Information system security online test method, system, device and medium

Abstract

The invention discloses an information system security online test method, system and device and a medium, and the method comprises the steps: carrying out the vulnerability scanning of an information system, and generating a vulnerability report according to a vulnerability scanning result; performing simulation attack on the information system, and generating an attack simulation report according to a simulation attack result; and generating a risk assessment matrix according to the vulnerability report and the attack simulation report. According to the method, the system, the equipment and the medium, comprehensive security verification can be carried out before the information system is online.

Description

Technical Field

[0001] The present invention belongs to the technical field of information system security testing, and relates to an information system security online testing method, system, equipment and medium. Background Art

[0002] Before an information system goes online, it usually needs to undergo rigorous functional and performance testing. However, with the continuous development of network attack technology, the importance of system security testing has become increasingly prominent. Existing security testing methods often rely too much on static vulnerability scanning tools and cannot fully capture the security risks of the system in the actual operating environment. In addition, there is a lack of multi-level attack simulations for information systems, which may lead to security risks in the system after actual deployment. Especially in a complex enterprise network environment, the security risks after the system goes online are more difficult to predict. Therefore, there is an urgent need for a systematic security testing device and method that can perform comprehensive security verification before the information system goes online, helping users identify and eliminate potential security vulnerabilities in advance. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and to provide a method, system, device and medium for testing the security of an information system online, which can perform comprehensive security verification before the information system goes online.

[0004] In order to achieve the above object, the present invention adopts the following technical scheme:

[0005] In one aspect of the present invention, the information system security online testing method of the present invention comprises:

[0006] Conduct vulnerability scans on information systems and generate vulnerability reports based on the vulnerability scan results;

[0007] Conduct simulated attacks on information systems and generate attack simulation reports based on the results of simulated attacks;

[0008] A risk assessment matrix is ​​generated based on the vulnerability report and the attack simulation report.

[0009] The information system security online testing method of the present invention is further improved in that:

[0010] Furthermore, the process of performing vulnerability scanning on the information system and generating a vulnerability report according to the vulnerability scanning result is as follows:

[0011] Identify vulnerability scanning tools;

[0012] Configure scanning tasks;

[0013] According to the scanning task, using the vulnerability scanning tool to scan the information system for vulnerabilities;

[0014] A vulnerability report is generated based on the vulnerability scan results, and the contents of the vulnerability report include a description of the vulnerability, the scope of impact, a severity rating, and repair suggestions.

[0015] Furthermore, the process of simulating an attack on the information system and generating an attack simulation report according to the result of the simulated attack is as follows:

[0016] Determine the type of simulated attack;

[0017] Use the simulated attack platform to conduct simulated attacks on information systems according to the determined types of simulated attacks;

[0018] Generate an attack simulation report based on the response results of the simulated attack.

[0019] Furthermore, the response result R of the simulated attack is expressed as:

[0020] R=Simulate(A j ,S k )for j=1,2,…,m and k=1,2,…,p

[0021] Among them, A j represents the jth attack type, S k represents the kth system component, m is the total number of attack types, and p is the total number of system components.

[0022] In a second aspect of the present invention, the information system security online testing system of the present invention comprises:

[0023] Vulnerability scanning module, used to scan the information system for vulnerabilities and generate vulnerability reports based on the vulnerability scanning results;

[0024] A simulated attack module is used to simulate attacks on information systems and generate attack simulation reports based on the results of the simulated attacks;

[0025] A generation module is used to generate a risk assessment matrix based on the vulnerability report and the attack simulation report.

[0026] The information system security online testing system of the present invention is further improved in that:

[0027] Furthermore, the vulnerability scanning module includes:

[0028] A first determination module is used to determine a vulnerability scanning tool;

[0029] Configuration module, used to configure scanning tasks;

[0030] A scanning module, used to perform vulnerability scanning on the information system using the vulnerability scanning tool according to the scanning task;

[0031] The first report generation module is used to generate a vulnerability report based on the vulnerability scanning results. The content of the vulnerability report includes a description of the vulnerability, the scope of impact, the severity rating and repair suggestions.

[0032] Furthermore, the simulated attack module includes:

[0033] A second determination module, used to determine the type of simulated attack;

[0034] An attack module, used to use a simulated attack platform to conduct a simulated attack on an information system according to a determined type of simulated attack;

[0035] The second report generating module is used to generate an attack simulation report according to the response result of the simulated attack.

[0036] Furthermore, the response result R of the simulated attack is expressed as:

[0037] R=Simulate(A J ,S K )for j=1,2,…,m and k=1,2,…,p

[0038] Among them, A J represents the jth attack type, S K represents the kth system component, m is the total number of attack types, and p is the total number of system components.

[0039] In a third aspect of the present invention, the computer device of the present invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the information system security online testing method when executing the computer program.

[0040] In a fourth aspect of the present invention, the computer-readable storage medium of the present invention stores a computer program, and when the computer program is executed by a processor, the steps of the information system security online testing method are implemented.

[0041] The present invention has the following beneficial effects:

[0042] The information system security online testing method, system, equipment and medium described in the present invention perform vulnerability scans on the information system during specific operations, and generates a vulnerability report based on the vulnerability scan results; simulate attacks on the information system, and generate an attack simulation report based on the results of the simulated attacks; generate a risk assessment matrix based on the vulnerability report and the attack simulation report to ensure the security of the system under multi-level attack scenarios. Through the use of automated tools, the test scope is covered more widely, and more potential security vulnerabilities can be discovered, thereby performing comprehensive security verification before the information system goes online. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings constituting a part of the present invention are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the accompanying drawings:

[0044] Figure 1 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] In the description of the present invention, it should be understood that the terms “include” and “comprises” indicate the presence of described features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0047] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0048] It should be further understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present invention generally indicates that the associated objects are in an "or" relationship.

[0049] It should be understood that, although the terms first, second, third, etc. may be used to describe preset ranges, etc. in the embodiments of the present invention, these preset ranges should not be limited to these terms. These terms are only used to distinguish preset ranges from each other. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0050] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0051] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention described and shown in the drawings here can usually be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0052] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0053] Embodiment 1

[0054] refer to Figure 1 The information system security online testing method of the present invention comprises the following steps:

[0055] 1) Automated vulnerability scanning of information systems;

[0056] Automated vulnerability scanning is the first line of defense for the entire system. It conducts comprehensive automated scans of information systems to identify known security vulnerabilities and configuration errors. Specifically, by integrating multiple vulnerability scanning tools, it can achieve in-depth detection of multiple levels such as operating systems, databases, middleware and applications.

[0057] The specific process of step 1) is:

[0058] 11) Choose from a variety of leading vulnerability scanning tools on the market, such as Nessus, Qualys, and OpenVAS. Each vulnerability scanning tool has different advantages in detecting specific types of vulnerabilities. For example, Nessus is known for its comprehensive vulnerability library and accuracy, and is suitable for comprehensive detection of enterprise-level systems; OpenVAS is an open source tool suitable for small businesses with limited budgets.

[0059] 12) Before performing a vulnerability scan, the system administrator configures the scan task, including the target system's IP address, the port range to be scanned, the plug-ins to be used, and the scan strategy. The scan strategy includes quick scan, deep scan, and customized scan. The administrator selects the appropriate strategy based on specific needs.

[0060] 13) When performing a vulnerability scan, the target component will be automatically detected to identify open ports and running services. The scanning tool will then detect known vulnerabilities one by one. Through the integration of APIs with various scanning tools, the system can receive scan results in real time and organize and analyze them.

[0061] 14) After the scan is completed, a vulnerability report is automatically generated, which includes the description of the vulnerability, the scope of impact, the severity rating and the repair suggestions. Through natural language processing technology, the system can intelligently process the scan report, extract key indicators, provide data support for subsequent steps, and obtain the vulnerability set V of the i-th component. I for:

[0062] V I =Scan(C I )for i=1,2,…,n

[0063] Among them, C i is the i-th component, and n is the total number of components.

[0064] 2) Attack scenario simulation;

[0065] By simulating various network attack scenarios and testing the defense capabilities of information systems, we can not only discover known vulnerabilities, but also evaluate the system's ability to respond to unknown attacks. The specific steps are as follows:

[0066] 21) Support simulation of multiple attack types, such as denial of service attack (DoS), SQL injection, cross-site scripting attack (XSS), directory traversal, etc. Testers select different attack types according to specific needs, and the module needs to preset attack templates to facilitate users to quickly configure.

[0067] 22) Using attack simulation platforms such as Metasploit and Burp Suite, the system can perform a variety of attacks. These tools provide a wealth of attack modules and plug-ins that can flexibly combine different attack scenarios. When the attack is executed, the system will record the response time, success rate and system errors of each attack, and analyze the system's defense mechanism in detail.

[0068] 23) After the attack simulation is completed, an attack simulation report is automatically generated. The contents of the attack simulation report include the attack type, success or failure, affected components and system response. The contents of the attack simulation report are then displayed in a chart form to facilitate analysis and decision-making. Specifically:

[0069] R=Simulate(A j ,St k )for j=1,2,…,m and k=1,2,…,p

[0070] Among them, R represents the simulated attack response result, A j represents the jth attack type, S k represents the kth system component, m is the total number of attack types, and p is the total number of system components.

[0071] 3) Construct a risk assessment matrix;

[0072] A multi-dimensional risk assessment model is adopted to consider factors such as vulnerability severity, attack success rate, business importance and potential losses. Through expert evaluation and data analysis, the weights of each factor, such as ω1, ω2, ω3, etc., are determined.

[0073] Extract key data from vulnerability scanning reports and attack simulation reports, and standardize them to provide input data for risk assessment models. For example, vulnerability severity can be quantified using CVSS (Common Vulnerability Scoring System).

[0074] According to the input data and weight, each potential risk point is evaluated. The risk assessment formula is:

[0075] R i =ω1·S i +ω2·P i +ω3·L i

[0076] Among them, R i represents the risk level of the ith risk point, S i is the severity of the vulnerability, P i is the attack success rate, L i is the potential loss, ω1, ω2 and ω3 are the corresponding weight coefficients respectively.

[0077] The risk assessment results will be displayed in the form of a risk matrix, and high-risk areas can be quickly identified based on risk levels. A risk assessment report will be automatically generated, including detailed analysis and charts of each risk point, providing a basis for decision-making.

[0078] 4) Generate security reinforcement suggestions;

[0079] Generate security reinforcement suggestions based on risk assessment results and automatically generate targeted security reinforcement suggestions to improve the overall security of the system.

[0080] 41) Suggestions for generating logic;

[0081] Based on the risk assessment results, components and vulnerabilities that need to be reinforced are identified, and reinforcement suggestions are generated. The reinforcement suggestions include system patch updates, configuration reinforcement, and permission management optimization, as well as specific measures such as network isolation and deployment of intrusion detection systems.

[0082] 42) Prioritization;

[0083] By analyzing the risk assessment results, the generated reinforcement suggestions are prioritized so that users can deal with high-risk issues first.

[0084] 43) Report generation;

[0085] Automatically generate a reinforcement suggestion report, which includes a detailed description of each reinforcement suggestion, implementation steps and expected results. The reinforcement suggestion report will also provide a time frame and resource requirements for implementing the suggestion to help users plan the implementation process reasonably, namely:

[0086] S = GenerateSuggestions(R)

[0087] Among them, S is the security reinforcement recommendation and R is the risk assessment result.

[0088] 5) Safety retest and online evaluation;

[0089] 51) Retest configuration;

[0090] The retest process will use the same vulnerability scanning and attack simulation tools as the initial test to ensure that the hardened system can resist the same types of attacks. The scope and depth of the retest can be configured as needed.

[0091] 52) Retest execution;

[0092] When performing retesting, the reinforced system is automatically subjected to comprehensive vulnerability scanning and attack simulation, and the retest results are compared with the initial test results, with a focus on analyzing changes in various security indicators.

[0093] 53) Generate result analysis and report;

[0094] A retest report will be generated, which will clearly show the security status comparison before and after the reinforcement, helping users evaluate the effectiveness of the reinforcement measures. The final security online assessment report will integrate the results of each module to form a complete security assessment document. The retest report includes risk assessment results, reinforcement suggestions and retest results, namely:

[0095] C=ReTest(S f ,S i )

[0096] Among them, C represents the retest result, S f is the system status after reinforcement, S i This is the initial system state.

[0097] The present invention has the following characteristics:

[0098] Comprehensiveness: This invention combines multiple testing methods such as vulnerability scanning, attack simulation, and risk assessment to ensure the security of the system under multi-level attack scenarios. Through the use of automated tools, the test coverage is wider and more potential security vulnerabilities can be discovered.

[0099] Accuracy: The quantitative risk assessment model can accurately assess the security risk level of the system. Compared with the traditional method that relies on static reports, the present invention uses dynamic analysis and modeling technology to make risk assessment more scientific and reasonable.

[0100] Practicality: This invention provides detailed security reinforcement suggestions and optimization solutions to help users quickly fix security risks in the system. Through practical security reinforcement measures, the security risks of the system after going online can be effectively reduced to ensure business continuity.

[0101] Dynamic adaptability: This invention introduces advanced technologies such as machine learning in attack simulation, which can dynamically adjust the attack strategy according to the actual situation of the system, so as to more accurately evaluate the defense capability of the system. This flexibility enables the testing method to cope with ever-changing security threats.

[0102] Automation and efficiency: Through the fully automated testing process, the present invention greatly improves the efficiency of security testing, saves human resources and time costs. System administrators can complete a comprehensive security assessment in a shorter time and make decisions quickly.

[0103] Embodiment 2

[0104] The information system security online testing system of the present invention comprises:

[0105] Vulnerability scanning module, used to scan the information system for vulnerabilities and generate vulnerability reports based on the vulnerability scanning results;

[0106] A simulated attack module is used to simulate attacks on information systems and generate attack simulation reports based on the results of the simulated attacks;

[0107] A generation module is used to generate a risk assessment matrix based on the vulnerability report and the attack simulation report.

[0108] As an implementation manner of the present invention, the vulnerability scanning module includes:

[0109] A first determination module is used to determine a vulnerability scanning tool;

[0110] Configuration module, used to configure scanning tasks;

[0111] A scanning module, used to perform vulnerability scanning on the information system using the vulnerability scanning tool according to the scanning task;

[0112] The first report generation module is used to generate a vulnerability report based on the vulnerability scanning results. The content of the vulnerability report includes a description of the vulnerability, the scope of impact, the severity rating and repair suggestions.

[0113] As an implementation mode of the present invention, the simulated attack module includes:

[0114] A second determination module, used to determine the type of simulated attack;

[0115] An attack module, used to use a simulated attack platform to conduct a simulated attack on an information system according to a determined type of simulated attack;

[0116] The second report generating module is used to generate an attack simulation report according to the response result of the simulated attack.

[0117] As an implementation mode of the present invention, the response result R of the simulated attack is expressed as:

[0118] R=Simulate(A j ,S k )for j=1,2,…,m and k=1,2,…,p

[0119] Among them, A j represents the jth attack type, S k represents the kth system component, m is the total number of attack types, and p is the total number of system components.

[0120] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, each functional module in each embodiment of the present application may be integrated into a processor, or may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0121] Embodiment 3

[0122] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the information system security online testing method are implemented, for example, including: scanning the information system for vulnerabilities, generating a vulnerability report according to the vulnerability scanning results; simulating attacks on the information system, generating an attack simulation report according to the results of the simulated attacks; generating a risk assessment matrix according to the vulnerability report and the attack simulation report. The memory may include a memory, such as a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk memory, etc. The processor, the network interface, and the memory are interconnected through an internal bus, and the internal bus may be an industrial standard architecture bus, a peripheral component interconnection standard bus, an extended industrial standard architecture bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory is used to store programs. Specifically, the program may include a program code, and the program code includes computer operation instructions. The memory may include a memory and a non-volatile memory, and provide instructions and data to the processor.

[0123] Embodiment 4

[0124] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the information system security online testing method are implemented, for example, including: scanning the information system for vulnerabilities, and generating a vulnerability report according to the vulnerability scanning results; simulating attacks on the information system, and generating an attack simulation report according to the results of the simulated attacks; generating a risk assessment matrix according to the vulnerability report and the attack simulation report. Specifically, the computer-readable storage medium includes, but is not limited to, for example, volatile memory and / or non-volatile memory. The volatile memory may include random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include a read-only memory (ROM), a hard disk, a flash memory, an optical disk, a magnetic disk, etc.

[0125] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0126] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0127] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0128] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for testing the safety of an information system online, characterized in that: include: Conduct vulnerability scans on information systems and generate vulnerability reports based on the vulnerability scan results; Conduct simulated attacks on information systems and generate attack simulation reports based on the results of simulated attacks; A risk assessment matrix is ​​generated based on the vulnerability report and the attack simulation report.

2. The information system security online testing method according to claim 1 is characterized in that: The process of performing vulnerability scanning on the information system and generating a vulnerability report according to the vulnerability scanning results is as follows: Identify vulnerability scanning tools; Configure scanning tasks; According to the scanning task, using the vulnerability scanning tool to scan the information system for vulnerabilities; A vulnerability report is generated based on the vulnerability scan results, and the contents of the vulnerability report include a description of the vulnerability, the scope of impact, a severity rating, and repair suggestions.

3. The information system security online testing method according to claim 1 is characterized in that: The process of simulating an attack on an information system and generating an attack simulation report according to the result of the simulated attack is as follows: Determine the type of simulated attack; Use the simulated attack platform to conduct simulated attacks on information systems according to the determined types of simulated attacks; Generate an attack simulation report based on the response results of the simulated attack.

4. The information system security online testing method according to claim 3 is characterized in that: The response result R of the simulated attack is expressed as: R=Simulate(A j ,S k )for j=1,2,...,m and k=1,2,…,p Among them, A j represents the jth attack type, S k represents the kth system component, m is the total number of attack types, and p is the total number of system components.

5. An information system security online testing system, characterized in that: include: Vulnerability scanning module, used to scan the information system for vulnerabilities and generate vulnerability reports based on the vulnerability scanning results; A simulated attack module is used to simulate attacks on information systems and generate attack simulation reports based on the results of the simulated attacks; A generation module is used to generate a risk assessment matrix based on the vulnerability report and the attack simulation report.

6. The information system security online testing system according to claim 5, characterized in that: The vulnerability scanning module includes: A first determination module is used to determine a vulnerability scanning tool; Configuration module, used to configure scanning tasks; A scanning module, used to perform vulnerability scanning on the information system using the vulnerability scanning tool according to the scanning task; The first report generation module is used to generate a vulnerability report based on the vulnerability scanning results. The content of the vulnerability report includes a description of the vulnerability, the scope of impact, the severity rating and repair suggestions.

7. The information system security online testing system according to claim 5, characterized in that: The simulated attack module comprises: A second determination module, used to determine the type of simulated attack; An attack module, used to use a simulated attack platform to conduct a simulated attack on an information system according to a determined type of simulated attack; The second report generating module is used to generate an attack simulation report according to the response result of the simulated attack.

8. The information system security online testing system according to claim 7, characterized in that: The response result R of the simulated attack is expressed as: R=Simulate(A j ,S k )for j=1,2,...,m and k=1,2,…,p Among them, A j represents the jth attack type, S k represents the kth system component, m is the total number of attack types, and p is the total number of system components.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the information system security online testing method as described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the information system security online testing method as described in any one of claims 1 to 4 are implemented.

Images