Network penetration testing method and system based on state feedback

Abstract

The invention provides a network penetration testing method and system based on state feedback, and belongs to the field of computer security detection.The method comprises the steps that vulnerability information is collected, and a vulnerability database is constructed; performing vulnerability attribute identification according to the vulnerability database, and matching penetration test conditions based on an identification result; matching the penetration test condition with a preset penetration test condition template for the target environment through LLM, if matching succeeds, judging that the target environment meets a vulnerability utilization condition, selecting a test condition meeting the vulnerability, and starting a corresponding penetration test process; executing a penetration test according to the generated test plan by using a state machine, and judging the test effect and the accuracy of state conversion through a feedback mechanism; and according to test feedback, the rule or condition template in the matching process is further optimized. The method does not need to preset a large number of rules and test cases to match the state, and can judge the test effect and the accuracy of state conversion through a feedback mechanism.

Description

Technical Field

[0001] The invention belongs to the technical field of computer security detection, and in particular relates to a network penetration testing method and system based on state feedback. Background Art

[0002] As my country enters a "new era of cybersecurity," it is also facing more severe security risks. With the development of Internet technology, global cybersecurity incidents have occurred frequently, data leaks, business interruptions, factory shutdowns, etc. have occurred from time to time, and the cybersecurity situation remains severe and even more complicated.

[0003] Security comes from being prepared. As an important means of actively detecting network vulnerabilities and preventing network attacks, penetration testing technology can timely discover the vulnerabilities of the target network system and repair and reinforce them in a targeted manner. At present, penetration testing mainly relies on manual work, which has high technical requirements for testers and huge costs. There are two technical routes for implementing existing penetration testing methods. One is to use workflow engine technology to connect the automation process in series. This method mainly uses the workflow engine to set the task template of the penetration test, and designs targeted use cases for the test environment, so as to drive the entire process of automated penetration testing according to the preset template. This test method requires the design of a large number of test cases for different types of test targets. The second is to use fixed processes and feature matching to perform automated penetration testing. This method mainly matches the data returned during the test with the pre-set test script library by solidifying the test process and defining the test action, and executes the corresponding script that matches successfully. If there is no corresponding script, it will enter the next link until the test process is completed. The test process of this technology has been pre-solidified, and the applicability of the test is limited. Summary of the invention

[0004] In order to solve the problem that the existing testing method needs to design a large number of test cases for different types of test targets and the existing test process is pre-solidified, which limits the applicability of the test, the present invention provides a network penetration testing method based on state feedback.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A network penetration testing method based on state feedback, comprising:

[0007] Collect vulnerability information from search engines and public data, and build a vulnerability database;

[0008] Identify vulnerability attributes according to the vulnerability database, and match penetration test conditions based on the vulnerability attribute identification results;

[0009] The penetration test conditions are matched with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful, it is judged that the target environment meets the vulnerability exploitation conditions, then the test conditions that meet the vulnerability are selected and the corresponding penetration test process is started; the matching results of the vulnerability attributes and the test conditions are output, and a specific test plan is generated for the penetration test; the state machine is used to perform the penetration test according to the generated test plan, and the test effect and the accuracy of the state transition are judged through the feedback mechanism;

[0010] Based on the test feedback, further optimize the rules or condition templates in the matching process.

[0011] Preferably, the collecting of vulnerability information from search engines and public data and building of a vulnerability database is specifically as follows:

[0012] Knowledge is extracted based on the correspondence between the search engine and the vulnerability knowledge base ontology, and the extracted knowledge is stored in the graph database in the form of RDF;

[0013] With the help of the performance of the large language model LLM in the named entity recognition (NER) task, one of the subtasks of natural language processing (NLP), the named entities describing the vulnerabilities are extracted from the unstructured data of vulnerability descriptions, and the named entities are aligned with the knowledge extraction part in the graph database to finally form a vulnerability knowledge base.

[0014] Preferably, the vulnerability attribute identification is performed according to the vulnerability database, and the penetration test conditions are matched based on the vulnerability attribute identification results, specifically:

[0015] Based on the specific information of each vulnerability, vulnerability attribute identification is performed to analyze the key features of the vulnerability; the identified vulnerability attributes are marked and classified, and the penetration test conditions are matched according to the classification results.

[0016] Preferably, the key features of the vulnerability include vulnerability type, exploitation conditions, system components or services affected by the vulnerability, complexity of vulnerability exploitation, and possible consequences; matching is to compare the identified vulnerability attributes with the penetration test conditions to determine whether the requirements for performing the penetration test are met.

[0017] Preferably, the method also includes establishing test templates with different conditions in the penetration testing system, each template matching a specific vulnerability type or attribute.

[0018] Preferably, the state machine is used to perform the penetration test according to the generated test plan, and the test effect and the accuracy of the state transition are judged through the feedback mechanism, specifically:

[0019] The state of the current target scenario is determined through a large language model, and penetration path planning is performed based on the state. The penetration test task is divided into multiple subtasks, and multiple substates are set for the system.

[0020] The state machine is used to treat each scenario after the completion of the penetration test as a state, and each execution of the penetration test step is a transition between states; after each state transition, it is judged whether the current transition is correct. If it is converted to an incorrect state, the state is rolled back through the feedback mechanism, and a more appropriate step is decided to guide the current state to transition to the correct state.

[0021] Preferably, the state machine is used to treat each scene after the completion of the penetration test as a state, and each execution of the penetration test step is a transition between states; after each state transition, it is judged whether the current transition is correct. If it is converted to an incorrect state, the state is rolled back through the feedback mechanism, and a more appropriate step is decided to guide the current state to the correct state, which specifically includes:

[0022] Construct a state machine for penetration testing tasks: Based on the principle of automata, the penetration testing task is broken down into several subtasks and a state machine is constructed; each subtask is a system state in the state machine, and these states are defined and organized according to the requirements of the penetration test;

[0023] The system status is generated based on the large language model LLM. LLM understands the penetration test task as multiple subtasks and constructs multiple system states;

[0024] Construct state transition events and functions: define the transitions between system states and construct state transition events through a series of operations; each transition event is a trigger for the transition from one state to another, representing the operation performed by the system or the command executed;

[0025] Through capability decision and intention matching, appropriate operations are selected for each subtask, and the state transition function F:S×A→S is defined and constructed, that is, when the system is in state s i When action a is executed, the system transitions to state s j ;

[0026] The system feeds back the executed action set {op_1, op_2, …, op_n} to LLM, which determines the system state transition mode based on the results and adjusts subsequent operations;

[0027] Construct and simulate the penetration path: Based on the state transition of the state machine, construct a complete set of actions from the initial state to the final state to form a penetration path;

[0028] Based on the construction of the penetration path, simulate the security protection strength, penetration success probability and expected effect of different paths, and choose the path with high risk and strong feasibility;

[0029] Build targeted testing strategies based on different penetration paths; each step includes attack techniques, tools, scripts and trigger conditions;

[0030] Execution of action set and result feedback: Use the generated action set to automatically execute the operations in the penetration test path and feed back the system response results to LLM;

[0031] LLM analyzes the system's response, updates the current status and adjusts subsequent paths and operations to achieve the best penetration testing results.

[0032] Preferably, when there are multiple vulnerabilities in the target environment, a vulnerability exploitation state machine is constructed for multiple vulnerabilities to perform vulnerability discovery and risk assessment, specifically:

[0033] For multiple vulnerable scenarios, the penetration test exploit state machine further constructs a composite exploit state machine ESM for scenarios with multiple vulnerabilities; suppose there are two ESMs from two vulnerabilities, where ESM1 = <s1,a1,f1,s 01 ,se1>,ESM2= <s2,a2,f2,s 02 ,se2>; For each state transition F ij2 :(s i ,a)→s j In ESM2, if s i and j If they are new in s1, add them to s1; otherwise, add a to a1; finally, add an entry F to f1 ij1 :(s i ,a)→s j , to connect to the s in ESM1 i and j ,Through the multi-level transition simulation of the state machine, the deep vulnerabilities of the target system are explored;

[0034] Among them, s1 represents the state set in ESM1, s2 represents the state set in ESM2, a1 represents the action set in ESM1, a2 represents the action set in ESM2, f1 represents the transition function set in ESM1, f2 represents the transition function set in ESM2, s 01 represents the initial state in ESM1, s 02 represents the end state in ESM1, se1 represents the initial state in ESM2, and se2 represents the end state in ESM2.

[0035] The present invention also provides a network penetration testing system based on state feedback, comprising:

[0036] Database construction module, used to collect vulnerability information from search engines and public data, and build a vulnerability database;

[0037] The condition matching module is used to identify vulnerability attributes according to the vulnerability database and match the penetration test conditions based on the vulnerability attribute identification results;

[0038] The process initiation module is used to match the penetration test conditions with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful and the target environment is judged to meet the vulnerability exploitation conditions, the test conditions that meet the vulnerability are selected and the corresponding penetration test process is initiated;

[0039] The state feedback module is used to output the matching results between vulnerability attributes and test conditions, generate a specific test plan for penetration testing, use the state machine to perform penetration testing according to the generated test plan, and judge the test effect and the accuracy of state transition through the feedback mechanism;

[0040] The condition optimization module is used to further optimize the rules or condition templates in the matching process based on test feedback.

[0041] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is loaded by a processor, it can execute any one of the steps in the network penetration testing method based on state feedback.

[0042] The network penetration testing method based on state feedback provided by the present invention has the following beneficial effects:

[0043] The present invention uses a large language model to intelligently judge the state of the current target scenario according to the current situation, so there is no need to match the state by presetting a large number of rules and test cases. The state machine is used to perform penetration testing according to the generated test plan, and the test effect and the accuracy of state conversion are judged through the feedback mechanism, which enables the system to dynamically adapt to complex changes in the target environment and automatically select the optimal test path for different target environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1This is a flow chart of a network penetration testing method based on state feedback according to Embodiment 1 of the present invention.

[0046] Figure 2 A flowchart for building a vulnerability knowledge base;

[0047] Figure 3 A planning flowchart for the test path;

[0048] Figure 4 A schematic diagram of the HNSW algorithm provided in Example 1 of the present invention;

[0049] Figure 5 A schematic diagram of a state machine for penetration testing provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0051] Example 1

[0052] The existing penetration test engine path planning is a random walk, and the target is vague. In addition, the existing solutions are strictly executed according to the manually preset process chain, and the penetration strategy is rigid; the outputs of multiple calls are inconsistent, and model alignment is difficult. Based on this phenomenon, the present invention hopes that the penetration test engine can dynamically plan the next step to be taken based on the results of the previous step, rather than relying on manual presets. If there are multiple options for the next step, the model can dynamically select the optimal path based on existing knowledge. Therefore, the present invention proposes a penetration test method that can automatically deduce, dynamically plan the penetration test path in real time, and penetrate the target system. The purpose is to utilize the core features such as the vulnerability knowledge base, state machine transfer, and intelligent result feedback built around the knowledge graph to automatically generate, execute and adjust the penetration test path of the target system to optimize the penetration test efficiency and improve the penetration test accuracy and success rate.

[0053] Based on this, the present invention provides a network penetration testing method based on state feedback, such as Figure 1 As shown, including:

[0054] S1: Collect vulnerability information from search engines and public data, and build a vulnerability database.

[0055] In one embodiment, S1 specifically includes:

[0056] S11: Knowledge extraction is performed based on the correspondence between NVD’s data transfer and the vulnerability knowledge base ontology. The extracted knowledge is represented in the form of a resource description framework (RDF) and stored in a graph database. NVD is a comprehensive vulnerability database maintained by the National Institute of Standards and Technology (NIST) of the United States, which aims to collect, share and distribute information about security vulnerabilities in computer software and hardware. One of the main goals of NVD is to provide a comprehensive and timely vulnerability information base to help security professionals better understand and manage known vulnerabilities. This helps:

[0057] 1. Vulnerability identification and management: NVD collects and displays vulnerability information in various software and hardware. This information includes the severity of the vulnerability, the scope of impact, possible solutions, and related references. This enables enterprises and organizations to identify and appropriately manage vulnerabilities that may affect their systems and applications early.

[0058] 2. Security patch release: Manufacturers and developers can create and release patches for their products by referring to the vulnerability information in NVD. This helps to fix vulnerabilities, improve the security of systems and software, and reduce the risk of attacks.

[0059] 3. Vulnerability Research: Security researchers can use information from NVD to gain insight into how different vulnerabilities work, thereby better understanding attack techniques and developing corresponding defense strategies.

[0060] 4. Decision support: Enterprises and governments can develop security strategies, risk assessments, and vulnerability remediation plans based on the information in the NVD to protect their critical information infrastructure.

[0061] Specifically, for example, step S11 specifically includes: extracting information such as vulnerability name (Name), vulnerability description (Description), related vulnerability (Related Weakness), common consequences (Common Consequences), detection methods (Detection Methods) and mitigation measures (Potential Mitigations) through search engines and from publicly available information, and representing the extracted knowledge in RDF form and storing it in a graph database. Resources and properties in RDF are identified by URIs, and an example of the URI format in the vulnerability knowledge base is shown above.

[0062] S12: With the help of the excellent performance of the large language model LLM in the named entity recognition (NER) task, one of the subtasks of natural language processing (NLP), knowledge is extracted from the unstructured data of vulnerability descriptions, and the content of the identified entities is aligned with the knowledge extraction part to finally form a vulnerability knowledge base.

[0063] The exploitation of different vulnerabilities requires specific conditions to be met. For example, some vulnerabilities require certain access rights, specific operating system versions, specific network conditions, etc. In other words, the exploitation of some vulnerabilities requires the satisfaction of certain prerequisites. In this step, matching the vulnerabilities in the vulnerability database with the exploitation conditions can help screen out vulnerabilities that meet the target environment and ensure that the screened vulnerabilities have the possibility of being exploited in the target environment.

[0064] Step S12 specifically includes: Figure 2 , and further use LLM to perform named entity recognition (NER) tasks for vulnerability descriptions. The relationships between different vulnerability-related concepts are predefined in the vulnerability knowledge base. Among them, the vulnerability ontology is described by Web Ontology Language (OWL). The Vulnerability class is an abstraction of all specific vulnerability objects. In the vulnerability knowledge base, CVE is an instance of the Vulnerability class. The Weakness class is an abstraction of all specific vulnerability objects. The CWE object is an instance of the Weakness class. Subsequently, the output entities of NER are aligned with the entities in the graph database, and together they form a vulnerability knowledge base, that is, a vulnerability knowledge base built with the knowledge graph as the core.

[0065] S2: Identify vulnerability attributes according to the vulnerability database, and match penetration test conditions based on the vulnerability attribute identification results.

[0066] The present invention provides a target penetration test network environment. According to the specific environmental information of the penetration test target (such as system architecture, software version, network topology, etc.), the vulnerability database matches the vulnerabilities that meet the target environment and screens out potential vulnerabilities that may exist. The exploitation of different vulnerabilities needs to meet specific conditions, such as certain access rights, specific versions of the operating system, specific network conditions, etc. In this step, it is necessary to further match the preconditions for vulnerability exploitation to ensure that the screened vulnerabilities have the possibility of exploitation in the target environment. The present invention associates the information in the vulnerability knowledge base with FilterRAG and Graph RAG, and constructs a feature mapping relationship to match the penetration test conditions. Specifically, Filter RAG uses a Chinese-friendly embedding model that has been optimized through rapid search on the MTEB rankings of huggingface for knowledge embedding, namely gte-Qwen2-7B-instruct. At the same time, in terms of vector indexing, FilterRAG uses an algorithm faiss that is optimized for indexing 10,000+ elements, and further enables approximate nearest neighbor implementations, such as the Hierarchical Navigable Small Worlds (HNSW) algorithm. Figure 4 As shown in the figure, to further improve indexing efficiency, Filter RAG's vector library also stores metadata information and enables metadata filters to accelerate indexing. Based on the impact range, exploit difficulty, and completeness of condition matching of the vulnerability, a sorted vulnerability priority list is generated to provide a basis for subsequent penetration test path planning. Filter RAG and Graph RAG are two different information retrieval and representation methods.

[0067] Filter RAG can filter entries that match specific vulnerability attributes from the vulnerability database to help locate vulnerabilities that match target characteristics (such as specific vulnerability types or risk levels). Doing so can improve vulnerability identification efficiency and provide accurate data support for subsequent testing decisions. Graph RAG can help build an association graph between vulnerabilities and test conditions and identify the dependencies between various conditions. For example, the system can use the graph structure of Graph RAG to find the combined path between different conditions, thereby more accurately matching the penetration test environment and vulnerability exploitation conditions. This is very helpful for automated decision-making and recommendations.

[0068] In one embodiment, S2 specifically includes:

[0069] S21: For the specific information of each vulnerability, perform vulnerability attribute identification and analyze the key features of the vulnerability. Vulnerability attribute identification is to refine and describe the collected information, including the type of vulnerability (such as buffer overflow, SQL injection, XSS, etc.), the system or service affected by the vulnerability, the conditions and complexity of the vulnerability, the required permission level, and the possible consequences (such as information leakage, remote code execution, etc.). The process of identifying vulnerability attributes helps the penetration testing system understand the characteristics of specific vulnerabilities so that it can more effectively select and match appropriate penetration testing conditions. For example, if the vulnerability attributes show that the vulnerability requires specific permissions, the system can determine whether this condition is met in the current test environment, and decide whether to perform related penetration testing actions based on this. "Matching" refers to comparing the identified vulnerability attributes with the penetration testing conditions to determine whether the requirements for performing a penetration test are met.

[0070] S22: Mark and classify the identified vulnerability attributes for subsequent condition matching.

[0071] Labels are set for the key attributes of each type of vulnerability (such as "remote exploitation", "local permission requirement", "Web application vulnerability", etc.) to provide structured data support for subsequent matching conditions.

[0072] S23: Establish test templates with different conditions in the penetration test system, and each template matches a specific vulnerability type or attribute. The conditional templates include: permission requirements, network topology requirements, configuration requirements of the target system, specific tool or script requirements, etc.

[0073] S3: Match the penetration test conditions with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful, it is judged that the target environment meets the vulnerability exploitation conditions, then select the test conditions that meet the vulnerability and start the corresponding penetration test process; output the matching results of the vulnerability attributes and the test conditions, and generate a specific test plan for the penetration test; the plan includes detailed conditions such as test objectives, steps, tools, and related permissions. Use the state machine to perform the penetration test according to the generated test plan, and judge the effect of the test and the accuracy of the state transition through the feedback mechanism. Establish test templates with different conditions in the penetration test system, and each template matches a specific vulnerability type or attribute. The condition templates include: permission requirements, network topology requirements, configuration requirements of the target system, specific tool or script requirements, etc.

[0074] The state machine is used to perform penetration testing according to the generated test plan, and the test effect and the accuracy of state transition are judged through the feedback mechanism, specifically:

[0075] The state of the current target scenario is determined through a large language model, and penetration path planning is performed based on the state. The penetration test task is divided into multiple subtasks, and multiple substates are set for the system.

[0076] The state machine is used to treat each scenario after the completion of the penetration test as a state. Each execution of the penetration test step is a transition between states. After each state transition, it is judged whether the current transition is correct. If it is converted to an incorrect state, the state is rolled back through the feedback mechanism, and a more appropriate step is decided to guide the current state to the correct state. The details are as follows:

[0077] Construct a state machine for penetration testing tasks: Based on the principle of automata, the penetration testing task is broken down into several subtasks and a state machine is constructed; each subtask is a system state in the state machine, and these states are defined and organized according to the requirements of the penetration test;

[0078] The system status is generated based on the large language model LLM. LLM understands the penetration test task as multiple subtasks and constructs multiple system states;

[0079] Construct state transition events and functions: define the transitions between system states and construct state transition events through a series of operations; each transition event is a trigger for the transition from one state to another, representing the operation performed by the system or the command executed;

[0080] Through capability decision and intention matching, appropriate operations are selected for each subtask, and the state transition function F:S×A→S is defined and constructed, that is, when the system is in state s i When action a is executed, the system transitions to state s j ;

[0081] The system feeds back the executed action set {op_1, op_2, …, op_n} to LLM, which determines the system state transition mode based on the results and adjusts subsequent operations;

[0082] Construct and simulate the penetration path: Based on the state transition of the state machine, construct a complete set of actions from the initial state to the final state to form a penetration path;

[0083] Based on the construction of the penetration path, simulate the security protection strength, penetration success probability and expected effect of different paths, and choose the path with high risk and strong feasibility;

[0084] Build targeted testing strategies based on different penetration paths; each step includes attack techniques, tools, scripts and trigger conditions;

[0085] Execution of action set and result feedback: Use the generated action set to automatically execute the operations in the penetration test path and feed back the system response results to LLM;

[0086] LLM analyzes the system's response, updates the current status and adjusts subsequent paths and operations to achieve the best penetration testing results.

[0087] In one embodiment, if Figure 3 and Figure 5 As shown, S3 includes:

[0088] S31: Using the principle of automata, the penetration test task is disassembled and constructed into an exploit state machine. Using the condition matching provided in the previous step, the available tools and scripts are marked for each subtask to speed up the subsequent testing process. Common vulnerability scanning and exploitation tools such as Metasploit, Nmap, and Nessus can be associated, or custom exploitation scripts can be built for specific vulnerabilities. Based on the identified vulnerabilities, possible penetration paths are planned. Different paths may vary depending on the attack surface and vulnerability. Path planning can include penetration paths from the external attack surface to the internal network, as well as paths for further lateral movement in the internal network. For the same key target (such as the core database), there are often multiple paths to choose from.

[0089] S32: System state (a node in the state machine, the state of the target scenario being penetrated at a specific moment) represents the condition or configuration of the system at a specific moment during the penetration test. Including: initial state, receiving input state, information leakage state, parsing error state, command injection state, etc. These states are generated by the base LLM. By understanding the penetration test task, LLM divides the task into multiple subtasks in RefinerAgent and sets multiple substates for the system. The final end state is the state of obtaining system control authority. Here, a system may have multiple end states.

[0090] A transition is an event in which a system changes from one state to another, that is, one or more operations (an operation set) on the system. For example: inputting a piece of data into the system, executing a function of the system, triggering a specific function of the system. The system obtains the action / command (set) to be executed through the operation of capability decision and secondary screening based on subtask intention matching. After extracting all states and actions, construct the state transition function F:S×A→S. For the running state s i to j Action A, which adds an entry F ij :(s i ,a)→s j to F. The action is a sequence of operations {op1, op2, ..., opn The system automatically executes this action and feeds the result back to LLM for understanding. LLM determines the state transition mode of the target system of the penetration test after executing the action. According to the above logic, a complete set of actions from the initial state to the end state of the penetration test can be obtained.

[0091] S33: Use the action set obtained in S32 to simulate the path in the penetration path constructed in S31. By comparing the security protection strength, penetration success probability and expected effect of different paths, select the path with high risk and strong feasibility. According to different attack penetration test paths, build corresponding test strategies, consider the attack methods, exploit tools, exploit scripts and triggerable conditions of each step to ensure the continuity and effectiveness of the operation. According to the requirements of each step in the penetration path, select appropriate automation tools and scripts, and optimize them according to the uniqueness of the target environment. Try to automate the attack process of the penetration test to reduce manual operations and improve the efficiency and coverage of the test.

[0092] When there are multiple vulnerabilities in the target environment, a vulnerability exploitation state machine is constructed for multiple vulnerabilities to perform vulnerability discovery and risk assessment. Specifically: In many scenarios, there are often multiple attack surfaces. Different vulnerabilities are combined according to their dependencies to form a vulnerability chain. For example, some medium- and low-risk vulnerabilities can be used as prerequisites for high-risk vulnerabilities, thereby improving the overall attack effect. For different penetration targets, a combination of exploitation strategies is designed to achieve specific goals. For example, initial access is obtained through a low-privilege vulnerability, and then a privilege escalation vulnerability is used to obtain higher permissions, ultimately achieving the goal of fully controlling the target system. Based on the description of multiple vulnerable scenarios, a composite ESM for multiple attack surfaces can be constructed based on the single exploitation state machine mode of S3. Assume that there are two ESMs (ESM1 = <s1,a1,f1,s 01 ,se1> and ESM2= <s2,a2,f2,s 02 ,se2>) comes from two vulnerabilities. For each state transition F ij2 :(s i ,a)→s j In ESM2, if s i and j If they are new in s1, add them to s1. Otherwise, add a to a1. Finally, add an entry F to f1. ij1 :(s i ,a)→s j , to connect to the s in ESM1 i and j Through the multi-level transfer simulation of the state machine, the deep-level vulnerabilities of the target system are explored.

[0093] S4, LLM analyzes the system's response, updates the current status and adjusts subsequent paths and operations to achieve the best penetration testing results.

[0094] The network penetration testing method based on state feedback provided by the present invention has the following beneficial effects:

[0095] (1) The present invention provides a network penetration testing method based on state feedback. By building a vulnerability knowledge base to mine the correlation between vulnerabilities, the present invention provides auxiliary information for autonomous planning of penetration test paths, so as to formulate subtask plans more scientifically and efficiently. For each subtask, the LLM alignment technology is used to generate a corresponding plan description. The automaton state transition principle is used to timely feedback and adjust the subtask planning strategy, thereby greatly improving the adaptability and generalization ability of penetration testing.

[0096] (2) Based on the vulnerability knowledge base construction method, the present invention extracts information such as vulnerability name, vulnerability description, related vulnerabilities, common consequences, detection methods and mitigation measures from search engines and public channels, and represents the extracted knowledge in RDF form and stores it in a graph database. It is convenient and efficient, simple to operate, and can quickly establish associations between vulnerabilities.

[0097] (3) The present invention associates the vulnerability information knowledge base with Filter RAG and Graph RAG to build a feature mapping relationship to match the penetration test conditions, which has an ultra-fast search speed. The vector library also stores metadata information and enables metadata filters to accelerate indexing, further improving indexing efficiency.

[0098] (4) The present invention uses the principle of automata to disassemble the penetration test task and construct it into an exploit state machine. It can handle various uncertainties involved in penetration planning, has real-time planning capabilities, and the planning process is flexible and accurate. The combination of multiple exploit automata can help find different penetration test methods and explore different penetration test paths.

[0099] (5) Reduce manual presetting: Compared with traditional methods that require a large number of presetting rules and test cases, this method relies on the context judgment ability of a large language model and reduces the reliance on presetting rules. This not only simplifies system maintenance, but also improves the system's adaptability in complex scenarios.

[0100] (6) Dynamic adaptability: Each execution of a penetration test step will generate a new state. By modeling the scenario through the state machine mechanism, the system can flexibly adjust the next operation based on the feedback. This allows the system to dynamically adapt to complex changes in the target environment and automatically select the optimal test path for different target environments.

[0101] (7) Error rollback and optimization: After executing the state transition, if the current state is found to be incorrect, the system can roll back and re-plan through the feedback mechanism. This mechanism not only improves the accuracy of the penetration test, but also reduces invalid operations caused by incorrect path selection, making the test more efficient and reasonable.

[0102] Example 2

[0103] Based on the same inventive concept, the present invention also provides a network penetration testing system based on state feedback, comprising:

[0104] The database construction module is used to collect vulnerability information from search engines and public materials and build a vulnerability database.

[0105] The condition matching module is used to identify vulnerability attributes according to the vulnerability database and match the penetration test conditions based on the vulnerability attribute identification results.

[0106] The process startup module is used to match the penetration test conditions with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful and the target environment is judged to meet the vulnerability exploitation conditions, the test conditions that meet the vulnerability are selected and the corresponding penetration test process is started.

[0107] The state feedback module is used to output the matching results between vulnerability attributes and test conditions, generate a specific test plan for penetration testing, use the state machine to perform penetration testing according to the generated test plan, and judge the test effect and the accuracy of state transition through the feedback mechanism.

[0108] The condition optimization module is used to further optimize the rules or condition templates in the matching process based on test feedback.

[0109] Each module in the above-mentioned network penetration testing system based on state feedback can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0110] Example 3

[0111] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, a non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, the steps in the embodiment of the network penetration testing method based on state feedback can be implemented. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0112] It will be appreciated by those skilled in the art that embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0113] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0114] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0115] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0116] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the patent for the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. A network penetration testing method based on state feedback, characterized in that: include: Collect vulnerability information from search engines and public data, and build a vulnerability database; Identify vulnerability attributes according to the vulnerability database, and match penetration test conditions based on the vulnerability attribute identification results; The penetration test conditions are matched with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful, it is judged that the target environment meets the vulnerability exploitation conditions, then the test conditions that meet the vulnerability are selected and the corresponding penetration test process is started; the state machine is used to perform the penetration test according to the generated test plan, and the test effect and the accuracy of the state transition are judged through the feedback mechanism; Based on the test feedback, further optimize the rules or condition templates in the matching process.

2. The network penetration testing method based on state feedback according to claim 1 is characterized in that: The vulnerability information is collected from search engines and public data, and a vulnerability database is constructed, specifically: Knowledge is extracted based on the correspondence between the search engine and the vulnerability knowledge base ontology, and the extracted knowledge is stored in the graph database in the form of RDF; With the help of the performance of the large language model LLM in the named entity recognition (NER) task, one of the subtasks of natural language processing (NLP), the named entities describing the vulnerabilities are extracted from the unstructured data of vulnerability descriptions, and the named entities are aligned with the knowledge extraction part in the graph database to finally form a vulnerability knowledge base.

3. The network penetration testing method based on state feedback according to claim 2 is characterized in that: The vulnerability attribute identification is performed according to the vulnerability database, and the penetration test conditions are matched based on the vulnerability attribute identification results, specifically: Based on the specific information of each vulnerability, vulnerability attribute identification is performed to analyze the key features of the vulnerability; the identified vulnerability attributes are marked and classified, and the penetration test conditions are matched according to the classification results.

4. The network penetration testing method based on state feedback according to claim 3 is characterized in that: The key features of the vulnerability include the vulnerability type, exploitation conditions, system components or services affected by the vulnerability, the complexity of vulnerability exploitation, and possible consequences; matching is to compare the identified vulnerability attributes with the penetration test conditions to determine whether the requirements for performing the penetration test are met.

5. The network penetration testing method based on state feedback according to claim 1 is characterized in that: It also includes establishing test templates for different conditions in the penetration testing system, each template matching a specific vulnerability type or attribute.

6. The network penetration testing method based on state feedback according to claim 3 is characterized in that: The state machine is used to perform the penetration test according to the generated test plan, and the test effect and the accuracy of the state transition are judged through the feedback mechanism, specifically: The state of the current target scenario is determined through a large language model, and penetration path planning is performed based on the state. The penetration test task is divided into multiple subtasks, and multiple substates are set for the system. The state machine is used to treat each scenario after the completion of the penetration test as a state, and each execution of the penetration test step is a transition between states; after each state transition, it is judged whether the current transition is correct. If it is converted to an incorrect state, the state is rolled back through the feedback mechanism, and a more appropriate step is decided to guide the current state to transition to the correct state.

7. The network penetration testing method based on state feedback according to claim 6 is characterized in that: The state machine is used to treat each scene after the penetration test is completed as a state, and each execution of the penetration test step is a transition between states; after each state transition, it is judged whether the current transition is correct. If it is converted to an incorrect state, the state is rolled back through the feedback mechanism, and a more appropriate step is decided to guide the current state to the correct state, which specifically includes: Construct a state machine for penetration testing tasks: Based on the principle of automata, the penetration testing task is broken down into several subtasks and a state machine is constructed; each subtask is a system state in the state machine, and these states are defined and organized according to the requirements of the penetration test; The system status is generated based on the large language model LLM. LLM understands the penetration test task as multiple subtasks and constructs multiple system states; Construct state transition events and functions: define the transitions between system states and construct state transition events through a series of operations; each transition event is a trigger for the transition from one state to another, representing the operation performed by the system or the command executed; Through capability decision and intention matching, appropriate operations are selected for each subtask, and the state transition function F:S×A→S is defined and constructed, that is, when the system is in state s i When action a is executed, the system transitions to state s j ; The system feeds back the executed action set {op_1, op_2, …, op_n} to LLM, which determines the system state transition mode based on the results and adjusts subsequent operations; Construct and simulate the penetration path: Based on the state transition of the state machine, construct a complete set of actions from the initial state to the final state to form a penetration path; Based on the construction of the penetration path, simulate the security protection strength, penetration success probability and expected effect of different paths, and choose the path with high risk and strong feasibility; Build targeted testing strategies based on different penetration paths; each step includes attack techniques, tools, scripts and trigger conditions; Execution of action set and result feedback: Use the generated action set to automatically execute the operations in the penetration test path and feed back the system response results to LLM; LLM analyzes the system's response, updates the current state and adjusts subsequent paths and actions.

8. The network penetration testing method based on state feedback according to claim 7 is characterized in that: When there are multiple vulnerabilities in the target environment, a vulnerability exploitation state machine is constructed for multiple vulnerabilities to perform vulnerability discovery and risk assessment, specifically: For multiple vulnerable scenarios, the penetration test exploit state machine further constructs a composite exploit state machine ESM for scenarios with multiple vulnerabilities; suppose there are two ESMs from two vulnerabilities, where ESM1 = <s1,a1,f1,s 01 ,se1>,ESM2= <s2,a2,f2,s 02 ,se2>; For each state transition F ij2 :(s i ,a)→s j In ESM2, if s i and j are new in s1, they are added to s1; otherwise , add a to a1; finally, add an entry F to f1 ij1 :(s i ,a)→s j , to connect to the s in ESM1 i and j ,Through the multi-level transition simulation of the state machine, the deep vulnerabilities of the target system are explored; Among them, s1 represents the state set in ESM1, s2 represents the state set in ESM2, a1 represents the action set in ESM1, a2 represents the action set in ESM2, f1 represents the transition function set in ESM1, f2 represents the transition function set in ESM2, s 01 represents the initial state in ESM1, s 02 represents the end state in ESM1, se1 represents the initial state in ESM2, and se2 represents the end state in ESM2.

9. A network penetration testing system based on state feedback, characterized in that: include: Database construction module, used to collect vulnerability information from search engines and public data, and build a vulnerability database; The condition matching module is used to identify vulnerability attributes according to the vulnerability database and match the penetration test conditions based on the vulnerability attribute identification results; The process initiation module is used to match the penetration test conditions with the preset penetration test condition template for the target environment through the large language model LLM. If the match is successful and the target environment is judged to meet the vulnerability exploitation conditions, the test conditions that meet the vulnerability are selected and the corresponding penetration test process is initiated; The state feedback module is used to output the matching results between vulnerability attributes and test conditions, generate a specific test plan for penetration testing, use the state machine to perform penetration testing according to the generated test plan, and judge the test effect and the accuracy of state transition through the feedback mechanism; The condition optimization module is used to further optimize the rules or condition templates in the matching process based on test feedback.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is loaded into a processor, it can execute the steps of the method according to any one of claims 1 to 8.

Images