Penetration testing system and method based on multi-agent collaboration

Abstract

The invention provides a penetration test system and method based on multi-agent collaboration, and the system comprises an interaction module, and a plan generation agent, a plan planning agent and a plan execution agent which comprise a large language model LLM, and the interaction module is used for receiving a to-be-solved problem inputted by a user; the plan generation agent is used for generating a penetration test task plan according to a to-be-solved problem; the plan planning agent is used for splitting the penetration test task plan to generate a plurality of sub-plans; a reinforcement learning technology is utilized to screen out an optimal adaptive API of an optimal tool corresponding to the current plan description, parameters required by the current API are extracted from the subtasks, and a final penetration test command is generated; and the plan execution agent is used for receiving the penetration test command transmitted by the plan planning agent, executing the command and recording a generated execution result. According to the method, a user only needs to give a penetration test target and purpose, a penetration test scheme can be automatically given, a penetration test task is carried out, and a result is finally given.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer security detection, and specifically relates to a penetration testing system and method based on multi-agent collaboration. Background Art

[0002] Penetration testing is a security assessment method that evaluates computer systems, networks or applications to check their security by simulating the behavior of attackers. Its main purpose is to simulate hacker attacks to discover loopholes, weaknesses and security risks in the system. In traditional penetration testing, penetration testers usually use automated tools to analyze the target system. The steps of penetration testing are generally divided into seven steps: preliminary interaction, intelligence collection, threat modeling, vulnerability analysis, penetration attack, post-penetration attack and report formation. Traditional penetration testing has great requirements on the professional skills and experience of testers. Testers are required to use a variety of test penetration tools and be able to effectively combine and utilize them.

[0003] At present, automated penetration testing tools generally integrate the functions of multiple penetration testing tools to facilitate the use of testers, but testers still need to have strong professional skills and familiarity with the testing tools. Although there are many excellent tools and methods in this field, fully automated penetration testing is still difficult to achieve. The difficulty in automating penetration testing is that comprehensive knowledge is required to understand and discover various vulnerabilities. In practice, penetration testers usually use a combination of depth-first and breadth-first search to conduct penetration testing. First, a comprehensive understanding of the target is obtained through breadth-first search, and then specific services and vulnerabilities are tested through depth-first search. However, this testing method requires penetration testers to have rich experience and professional knowledge. Summary of the invention

[0004] In order to solve the problem that existing automated penetration testing methods still need to rely on the experience and expertise of testers, the present invention provides a penetration testing system based on multi-agent collaboration, aiming to provide an intelligent and automated penetration testing system through the collaborative work of multiple agents, so as to significantly improve the efficiency, accuracy and intelligence level of penetration testing.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] A penetration testing system based on multi-agent collaboration includes an interactive module and a plan generation agent, a plan planning agent and a plan execution agent including a large language model LLM, wherein:

[0007] The interaction module is used to receive the problem to be solved input by the user;

[0008] The plan generation agent is used to generate a penetration test task plan according to the problem to be solved;

[0009] The plan planning agent is used to split the penetration test task plan to generate multiple sub-plans; and use reinforcement learning technology to screen out the best adaptation API corresponding to the optimal tool described in the current plan, and extract the parameters required by the current API from the sub-task to generate the final penetration test command;

[0010] The plan execution agent is used to receive the penetration test command transmitted by the plan planning agent, execute the command, and record the generated execution result.

[0011] Preferably, it also includes an analysis and summary module, which is used to generate a penetration test and risk assessment report for the problems to be solved input by the current user based on the execution results recorded by the planned execution agent and the general summary generated by the LLM in each agent, and discover vulnerabilities based on the penetration test and risk assessment report.

[0012] Preferably, the problem to be solved input by the user includes the IP or address information of the target, and if the information is incomplete, the system exits in time; the penetration test task plan generated by the planning agent includes the target information given by the user.

[0013] Preferably, if the planning agent is not in the initial state, the planning agent receives the execution result of the plan execution agent, updates and improves the current task plan according to the current task list and the execution result of the previous round of plan, and generates a new subtask list;

[0014] For each subtask, LLM alignment technique is used to generate the corresponding plan description.

[0015] Preferably, the method of using reinforcement learning technology to select the best-fitting API corresponding to the optimal tool described in the current plan, extracting the parameters required by the current API from the subtasks, and generating the final penetration test command specifically includes:

[0016] Integrate penetration testing tools into APIs based on their functions, build plug-in libraries, and perform modular management;

[0017] Using the secondary screening algorithm and RAG technology, the best-fitting API corresponding to the optimal tool described in the current plan is selected from the plug-in library;

[0018] Using the SymbCoT algorithm, the LLM is enabled to extract the core parameters required by the current API from the subtasks with a standardized and precise description paradigm, and generate the final penetration test commands.

[0019] Preferably, the plan execution agent is used to receive the penetration test command delivered by the plan planning agent, execute the command, and record the generated execution result, specifically including:

[0020] The plan execution agent receives the specific penetration test command transmitted by the plan planning agent, executes the command, and obtains the execution result of the penetration test tool;

[0021] Send the execution results of the penetration testing tool to the LLM of the plan execution agent to generate a general summary of the current penetration testing commands;

[0022] Determine the execution result of the penetration testing tool. If all subtasks are not completed, go to the step of generating multiple sub-plans and feed back the execution result of the penetration testing tool to the planning agent; if all subtasks are completed, the user's penetration testing needs have been met.

[0023] The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that when the plan generation agent receives the problem to be solved input by the user and generates the task plan for the automated penetration test, the system exits in time for the input whose decision result is that it is not executable.

[0024] The present invention also provides a penetration testing method based on multi-agent collaboration, comprising:

[0025] The plan generation agent generates a penetration test task plan based on the issues to be resolved;

[0026] The planning agent splits the penetration test task plan into multiple sub-plans. It uses reinforcement learning technology to select the best-fitting API for the optimal tool described in the current plan, extracts the parameters required by the current API from the sub-tasks, and generates the final penetration test command.

[0027] The plan execution agent receives the penetration test command delivered by the plan planning agent, executes the command, and records the generated execution results;

[0028] Among them, the plan generation agent, plan planning agent and plan execution agent all contain the large language model LLM.

[0029] The present invention also provides a computer device, including a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps described in the penetration testing method based on multi-agent collaboration.

[0030] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is loaded by a processor, it can execute the steps described in the penetration testing method based on multi-agent collaboration.

[0031] The penetration testing method based on multi-agent collaboration provided by the present invention has the following beneficial effects:

[0032] The present invention adopts a multi-intelligent agent approach, by setting a plan generation agent, a plan planning agent and a plan execution agent including a large language model (LLM), so that the agent can act as a decision maker, executor and other testers in a traditional penetration test, so that the user only needs to provide a penetration test goal and purpose, and the system can automatically provide a penetration test plan and perform the penetration test task in a collaborative way, and finally provide the result.

[0033] The automated task plan generation by the plan generation agent avoids the tediousness and errors of manual operations, and can exit in time for non-executable inputs, ensuring the rationality and feasibility of the task and avoiding unnecessary waste of resources. The plan planning agent breaks down complex tasks into multiple sub-plans, and combines reinforcement learning to select the optimal tool and its best API adaptation solution to ensure that each sub-task is processed efficiently and accurately, thereby improving the execution effect of the entire penetration testing process. This solution allows users to accurately and efficiently complete penetration testing tasks without having to understand the specific use of the tool and in-depth penetration testing knowledge, reducing labor costs and improving penetration efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 This is a flow chart of a penetration testing method based on multi-agent collaboration according to Embodiment 1 of the present invention;

[0036] Figure 2 To generate a flowchart of the penetration testing task;

[0037] Figure 3 A flowchart for splitting up the penetration testing tasks;

[0038] Figure 4 A flowchart for generating penetration testing commands;

[0039] Figure 5 A flowchart for performing penetration testing tasks;

[0040] Figure 6 A block diagram of a penetration testing system based on multi-agent collaboration provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0041] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0042] Example 1

[0043] The present invention provides a penetration testing method based on multi-agent collaboration, specifically as follows Figure 1 As shown, the method includes:

[0044] S1: Receive the problem to be solved from the user, and the plan generation agent (Planner agent) generates the task plan for the automated penetration test. For inputs whose decision results are not executable, the system exits in time.

[0045] In one embodiment, S1 includes:

[0046] S11: The user input is natural language, and the user input needs to include information such as the target IP or address. If the information is incomplete, the system will exit in time.

[0047] S12: Generate a penetration test plan based on the user input, where the plan includes the target information given by the user.

[0048] Specifically, Figure 2 As shown, step S11 specifically includes: the address information of the target host or system, such as the address information in the form of IP:PORT; the user's penetration test requirements, such as performing a vulnerability scan on the target address or performing port detection on the target. If the plan generation agent determines that the information entered by the user is incomplete or the user's penetration test requirements cannot be completed, it will exit safely and output corresponding prompt information to remind the user to change the requirements or supplement the information. Step S12 specifically includes: the plan generation agent generates a rough penetration test task plan list based on the user's input.

[0049] S2: The planning agent (Refiner agent) uses the Automatic multi-step reasoning (ART) algorithm (or HTN decomposition algorithm, HRL algorithm, behavior tree algorithm) to split or improve the plan according to the task plan and the execution results of the previous round of tasks (except the first round) to generate accurate sub-plans.

[0050] like Figure 3 As shown, in one embodiment, S2 includes:

[0051] S21: If the planning agent is in the initial state (i.e., the first cycle), the planning agent receives the task plan generated by the plan generation agent and uses the Automatic multi-step reasoning (ART) algorithm to split the plan so as to formulate subtask plans more scientifically and efficiently.

[0052] S22: If the planning agent is not in the initial state (ie after the first cycle), the planning agent receives the execution result of the plan execution agent, updates and improves the current task plan according to the current task list and the execution result of the previous round of plan, and generates a new subtask list.

[0053] S23: For each subtask, use LLM alignment technology to generate the corresponding plan description.

[0054] Specifically, for example, step S21 specifically includes: judging the current Agent state, if it is the first round of loop, that is, the plan list generated by the plan generation agent after the user input is passed to the plan planning agent, and no task has been executed, the plan planning agent uses the Automatic multi-step reasoning (ART) algorithm to split the overall plan and formulate subtask plans. The requirements of each subtask correspond to an API in the plug-in library. Step S22 specifically includes: if it is after the first round of loop, that is, a subtask has been completed and the plan planning agent has received the execution result from the plan execution agent. The plan planning agent updates the current task plan list based on the current task plan list and the execution results of the previous round of tasks.

[0055] S3: Use reinforcement learning technology to screen out the best-fitting API corresponding to the optimal tool described in the current plan, and use the SymbCoT algorithm (or Zero-Shot and Few-Shot Reasoning method, Prompt Chaining algorithm, Constraint-Based TaskPlanning algorithm) to extract the core parameters required by the current API from the subtask and generate the final penetration test command.

[0056] like Figure 4 As shown, in one embodiment, S3 includes:

[0057] S31: Integrate penetration testing tools into APIs according to their functions, build a plug-in library, and perform modular management.

[0058] S32: Using the secondary screening algorithm and RAG technology, the best-fitting API corresponding to the optimal tool described in the current plan is screened out from the plug-in library built in S31.

[0059] S33: Use the SymbCoT algorithm to enable LLM to extract the core parameters required by the current API from the subtasks with a standardized and precise description paradigm, and generate the final penetration test command.

[0060] Specifically, for example, step S31 specifically includes: integrating various penetration testing tools, abstracting the functions of the penetration testing tools into APIs, and each API needs to have description information of the corresponding function and description information of the parameter meaning and format. Step S32 specifically includes: using RAG technology to find multiple APIs whose function description information is consistent with user needs from a large number of APIs, and then using LLM to select the most suitable API from multiple APIs. Step S33 specifically includes: after selecting the corresponding API, using LLM to generate the parameters required by the API according to the description information and requirements of the API, and generate the final penetration test command.

[0061] S4: The ExecutorAgent receives the specific command information transmitted by the Planning Agent and executes the command. The results are summarized and recorded. If all subtasks are not completed, return to step S2 until all subtasks are completed.

[0062] like Figure 5 As shown, in one embodiment, S4 includes:

[0063] S41: The plan execution agent receives the specific penetration test command transmitted by the plan planning agent, executes the command, and obtains the execution result of the penetration test tool.

[0064] S42: Obtain the execution result of the penetration test tool from S41. The execution result will be sent to LLM to generate a highly generalized summary of the current penetration test command.

[0065] S43: Get the execution result of the penetration test tool from S41. If the subtasks are not all completed, go to step S2 and feed back the execution result of the penetration test tool to the planning agent to help the planning agent to adjust and optimize the subtasks more flexibly; if the subtasks are all completed, it means that the user's penetration test requirements have been completed.

[0066] Specifically, for example, step S41 specifically includes: the plan execution agent calls the corresponding function of the corresponding penetration testing tool in the plug-in library according to the penetration testing command, and obtains the result after the penetration testing tool function is executed. Step S42 specifically includes: inputting the penetration testing command and the function execution result of the corresponding penetration testing tool to LLM, allowing LLM to make a highly generalized summary. Step S43 specifically includes: obtaining the execution result of the penetration testing tool from S41, and judging whether the subtasks have been completed according to the subtask list and the execution result. If it is judged that the subtasks have not been completed, the penetration test execution result will be fed back to the planning agent, so that it can improve and optimize the subtask list according to the current task list and the penetration test execution result, and give the subtasks to be completed in the next round; if it is judged that the subtasks have been completed, it means that the user's penetration testing needs have been completed, and there is no need to continue to generate or modify the subtask list.

[0067] S5: Generate an automated penetration test and risk assessment report for the current user input based on the core metadata of the execution results and the summary generated by LLM.

[0068] In one embodiment, S5 includes: generating an automated penetration test and risk assessment report for the current user input based on the core data of the execution results of all subtasks and the general summary generated by LLM. Specifically, the penetration test commands used by all subtasks and the execution results of all subtasks are recorded. Based on the penetration test commands and execution results of all subtasks, and all the summary contents generated by S42, a risk assessment report for the current user input is generated.

[0069] The penetration testing method based on multi-agent collaboration provided by the present invention has the following beneficial effects:

[0070] (1) First, the present invention provides a penetration testing method based on multi-agent collaboration, which can significantly improve the efficiency and intelligence level of penetration testing. Through the automated task plan generation of the plan generation agent, the tediousness and errors of manual operation are avoided, and the unexecutable input can be exited in time, which ensures the rationality and feasibility of the task and avoids unnecessary waste of resources.

[0071] (2) Secondly, the planning agent uses the Automatic multi-step reasoning (ART) algorithm to scientifically decompose complex tasks into multiple sub-plans, and uses LLM alignment technology to accurately describe each sub-task. Combined with reinforcement learning, the optimal tool and its best API adaptation solution are selected, and flexible tool calls are achieved through a modularly managed plug-in library, ensuring that each sub-task is processed efficiently and accurately, improving the execution effect of the entire penetration testing process.

[0072] (3) In addition, the SymbCoT algorithm is used to accurately extract API core parameters to generate the final penetration test command, making the task description and tool call more closely matched and adaptable, ensuring the effectiveness and accuracy of the test command. ExecutorAgent receives and executes the penetration test command, forms a closed-loop optimization through feedback of the execution results, and helps the planning agent to dynamically adjust the task strategy. In this way, the system can flexibly adjust and optimize according to the actual situation during the execution process, and has stronger adaptability.

[0073] (4) Finally, the system can automatically generate penetration test and risk assessment reports, providing a highly generalized summary based on the task core metadata and LLM generation, thereby simplifying the report generation process and improving the visualization and insight of test information. This penetration test solution based on multi-agent collaboration not only enhances the system's intelligent perception and rapid decision-making capabilities, but also significantly improves the quality and efficiency of penetration testing, providing users with a more reliable network security assessment tool.

[0074] Example 2

[0075] Based on the same inventive concept, the present invention also provides a penetration testing system based on multi-agent collaboration, such as Figure 6 As shown, the system includes an interaction module, a plug-in library module, a management and error handling module, an analysis and summary module, and a plan generation agent (Planner agent), a plan planning agent (Refiner agent) and a plan execution agent (Executor Agent) including a large language model LLM. The system aims to automatically generate penetration test task plans through the plan generation agent to reduce human errors, and scientifically disassemble and refine tasks through the plan planning agent, automatically select the most suitable penetration tools and APIs, and improve execution efficiency.

[0076] Specifically, the interaction module is used to receive the problems to be solved input by the user and the system return information; the management and error handling module is used to manage the interaction and operation between the scheduling modules, and to handle the scenarios when system errors occur; the plug-in library module is used to store the functional APIs integrated by the penetration testing tools; the plan generation agent is used to determine whether the user requirements can be completed based on the user input and to generate a penetration testing task plan; the plan planning agent is used to plan the penetration testing task plan, decompose the plan into multiple subtasks, and screen out the appropriate API for each subtask to generate a penetration testing command; the plan execution agent is used to execute the penetration testing command and record the execution results of the penetration testing tool; the analysis and summary module is used to generate an automated penetration testing and risk assessment report for the current user query.

[0077] Each module in the above-mentioned penetration testing system based on multi-agent collaboration can be implemented in whole or in part through software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0078] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in the embodiment of the penetration testing method based on multi-agent collaboration. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0079] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, a non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, the steps in the embodiment of the penetration testing method based on multi-agent collaboration can be implemented. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0080] It will be appreciated by those skilled in the art that embodiments of the present invention may provide methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0081] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0082] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0083] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0084] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the patent for the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. A penetration testing system based on multi-agent collaboration, characterized in that: It includes an interactive module and a plan generation agent, a plan planning agent and a plan execution agent including a large language model LLM, among which: The interaction module is used to receive the problem to be solved input by the user; The plan generation agent is used to generate a penetration test task plan according to the problem to be solved; The plan planning agent is used to split the penetration test task plan to generate multiple sub-plans; and use reinforcement learning technology to screen out the best adaptation API corresponding to the optimal tool described in the current plan, and extract the parameters required by the current API from the sub-task to generate the final penetration test command; The plan execution agent is used to receive the penetration test command transmitted by the plan planning agent, execute the command, and record the generated execution result.

2. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: It also includes an analysis and summary module, which is used to generate a penetration test and risk assessment report for the problem to be solved input by the current user based on the execution results recorded by the planned execution agent and the general summary generated by the LLM in each agent, and discover vulnerabilities based on the penetration test and risk assessment report.

3. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: The problem to be solved input by the user includes the IP or address information of the target. If the information is incomplete, the system will exit in time; the penetration test task plan generated by the planning agent includes the target information given by the user.

4. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: The process also includes: if the plan planning agent is not in the initial state, the plan planning agent receives the execution result of the plan execution agent, updates and improves the current task plan according to the execution result of the current task list and the previous round of plan, and generates a new subtask list; For each subtask, LLM alignment technique is used to generate the corresponding plan description.

5. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: The method uses reinforcement learning technology to select the best-fitting API corresponding to the optimal tool described in the current plan, extracts the parameters required by the current API from the subtasks, and generates the final penetration test command, specifically including: Integrate penetration testing tools into APIs based on their functions, build plug-in libraries, and perform modular management; Using the secondary screening algorithm and RAG technology, the best-fitting API corresponding to the optimal tool described in the current plan is selected from the plug-in library; Using the SymbCoT algorithm, the LLM is enabled to extract the core parameters required by the current API from the subtasks with a standardized and precise description paradigm, and generate the final penetration test commands.

6. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: The plan execution agent is used to receive the penetration test command delivered by the plan planning agent, execute the command, and record the generated execution results, specifically including: The plan execution agent receives the specific penetration test command transmitted by the plan planning agent, executes the command, and obtains the execution result of the penetration test tool; Send the execution results of the penetration testing tool to the LLM of the plan execution agent to generate a general summary of the current penetration testing commands; Determine the execution result of the penetration testing tool. If all subtasks are not completed, go to the step of generating multiple sub-plans and feed back the execution result of the penetration testing tool to the planning agent; if all subtasks are completed, the user's penetration testing needs have been met.

7. The penetration testing system based on multi-agent collaboration according to claim 1 is characterized in that: When the plan generation agent receives the problem to be solved input by the user and generates the task plan for the automated penetration test, the system exits in time for the input whose decision result is unexecutable.

8. A penetration testing method based on multi-agent collaboration, characterized in that: include: The interactive module receives the problem to be solved input by the user; The plan generation agent generates a penetration test task plan based on the issues to be resolved; The planning agent splits the penetration test task plan into multiple sub-plans; And use reinforcement learning technology to screen out the best-fitting API corresponding to the optimal tool described in the current plan, and extract the parameters required by the current API from the subtask to generate the final penetration test command; The plan execution agent receives the penetration test command delivered by the plan planning agent, executes the command, and records the generated execution results; Among them, the plan generation agent, plan planning agent and plan execution agent all contain the large language model LLM.

9. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method of claim 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is loaded into a processor, it can execute the steps of the method according to claim 8.

Images