0117] In this example implementation, key information screening is performed based on the characteristic that the target information file has information tags (i.e., tag features). Exemplarily, for the tag features of XML files, an automated screening process is designed, and the corresponding controls for the automated screening process can be developed to achieve automation, or the corresponding scripts can be inserted into the penetration test process to achieve automation. For generating a target information file (such as an XML file), the file content is traversed, and information such as the target IP address, target port, system type, service, product, product version, CVE identification, and CVSS score are obtained through tag features. For example, the target IP address, target port, and system type corresponding information are obtained respectively through the tag features IP, port, and os. The key information obtained by traversal is composed of data, forming multiple key information, each key information at least including the target port, target system type, target service, target product, and vulnerability identification. Preliminary storage is performed in DataFrame format. After the traversal is completed, the preliminary stored information is displayed in the form of a list on the system interface, and the test system automatically stores the data in the form of a CSV file to obtain a target key information list. CSV is a simple file format that can be used to store tabular data.

[0118] In some other examples, the machine learning model is a decision tree model. Before performing the penetration test, the machine learning model needs to be trained. The training process of the machine learning model includes the following process:

[0119] Build a training dataset based on Metasploit's Exploits module;

[0120] Dividing the training data set into data subsets based on the entropy of the training data set for the vulnerability exploit category until the entropy of each divided data subset is 0, and the training is completed;

[0121] Each of the data subsets and its corresponding vulnerability exploitation category is taken as a subtree to form the decision tree model.

[0122] In this example implementation, the training data set is used for model training, and the training data set can be constructed based on the Exploits module of Metasploit, which contains more than one thousand vulnerability exploits written in Ruby. The vulnerability exploit files are traversed, and the system type, CVE vulnerability, service and port data applicable to the vulnerability exploit are matched for each file using regular expressions, and are preliminarily stored through DataFrame. After the traversal is completed, all data are stored in the form of CSV files. In some embodiments, the training data set can be preprocessed, that is, the redundant spaces in the data set are deleted, the rows with default values ​​are deleted, the string data is converted into numerical data using a unique hot encoding or label encoding method, and the mapping relationship between the string and the numerical value is stored. Model training can use the training data set to train the decision tree model. Specifically, the maximum depth of the tree, the feature selection standard, the minimum number of split samples and the minimum number of leaf node samples are set. Four hyperparameters, using accuracy as an evaluation indicator, select the hyperparameter combination with the highest accuracy through grid search to achieve the best model effect. For the training data set, the data subsets of the training data set can be divided based on the entropy of the vulnerability exploitation category of the training data set until the entropy of each divided data subset is 0, and the training is completed. Specifically, the vulnerability exploitation category can be used as a model label, and the number of occurrences of each vulnerability exploitation category in each data subset divided based on the training data set is counted. Suppose there are m data in the data subset S, there are n different vulnerability exploitation categories, and the number of elements with vulnerability exploitation category i is m i , for each vulnerability exploit category, the probability of its occurrence in the data subset is P(i) = m i / m. The entropy of the data set can be calculated based on the probability of each vulnerability exploit category appearing in the data subset. The entropy of the data subset S is calculated as follows:

[0123]

[0124] Where n represents the total number of vulnerability exploit categories in the data subset, i represents the sequence number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset. According to the entropy calculation formula, when P(i) = 1, that is, m i = m, the entropy is 0. At this time, the data label categories in the data subset are the same and no further decision is required. If the entropy is not 0, the data subset needs to be further divided.

[0125] Exemplarily, if the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset;

[0126] For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset;

[0127] The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

[0128] In this example implementation, the data subsets can be further segmented by information gain, which is the difference in entropy before and after the data subsets are segmented. The larger the information gain, the better the segmentation effect. Exemplarily, the label features of the data subsets may include system type, CVE vulnerability identifier, service and port, etc. The data subsets can be further segmented based on each label feature, and the segmentation features are screened out from each of the label features based on the information gain of the data subsets before and after the segmentation, and the segmentation results of the segmentation features are used as the current segmentation results of the data subsets. Repeat the subset segmentation process until the subset entropy is 0 or there are no more features to be segmented, and the obtained subsets are merged as trained subtrees to obtain a decision tree model.

[0129] Exemplarily, the segmentation features can be screened by the following steps:

[0130] Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset;

[0131] Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation;

[0132] The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

[0133] In this example implementation, multiple segmented subsets can be obtained by segmenting the data subsets based on each label feature. For example, the data subsets are segmented based on the system type, that is, the data with the same system type is divided into a subset (the segmented subset), and the entropy of each segmented subset is calculated. Then, the entropy weight of the segmented subset is determined according to the proportion of the amount of data in the segmented subset in the data subset before segmentation, and the weighted entropy of each segmented subset is summed to obtain the entropy of the data subset S after segmentation. The information gain of the segmentation with the system type as the feature is determined based on the difference in entropy before and after the data subset is segmented. The calculation formula for the information gain of the data subset before and after segmentation is:

[0134]

[0135] Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation. Then, the label feature corresponding to the maximum information gain is selected as the segmentation feature of the data subset, and the current data subset is divided into several subsets. Repeat the above segmentation process for each subset until the obtained subset entropy is 0 or there are no more features to be segmented (that is, the data in the subset contains only one label feature), and the data set segmentation process is completed.

[0136] After the model training is completed through the above process, the trained model is exported to the PKL file format for saving, and the trained model is deployed to the automated penetration testing system. The PKL file format is often used to save trained model parameters in the fields of machine learning and deep learning. After the model is trained, the model parameters can be saved in a PKL file for subsequent use.

[0137] For example, the training process of the decision tree model is as follows Figure 2 As shown in the figure, first calculate the entropy of the data set. If the entropy is 0, it means that the vulnerability exploit categories of the data in the current data set are the same and no decision is required. Create a leaf node and return the corresponding vulnerability exploit category label. If the entropy is not 0, further division is performed, that is, the information gain of each feature is calculated, and the feature with the largest information gain is selected. The data set is divided into several subsets according to the feature, and the corresponding subtree is built for each subset. A leaf node is created to return the category label and the entropy of the subset is calculated. Then repeat the above process for each subset until the subset entropy is 0 or there are no more features to be divided. Finally, the subtrees are merged based on the order of data division and the decision tree is returned. At this point, the construction of the decision tree model is completed.

[0138] In an example implementation, the matching of vulnerability exploitation information of each key information in the target key information list based on the machine learning model in step S130 to obtain vulnerability exploitation information corresponding to each key information includes:

[0139] The target key information list is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to the decision rule until the leaf node of the decision tree model is moved to obtain vulnerability exploitation information of each key information.

[0140] In this example implementation, the target key information list is used as the input of the decision tree model. The decision tree model continuously performs node testing according to the rules generated by training, moves each key information to the appropriate child node until the leaf node, and finally obtains the corresponding vulnerability exploitation information (such as the vulnerability exploitation type or name corresponding to each key information).

[0141] In some example implementations, before matching vulnerability exploit information of each key information in the target key information list based on the machine learning model, the method further includes:

[0142] Deleting redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list;

[0143] Each key information in the preprocessed target key information list is encoded to obtain a corresponding numerical target key information list.

[0144] In this example implementation, before the target key information list is input into the model, unnecessary data (redundant data) can be deleted by information traversal, and data such as target IP, target port, system type and CVE are retained. If there is a row with a default value in the searched data, the data in the corresponding row is deleted to obtain a preprocessed target key information list. Since the trained model can only process numerical data, the string data in the preprocessed target key information list is encoded and converted into numerical data to obtain a numerical target key information list to facilitate data processing of the model. Exemplarily, different encoding methods are used for different features. For data with few categories such as system type, one-hot encoding is used for data conversion. For data with many types such as CVE identification, label encoding is used to store the mapping relationship between string and numerical data. Accordingly, for the data output by the model, the corresponding vulnerability exploitation file name (string data) can be obtained through encoding mapping (stored mapping relationship).

[0145] In some example implementations, executing the penetration test case in step S140 above includes:

[0146] In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case;

[0147] Generate a corresponding target test instruction based on the use case information of the target test case;

[0148] Call the msfconsole tool to execute the target test instructions to perform penetration testing.

[0149] In this example implementation, the target test case to be executed can be selected in the test interface for execution. The test system searches for the case information of the corresponding penetration test case according to the selected target test case. The case information can be the information when the test case is constructed, and the target test instruction is generated according to the case information. The test system automatically creates a process to execute the instruction, calls msfconsole for penetration, and returns the execution result to the system interface for display.

[0150] Furthermore, the execution of the penetration test case also includes: if the preliminary penetration test is successful, continuing in-depth testing until the test is completed; if the preliminary penetration test fails, automatically executing the remaining penetration test cases except the target test case until all the remaining penetration test cases are executed, and performing a security assessment of the test target based on the execution results.

[0151] In this example implementation, it is determined whether the preliminary test is successful based on the returned execution result. If the preliminary test is successful, a prompt is given that the preliminary penetration test is successful, such as a prompt of "obtaining call authority", and an instruction is selected or entered for in-depth testing to obtain more target information; if the preliminary test is unsuccessful, a prompt of "penetration failure" is given, and the system automatically ends the penetration test process, automatically executes all penetration test cases, analyzes the execution results, and performs a security assessment of the test target. In this example, the process will not be automatically ended if the penetration is successful. You can enter or select instructions, and the system executes instructions to perform subsequent in-depth tests, obtain more target information, and view further test results. The penetration test process will not end until the system interface button is clicked to actively end the test. During the automatic execution of the penetration test case, the test system traverses the generated penetration test cases, generates corresponding test instructions for each penetration test case, and creates a process execution instruction. Only when one test case is executed can the next test case be executed, and the results of each test case test are saved. After all penetration test cases are executed, determine whether there are vulnerabilities in the test target based on the test results. If so, provide detailed information about the vulnerability, such as CVE identification, service, version, and CVSS score, inform the tester of the location of the test target that needs to be repaired, and generate a test report.

[0152] In the present invention, the test target information is first obtained by sniffing, and then the key information is screened out as the input of the machine learning model, wherein the machine learning model is trained by the machine learning algorithm, the key information is input into the machine learning model, the model automatically processes the data, and finally obtains the vulnerability exploitation file encoding; according to the key information, vulnerability exploitation information, and monitoring information, a penetration test case for the test target is generated, and then the test case is automatically executed according to the user's selection, and the test result is obtained. Finally, the system can automatically execute all test cases and perform a security assessment on the test target according to the execution results.

[0153] The following is a specific example to illustrate the specific steps of an automated penetration testing method based on machine learning of the present invention. Figure 3 As shown, the following processes may be included:

[0154] (1) Sniff the test target and collect information about the test target (target information);

[0155] (2) Process the target information and filter out key information;

[0156] (3) Traverse the key information and delete unnecessary data and rows with default values; then encode the string type data and convert it into digital code through one-hot encoding and label encoding. Store the converted data and use it as input for the machine learning model in (4);

[0157] (4) Inputting the processing result of (3) into the trained algorithm model to select the best vulnerability exploit and obtain the best vulnerability exploit file name;

[0158] (5) Obtain monitoring side information, and generate penetration test cases based on the monitoring side information, key information, and the best vulnerability exploitation file;

[0159] (6) Select the penetration test case to be executed, create a process to execute the test case and return the preliminary test results. If the test is successful, go to (7); if the test fails, end the process and go to (8);

[0160] (7) Select or enter a command to conduct in-depth testing to obtain more target information;

[0161] (8) Automatically execute all penetration test cases, analyze the execution results, and conduct security assessment of the target;

[0162] At this point, the entire process of automated penetration testing has been completed, including information collection, vulnerability exploit matching, penetration test case generation and execution, and target security assessment.

[0163] At present, machine learning refers to an algorithm that enables computers to use data to improve their performance on a task without explicit programming. It is an important branch of artificial intelligence research. In recent years, the field of machine learning has developed rapidly, and many algorithms have been applied to the field of network security and have achieved good results. In the study of automated penetration testing technology, artificial intelligence technology is combined with penetration testing experience to realize automated penetration testing. However, most automated penetration tests are based on deep reinforcement learning, and there are problems such as large data demand, long training time and large consumption of computing resources. The present invention uses a machine learning algorithm as the basis for model construction, simulates the process of manual vulnerability exploitation selection, improves the efficiency of the test, and reduces the possibility of manual operation misjudging information. At the same time, compared with the method of deep reinforcement learning, the requirements for data, training resources and training time for model training are reduced, and the cost of training is greatly reduced. The present invention constructs instructions and creates processes through scripts, automatically calls tools to execute instructions, reduces the requirements for testers' familiarity with tools, reduces the difficulty of penetration testing, improves the degree of automation, and reduces the occurrence of possible mistakes in manual operation. The present invention processes the information collected by the sniffing tool and extracts the key information, which reduces the requirements for the professionalism and experience of the tester in information collection, reduces the possibility of incorrect extraction of key information, and also makes the information easier to read. The present invention can automatically generate and execute test cases, evaluate the security of the target, generate reports, and more intuitively display the real security situation of the test target, thereby improving the automation level of penetration testing.

[0164] Embodiment 2:

[0165] Based on the same inventive concept, the present invention also provides an automated penetration testing system based on machine learning, comprising:

[0166] The information collection module is used to collect target information of the test target using a sniffing tool to obtain a target information file;

[0167] A screening module, used for screening the content of the target information file based on the information tags in the target information file to obtain a target key information list;

[0168] An information matching module, used to match vulnerability exploitation information of each key information in the target key information list based on a machine learning model to obtain vulnerability exploitation information corresponding to each key information;

[0169] The penetration testing module is used to generate corresponding penetration testing cases based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, and execute the penetration testing cases.

[0170] In a possible implementation, the information collection module includes:

[0171] An information acquisition submodule, used to acquire input test target information and sniffing configuration information associated with the test target;

[0172] The sniffing submodule is used to generate a sniffing test instruction based on the test target information and the sniffing configuration information; and to call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information;

[0173] The information storage submodule is used to store the sniffing information as an XML file to obtain the target information file.

[0174] In a possible implementation, the screening module includes:

[0175] A tag filtering submodule, used to traverse the content of the target information file, and based on the tag features of the target information file, filter out content data of a data type corresponding to the tag features to form a plurality of key information;

[0176] The table storage submodule is used to store multiple key information based on the table data structure to obtain the target key information list.

[0177] In a possible implementation manner, each piece of key information includes at least a target port, a target system type, a target service, a target product, and a vulnerability identifier.

[0178] In a possible implementation, the machine learning model is a decision tree model, and the system further includes a model training module, which includes:

[0179] The dataset construction submodule is used to build a training dataset based on the Exploits module of Metasploit;

[0180] A subset division submodule, used to divide the data subsets of the training data set based on the entropy of the training data set for the vulnerability exploitation category, until the entropy of each divided data subset is 0, and the training is completed;

[0181] The decision tree forming submodule is used to take each of the data subsets and its corresponding vulnerability exploitation category as a subtree to form the decision tree model.

[0182] In a possible implementation manner, the subset division submodule is further used for:

[0183] If the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset;

[0184] For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset;

[0185] The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

[0186] In a possible implementation manner, the subset division submodule is further used for:

[0187] Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset;

[0188] Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation;

[0189] The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

[0190] In a possible implementation manner, the information gain of the data subset before and after segmentation is calculated as follows:

[0191]

[0192] Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation;

[0193] The calculation formula of the entropy of the data subset is:

[0194]

[0195] Where n represents the total number of vulnerability exploit categories in the data subset, i represents the ordinal number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset.

[0196] In a possible implementation manner, the information matching module is specifically used to:

[0197] The target key information is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to a decision rule until it moves to a leaf node of the decision tree model to obtain vulnerability exploitation information of each key information.

[0198] In a possible implementation, the system further includes:

[0199] A preprocessing module, used to delete redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list;

[0200] The encoding module is used to encode each key information in the preprocessed target key information list to obtain a corresponding numerical target key information list.

[0201] In a possible implementation, the penetration testing module is further used to:

[0202] In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case;

[0203] Generate a corresponding target test instruction based on the use case information of the target test case;

[0204] Call the msfconsole tool to execute the target test instructions to perform a preliminary penetration test.

[0205] In a possible implementation, the penetration testing module is further used to:

[0206] If the initial penetration test is successful, continue with in-depth testing until the test is completed;

[0207] If the preliminary penetration test fails, the remaining penetration test cases except the target test case are automatically executed until all the remaining penetration test cases are completed, and a security assessment of the test target is performed based on the execution results.

[0208] Embodiment 3:

[0209] like Figure 4 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0210] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to implement the steps of an automated penetration testing method based on machine learning in the above-mentioned embodiment.

[0211] Example 4

[0212] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It is understandable that the storage medium here can include both built-in storage media in the electronic device and, of course, extended storage media supported by the electronic device. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of an automated penetration testing method based on machine learning in the above embodiment.

[0213] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0215] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0216] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0217] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. An automated penetration testing method based on machine learning, characterized in that: include: Use the sniffing tool to collect target information of the test target and obtain the target information file; Filter the content of the target information file based on the information tags in the target information file to obtain a target key information list; Match vulnerability exploitation information of each key information in the target key information list based on the machine learning model to obtain vulnerability exploitation information corresponding to each key information; Based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, a corresponding penetration test case is generated, and the penetration test case is executed.

2. The method according to claim 1, characterized in that: The target information of the test target is collected by using the sniffing tool to obtain the target information file, including: Obtaining input test target information and sniffing configuration information associated with the test target; Generate a sniffing test instruction based on the test target information and the sniffing configuration information; call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information; The sniffing information is stored as an XML file to obtain the target information file.

3. The method according to claim 2, characterized in that The content screening of the target information file based on the information tags in the target information file to obtain a target key information list includes: Traversing the content of the target information file, and filtering out content data of a data type corresponding to the tag feature based on the tag feature of the target information file to form a plurality of key information; A plurality of key information are stored based on a table data structure to obtain the target key information list.

4. The method according to claim 3, characterized in that Each key information includes at least the target port, target system type, target service, target product and vulnerability identification.

5. The method according to claim 1, characterized in that The machine learning model is a decision tree model, and the training process of the machine learning model includes: Build a training dataset based on Metasploit's Exploits module; Dividing the training data set into data subsets based on the entropy of the training data set for the vulnerability exploit category until the entropy of each divided data subset is 0, and the training is completed; Each of the data subsets and its corresponding vulnerability exploitation category is taken as a subtree to form the decision tree model.

6. The method according to claim 5, characterized in that The training process of the machine learning model also includes: If the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset; For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset; The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

7. The method according to claim 6, characterized in that The step of selecting a segmentation feature from each of the label features based on the information gain of the data subset before and after segmentation includes: Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset; Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation; The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

8. The method according to claim 7, characterized in that The calculation formula of the information gain of the data subset before and after segmentation is: Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation; The calculation formula of the entropy of the data subset is: Where n represents the total number of vulnerability exploit categories in the data subset, i represents the ordinal number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset.

9. The method according to claim 5, characterized in that The matching of vulnerability exploitation information of each key information in the target key information list based on the machine learning model to obtain vulnerability exploitation information corresponding to each key information includes: The target key information list is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to the decision rule until the leaf node of the decision tree model is moved to obtain vulnerability exploitation information of each key information.

10. The method according to any one of claims 1 to 9, characterized in that: Before matching vulnerability exploitation information of each key information in the target key information list based on the machine learning model, the method further includes: Deleting redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list; Each key information in the preprocessed target key information list is encoded with respect to a character string to obtain a corresponding numerical target key information list.

11. The method according to claim 1, characterized in that The executing of the penetration test case includes: In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case; Generate a corresponding target test instruction based on the use case information of the target test case; Call the msfconsole tool to execute the target test instructions to perform a preliminary penetration test.

12. The method according to claim 11, characterized in that The execution of the penetration test case also includes: If the initial penetration test is successful, continue with in-depth testing until the test is completed; If the preliminary penetration test fails, the remaining penetration test cases except the target test case are automatically executed until all the remaining penetration test cases are completed, and a security assessment of the test target is performed based on the execution results.

13. An automated penetration testing system based on machine learning, characterized in that: include: The information collection module is used to collect target information of the test target using a sniffing tool to obtain a target information file; A screening module, used for screening the content of the target information file based on the information tags in the target information file to obtain a target key information list; An information matching module, used to match vulnerability exploitation information of each key information in the target key information list based on a machine learning model to obtain vulnerability exploitation information corresponding to each key information; The penetration testing module is used to generate corresponding penetration testing cases based on the acquired test information, the target key information list and the vulnerability exploitation information corresponding to each key information, and execute the penetration testing cases.

14. The system according to claim 13, characterized in that The information collection module includes: An information acquisition submodule, used to acquire input test target information and sniffing configuration information associated with the test target; The sniffing submodule is used to generate a sniffing test instruction based on the test target information and the sniffing configuration information; and to call the Nmap tool to automatically execute the sniffing test instruction to obtain sniffing information; The information storage submodule is used to store the sniffing information as an XML file to obtain the target information file.

15. The system according to claim 14, characterized in that The screening module comprises: A tag filtering submodule, used to traverse the content of the target information file, and based on the tag features of the target information file, filter out content data of a data type corresponding to the tag features to form a plurality of key information; The table storage submodule is used to store multiple key information based on the table data structure to obtain the target key information list.

16. The system according to claim 15, characterized in that Each key information includes at least the target port, target system type, target service, target product and vulnerability identification.

17. The system according to claim 13, characterized in that The machine learning model is a decision tree model. The system further includes a model training module, which includes: The dataset construction submodule is used to build a training dataset based on the Exploits module of Metasploit; A subset division submodule, used to divide the data subsets of the training data set based on the entropy of the training data set for the vulnerability exploitation category, until the entropy of each divided data subset is 0, and the training is completed; The decision tree forming submodule is used to take each of the data subsets and its corresponding vulnerability exploitation category as a subtree to form the decision tree model.

18. The system according to claim 17, characterized in that The subset division submodule is also used for: If the entropy of the data subset is not 0, performing subset segmentation of the data subset based on each label feature in the data subset; For the segmentation result of each label feature, a segmentation feature is screened out from each label feature based on the information gain of the data subset before and after segmentation, and the segmentation result of the segmentation feature is used as the current segmentation result of the data subset; The subset segmentation process is repeated until the entropy of the segmentation result is 0 or the segmentation result is a single label feature.

19. The system according to claim 18, characterized in that The subset division submodule is also used for: Determine the entropy weight of each segmented subset based on the proportion of the data volume of each segmented subset in the data volume of the data subset before segmentation, and determine the entropy of the data subset after segmentation based on the entropy weight of each segmented subset and the entropy of the corresponding segmented subset; Determining the information gain of the data subset before and after segmentation based on the difference in entropy between the data subset before and after segmentation; The label feature corresponding to the maximum value of the information gain is selected as the segmentation feature.

20. The system according to claim 19, characterized in that The calculation formula of the information gain of the data subset before and after segmentation is: Where IG represents the information gain of the data subset before and after segmentation, S represents the data subset before segmentation, H(S) represents the entropy of the data subset before segmentation, |S| represents the size of the data subset before segmentation, k represents the number of subsets after segmentation, |S j | represents the size of the jth subset after segmentation, H(S j ) represents the entropy of the jth subset after segmentation; The calculation formula of the entropy of the data subset is: Where n represents the total number of vulnerability exploit categories in the data subset, i represents the ordinal number of the vulnerability exploit category, and P(i) represents the proportion of the data volume of the i-th vulnerability exploit category in the data subset.

21. The system according to claim 17, characterized in that The information matching module is specifically used for: The target key information is input into the decision tree model, and a decision test is performed at each node of the decision tree model according to a decision rule until it moves to a leaf node of the decision tree model to obtain vulnerability exploitation information of each key information.

22. The system according to any one of claims 13 to 21, characterized in that: The system further comprises: A preprocessing module, used to delete redundant data and rows corresponding to default values ​​from the target key information list to obtain a preprocessed target key information list; The encoding module is used to encode each key information in the preprocessed target key information list to obtain a corresponding numerical target key information list.

23. The system according to claim 13, characterized in that The penetration testing module is also used to: In response to a selection operation on a control corresponding to a target test case in a test interface, searching for use case information of the target test case; Generate a corresponding target test instruction based on the use case information of the target test case; Call the msfconsole tool to execute the target test instructions to perform a preliminary penetration test.

24. The system according to claim 23, characterized in that The penetration testing module is also used to: If the initial penetration test is successful, continue with in-depth testing until the test is completed; If the preliminary penetration test fails, the remaining penetration test cases except the target test case are automatically executed until all the remaining penetration test cases are completed, and a security assessment of the test target is performed based on the execution results.

25. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the automated penetration testing method based on machine learning as described in any one of claims 1 to 12 is implemented.

26. A readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, the automated penetration testing method based on machine learning as described in any one of claims 1 to 12 is implemented.

Images