Intelligent penetration testing method based on Petri network

Abstract

The invention provides an intelligent penetration testing method based on a Petri network. The intelligent penetration testing method comprises the steps of establishing an attack tool library, scanning a target network, matching parameter information, creating a network attack graph based on the Petri network, storing the network attack graph and analyzing the network attack graph. In a scene with a complex network structure, penetration testing can be carried out in a black box network with an opaque network structure, an attack path is automatically planned according to the actual situation of a target network, a network attack graph is generated, the network attack graph can be stored in a test platform database by a computer system, and the network attack graph model primitives are traversed and analyzed, so that the network attack graph model primitives are analyzed, and the test efficiency is improved. Effective penetration testing is directly carried out on the target network, training can be carried out without the help of a large amount of sample data, and intelligentization and high efficiency of penetration testing are achieved.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a penetration testing method. Background Art

[0002] Penetration testing is a technique that simulates attackers to conduct security assessments on computer systems, network devices, applications, etc. The purpose of penetration testing is to discover potential vulnerabilities and security weaknesses in the system, to assess the security of the system, and to provide corresponding repair suggestions.

[0003] Traditional penetration testing mainly relies on manual operations, which requires high technical skills of testers and is very expensive. Intelligent penetration testing uses artificial intelligence, large models and other technical means to effectively integrate network attack tools, analyze vulnerabilities, generate penetration testing plans, implement penetration attacks based on the security risks of the target terminal, and evaluate the security protection level of the target terminal.

[0004] When conducting penetration testing, the method of patent CN202410881109 needs to be compared with the historical database to generate the best penetration test path; this method requires long-term training before it can be put into use, which greatly affects the efficiency of penetration testing; once the target network structure changes, it needs to be retrained; this method is suitable for penetration test simulation testing, but has the defects of low efficiency and large sample demand when conducting penetration testing on actual networks. The method of patent CN202410881114 uses a reward value function to find the optimal penetration test path from a pre-trained data set; this method is prone to fall into the local minimum error, and sometimes the generated penetration test strategy does not achieve the expected effect; when the network structure is complex, it is necessary to use a large data set for long-term training, and changes in the target network structure require retraining, which cannot solve the problem of generating intelligent penetration test models in dynamic network environments. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides an intelligent penetration testing method based on Petri nets. The present invention can implement penetration testing in a black box network with an opaque network structure, automatically plan attack paths according to the actual situation of the target network, and generate a network attack graph, which can be stored in the test platform database by the computer system. By traversing and parsing the attack graph model elements, an effective penetration test can be directly implemented on the target network without the need for training with a large amount of sample data, thereby realizing intelligent and efficient penetration testing.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] An intelligent penetration testing method based on Petri net, comprising:

[0008] Step A: Establish an attack tool library. That is, collect attack tools that can perform penetration testing, integrate the attack tools into the test platform database, and form an attack tool library.

[0009] When implementing a penetration test, the corresponding attack tool is called from the attack tool library to increase the speed of the penetration test, which is conducive to controlling the process of the penetration test and realizing the intelligent and efficient penetration test. In addition, the test platform computer manages the attack tools in the network attack library to realize the addition, deletion, modification, and search of network attack tools in the network attack library. By dynamically updating and managing the attack tools in the network attack library, the flexibility and scalability of the network attack library are enhanced, so that the effectiveness of the attack tools is maximized. The attack tool is represented as {a1, a2, a3, a4, …an}, where a1 represents the number of the attack tool, a2 represents the name of the attack tool, a3 represents the storage path of the attack tool, and a4-an represents the parameter information of the attack tool. Table 1 is the structure table of the attack tool library:

[0010] Table 1 Attack tool library structure table

[0011] Field Name type length illustrate ID int 4 Attack tool ID name Vchar 20 Attack tool name location Vchar 20 Attack tool storage path parameter Vchar 200 Parameter 1, parameter 2, ...

[0012] Step B: Scan the target network and establish a network information structure table. That is, the test platform uses scanning tools such as Nmap and NetScan to obtain the terminal parameter information of the target network.

[0013] The obtained terminal parameter information can be expressed as {p1, p2, p3, p4}, where p1 represents the IP address, p2 represents the host name, p3 represents the communication port number, and p4 represents the vulnerability. As shown in Table 2, a network information structure table is established.

[0014] Table 2 Network information structure table

[0015] Field Name type length illustrate IP_Addr Vchar 20 IP address Hostname Vchar 20 Hostname port Vchar 20 Port Number hole Vchar 50 Vulnerabilities

[0016] Step C: Match the terminal parameter information obtained in step B with the parameter information of the attack tool in the attack tool library in step A, that is, compare the terminal parameter information obtained in step B with the parameter information of the attack tool in the attack tool library in step A. If the terminal parameter information of the terminal obtained in step B is consistent with the parameter information of the attack tool in the attack tool library in step A, then there is an attack path and the penetration test can continue to be implemented; if the terminal parameter information does not meet the attack tool implementation conditions, the penetration test fails and the test platform exits the test.

[0017] Step D: Create a network attack graph based on Petri nets, that is, according to the matching result of step C, if there is an attack path, create a network attack graph based on Petri nets to achieve a formal description of the penetration test path.

[0018] Step D specifically includes:

[0019] Step D.1: Create a mold. That is, define the graphic element information in the drawing software, form the drawing, and finally place the drawing in the toolbox of the drawing software.

[0020] In the process of drawing the network attack graph, the drawing toolbox where the graph is placed is the mold. In order to complete the drawing of the graph, the mold needs to be created and saved.

[0021] Step D.1 specifically includes:

[0022] Step D.1.1: Draw a primitive symbol in the drawing area, that is, use a spreadsheet to set attribute information for the primitive, and the number and type of parameters attached to the primitive. According to the characteristics of the attack graph model component unit, the present invention defines three types of primitives: attribute state node, attack behavior node, and logical relationship node.

[0023] Step D.1.2: Create a mold. That is, define the graphic element information in the drawing software, form a drawing, and finally place the drawing in the toolbox of the drawing software.

[0024] In the process of drawing network attack graphs, the drawing toolbox where the graph is placed is called a stencil. In order to complete the drawing of the graph, a stencil needs to be created and saved.

[0025] Step D.1.3: Generate attribute state nodes. Attribute state nodes represent the conditions required to implement a certain attack behavior. The system draws attribute state node primitives on the topology interface, sets the conditions to be met by subsequent attack behavior nodes, and writes the configuration parameter information into the database.

[0026] Step D.1.4 generates an attack behavior node. The attack behavior node stores information such as the attack behavior and its parameters taken when implementing the penetration test. The system draws the attack behavior node element on the topology interface, associates it with the attack tool in the attack tool library in step A, sets the parameter information of the attack tool, and writes the path for calling the attack tool and the parameter information of the attack tool into the database.

[0027] Step D.1.5 generates logical relationship nodes. Logical relationship nodes describe the temporal logic constraints on states and execution paths in penetration test behaviors. The system draws logical relationship node primitives on the topology interface and writes the node number information connected to it into the database according to the set logical relationship.

[0028] Step D.2: Draw a network attack graph, that is, draw a network attack graph based on Petri net according to the attack path obtained from the matching result of step C.

[0029] Step D.2 specifically includes:

[0030] Step D.2.1: Create an initial attribute state node primitive, that is, draw an initial attribute state node in the network attack graph, and the attribute state information of the primitive is an empty set.

[0031] The initial attribute state node is used to identify the initial state of the attack plan and has no specific meaning, so there is no need to set the specific content of the initial attribute state node. The system draws the attribute state node primitive in the topology interface and sets the "IntializtionCrunode" item to 1 to identify the node as the initial attribute state node. On this basis, the subsequent node number information is written into the database.

[0032] Step D.2.2: Create a partial attack graph for the network detection phase. The system draws a scanning tool primitive on the topology interface, connects the initial attribute state node in step D.2.1 with the scanning tool primitive using a connecting line, that is, points from the initial attribute state node to the scanning tool, and outputs the target network parameter information primitive.

[0033] Step D.2.3: Create a partial attack graph for selecting penetration testing tools, compare the target network parameter information {p1, p2, p3, p4…pn} with the parameter information of the attack tools {a1, a2, a3, a4,…an} in the attack tool library of step A, find the attack tool that is consistent with the target network parameter information, that is, find the matching attack tool set that can implement the penetration test; automatically add the matching attack tool set element to the attack graph.

[0034] Step D.2.4: Iteratively draw the attack graph for the target network, that is, use connecting lines to connect the target network parameter information set {p1, p2, p3, p4…pn} graph elements with the attack tool set {ai,…aj} graph elements, output the target network parameter information set after the attack, match it with the attack tool set, and find a matching attack tool that can implement the penetration test.

[0035] Step D.2.5: Repeat step D.2.4 until the match between the target network parameter information set and the attack tool set is an empty set, that is, the target network parameter information set is inconsistent with the parameter information of the attack tool set in the attack tool library, and a suitable attack tool cannot be found. Subsequent penetration testing is carried out and the network attack graph is created.

[0036] Step E: Storing the network attack graph, that is, storing the network attack graph created in step D into the test platform database.

[0037] Step E specifically includes:

[0038] Step E.1: Establish an attribute state node structure table, that is, store the attribute state nodes representing the attribute states required when a certain attack method is running into the attribute state node structure table.

[0039] The attribute state node information can be expressed as {S1, S2, S3, S4, S5, S6, S7, S8, S9, S10, S11}, where S1 represents the number of the attribute state node, S2 represents the number of the penetration test scheme to which the attribute state node belongs, S3 represents the name of the attribute state node, S4 represents the target terminal IP address when the penetration test is implemented, S5 represents the target computer terminal host name when the penetration test is implemented, S6 represents the communication port of the target terminal when the penetration test is implemented, S7 represents the vulnerability of the target terminal when the penetration test is implemented, S8 represents whether the node is the initial attribute state node, S9 represents the working status of the node, whether it has been executed or not executed, S10 represents the node's previous node number, and S11 represents the node's subsequent node number Next_ID. The attribute state node structure table is shown in Table 3.

[0040] Table 3 Attribute status node structure table

[0041]

[0042]

[0043] Step E.2: Establish an attack behavior node structure table, that is, store the attack behavior nodes representing the attack tools and their parameters used when implementing the penetration test into the attack behavior node structure table.

[0044] The attack behavior node information can be expressed as {A1, A2, A3, A4, A5, A6, A7, A8}, where A1 represents the number of the attack behavior node, A2 represents the number of the penetration test plan to which the attack behavior node belongs, A3 represents the name of the attack behavior node, A4 represents the number of the attack tool in the attack tool library, A5 represents the parameters loaded into the attack tool, A6 represents the working status of the node, whether it has been executed or not, A7 represents the number of the previous node of the node, and A8 represents the number of the subsequent node of the node. The attack behavior node structure table is shown in Table 4.

[0045] Table 4 Attack behavior node structure table

[0046] Field Name type length illustrate AggressivebehaviorID Vchar 10 Attack behavior node number projectID Vchar 50 Solution No. Name Vchar 20 Attack behavior node name AggressivetoolID int 4 Attack tool ID parameter Vchar 200 Parameter 1, parameter 2, ... State char 1 state Prior_ID Vchar 10 Points to the node attribute status node ID Next_ID Vchar 10 This node points to the attribute status node ID

[0047] Step E.3: Establish a logical relationship node structure table, that is, store the logical relationship nodes representing the logical relationship between attribute state nodes in the logical relationship node structure table.

[0048] The logical relationship node information can be expressed as {L1, L2, L3, L4, L5, L6, L7, L8, L9}, where L1 represents the number of the logical relationship node, L2 represents the number of the penetration test plan to which the logical relationship node belongs, L3 represents the name of the logical relationship node, L4 represents the input logical relationship number, that is, "and" or "or", L5 represents the output logical relationship box number, that is, "and" or "or", L6 represents the working status of the node, that is, executed or not executed, L7 represents the set of node numbers of the node's previous attribute state, L8 represents the set of node numbers of the node's subsequent attribute state, and L9 represents the number of node numbers of the node's previous attribute state. The logical relationship node structure table is shown in Table 5.

[0049] Table 5 Logical relationship node structure table

[0050] Field Name type length illustrate LogicRelationshipID Vchar 10 Logical relationship node number projectID Vchar 50 Solution No. Name Vchar 20 Logical relationship node name import char 1 Enter logical relationship output char 1 Output logical relationship State char 1 state Prior_ID Vchar 40 Point to the node attribute status node ID1, ID2... Next_ID Vchar 40 This node points to the attribute status node ID1, ID2... Prior_IDNum int 4 The number of attribute status nodes pointing to this node

[0051] Step F: Analyze the network attack graph, that is, the test platform analyzes the network attack graph stored in the database in step E and automatically performs penetration testing on the target network.

[0052] Step F specifically includes:

[0053] Step F.1: Find the initial attribute state node, that is, find the initial attribute state node from the attribute state node structure table according to the "IntializtionCrunode" field, create a process to be responsible for the processing of the node. According to the value of the "Next_ID" field of the node, determine the content of the subsequent node, and call the corresponding process to process the subsequent node.

[0054] Step F.2: Parse the subsequent nodes according to the chain logic relationship. Starting from the initial attribute state node, the platform not only processes the current node, but also pre-processes the subsequent nodes, and calls the corresponding node processing process according to the subsequent node type, passing parameters, so as to intelligently implement the penetration test in the order described by the attack graph model.

[0055] Step F.2 specifically includes:

[0056] Step F.2.1: Attack behavior node processing, that is, when the subsequent node is an attack behavior node, find the attack tool number and parameter information of the node in the attack behavior structure table, then call the corresponding attack tool, write the parameters, and implement the attack.

[0057] Step F.2.2: Attribute state node processing, that is, when the subsequent node is an attribute state node, determine the current network state. If the target network state meets the information described by the attribute state node, find the subsequent node of the node in the attribute state node structure table.

[0058] Step F.2.3: Logical relationship node processing, that is, when the subsequent node is a logical relationship node, the output logical relationship of the node is obtained in the logical relationship node structure table according to the logical relationship node number and the scheme number, and the corresponding operation is taken. When the output logical relationship is "and", the logical relationship node processing unit creates an attribute state node processing process for each subsequent attribute state node.

[0059] When the output logical relationship is "or", the logical relationship node processing unit processes the subsequent attribute state nodes one by one. If the target network state meets the condition information described by the attribute state node, the logical relationship node processing unit reads the number of the subsequent node of the attribute state node from the attribute state node structure table and calls the corresponding node processing process for processing. If the network information structure table in step B does not match the condition information described by all attribute state nodes, the logical relationship node processing unit will terminate the penetration test and display the termination node information.

[0060] Compared with the prior art, the beneficial effects of the present invention are: the present invention scientifically summarizes the penetration test behavior, generates a network attack graph based on the Petri net according to the state of the target network and the capabilities of the attack tool, realizes a graphical description of the penetration test process, and stores the relevant information in the test platform database; and automatically generates a penetration test strategy according to the analysis results of the Petri net.

[0061] Compared with other penetration testing methods, the present invention realizes dynamic adjustment of the penetration testing process. During the penetration testing process, if the system state changes, for example, the target system has a security patch update, the Petri net model can reflect this change in real time in the form of an attack graph, automatically adjust the test strategy, and avoid invalid test operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A testing environment for the method of the present invention;

[0063] Figure 2 is a flow chart of the steps of the method of the present invention;

[0064] Figure 3 It is a content diagram of the network information structure table after the port scanning in the method of the present invention is completed;

[0065] Figure 4 It is a content diagram of the network information structure table after the vulnerability scanning in the method of the present invention is completed;

[0066] Figure 5 A mold for designing an attack graph in the method of the present invention;

[0067] Figure 6 A network attack graph is obtained by the method of the present invention;

[0068] Figure 7 Graph showing changes in network connection relationships before and after the PC1 buffer zone attack in the embodiment. DETAILED DESCRIPTION

[0069] In order to make the objectives, technical methods and advantages of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0070] The penetration testing method provided in this embodiment can be applied in Figure 1 In a Gigabit network application environment. The equipment used includes: a router, a switch, n PCs, and an intelligent penetration test server. The ultimate goal is to conduct a penetration test on the terminal PC1.

[0071] like Figure 2 As shown, an intelligent penetration testing method based on Petri net includes:

[0072] Step A: Establish an attack tool library, that is, collect attack tools that can perform penetration testing, and integrate the attack tools into the test platform database. Tables 6 to 10 are structure tables of the attack tool library in the embodiment:

[0073] Table 6 Scanning tool structure table

[0074] Field Name type length illustrate ID int 4 1 name Vchar 20 Scanning Tools location Vchar 20 D:\Attack tools parameter Vchar 200 none

[0075] Table 7 Denial of Service Attack Tool Structure

[0076] Field Name type length illustrate ID int 4 2 name Vchar 20 Denial of Service Attack Tools location Vchar 20 D:\Attack tools parameter Vchar 200 IP address 1, IP address 2...

[0077] Table 8 SMB protocol vulnerability exploit tool structure table

[0078] Field Name type length illustrate ID int 4 3 name Vchar 20 SMB protocol vulnerability exploit tool location Vchar 20 D:\Attack tools parameter Vchar 200 IP address, transfer file path

[0079] Table 9 Buffer overflow tool structure table

[0080]

[0081]

[0082] Table 10 Deception attack tool structure table

[0083]

[0084] Step B: Scan the target network and establish a network information structure table, that is, use scanning tools such as Nmap and NetScan to sniff and scan the target network, obtain relevant information of the target network, and store the obtained parameter information in the network information structure table. Tables 11 and 12 are network information structure tables of the embodiment. After the port scan is completed, the contents of the network information structure table are as follows: Figure 3 As shown, after the vulnerability scan is completed, the contents of the network information structure table are as follows Figure 4 shown.

[0085] Table 11 Target host network information structure table

[0086] Field Name type length illustrate IP_Addr Vchar 20 192.168.1.2 Hostname Vchar 20 Test_A port Vchar 20 80,445 hole Vchar 50 MS08067

[0087] Table 12 Target host trusted host network information structure table

[0088] Field Name type length illustrate IP_Addr Vchar 20 192.168.1.4 Hostname Vchar 20 Test_B port Vchar 20 80,445 hole Vchar 50 Lack of flow control

[0089] Step C: Match the terminal parameter information obtained in step B with the parameter information of the attack tool in the attack tool library in step A.

[0090] According to the contents of the network information structure table 11 and table 12 of the embodiment, it can be known that: PC1 has MS08067 vulnerability, and TCP port 445 is open. PC2 provides Web services for PC1, and there is a TCP connection between PC1 and PC2. PC2 lacks flow control means, and PC1 can be deceptively attacked with the help of PC2.

[0091] According to the contents of attack tool library structure tables 6 to 10, we know that the system contains attack tools such as denial of service attack, deception attack, buffer overflow attack, etc., which meet the implementation conditions of penetration testing.

[0092] Step D: Create a network attack graph model.

[0093] Step D.1: Create a mold of the attack graph model, which contains three types of graph elements: attribute state node, attack behavior node, and logical relationship node, and save them. Figure 5 shown.

[0094] Step D.2: Draw a network attack graph, that is, draw a network attack graph based on Petri net according to the attack path obtained from the matching result of step C. The system uses Microsoft's Visio control for drawing.

[0095] Step D.2.1: Create an initial attribute state node primitive with the node parameter set to "empty".

[0096] Step D.2.2: Create a partial attack graph for the network detection phase. Starting from the initial attribute state node, draw a network attack graph. According to the content of the network information structure table in step B, match it with the attack tool library structure table, and find that the two hosts 192.168.1.2 and 192.168.1.4 in the target network have vulnerabilities, which can be used to implement penetration testing; among them, the target host IP address is 192.168.1.2, and there is a TCP connection between another host 192.168.1.4 in the target network and the target host. The target network state attribute state node is decomposed into two attribute state nodes, the target host PC1 attribute state node and the target host trust host PC2, through the "and branch" logical relationship node, that is, the target host trust host PC2 attribute state node contains a lack of flow control vulnerability.

[0097] Step D.2.3: Create a partial attack graph for the selected penetration testing tool. The target host PC1 attribute status node decomposes the three attribute status nodes of MS08067 vulnerability, TCP445 port opening, and TCP connection between PC1 and PC2 through the "and branch" logical relationship node. The target host trusts the PC2 attribute status node, which lacks a flow control vulnerability, and meets the implementation conditions of the denial of service attack in the attack tool library structure table. The system uses the denial of service attack to block the data communication of the target host trusts the PC2.

[0098] Step D.2.4: Draw an attack graph for the target network iteration. The two attribute status nodes of the target host PC1, MS08067 vulnerability and TCP445 port opening, meet the SMB protocol vulnerability attack conditions. The system uses the SMB protocol vulnerability to implant the Trojan file into the target host PC1. Based on the attribute status node of the target host PC1 "TCP connection with PC2", the system uses the ISN sequence number guessing tool to obtain the ISN sequence number of the TCP data communication between the target host PC1 and PC2.

[0099] Step D.2.5: Repeat step D.2.4. According to the feedback result of step D.2.4, the Trojan file has been successfully implanted into the target host PC1, which meets the conditions for implementing the buffer overflow attack. The buffer overflow attack is carried out on the target host PC1. With the help of the "and connection" logical relationship node, the two attribute status nodes "ISN sequence number for TCP data communication between PC1 and PC2" and "PC2 is blocked" are merged. Impersonate PC2 and send a data segment with a SYN flag to the target host PC1. After meeting the attribute status node condition of "receiving the SYN+ACK data packet from the target host PC1", impersonate PC2 to carry out a spoofing attack on the target host PC1.

[0100] After step D, we get the network attack diagram as follows: Figure 6As shown, it contains 15 attribute status nodes, 7 attack behavior nodes, and 4 logical relationship nodes.

[0101] The content of the rectangular box "Parameter Information" in the network attack diagram represents the parameter information obtained by the intelligent penetration test server using technical means. The content of the rectangular box "Penetration Process" represents the penetration means that can be taken using the above information. Places P13 and P15 are marked as "Terminated State", indicating the successful implementation of a certain penetration means.

[0102] Step E: Store the network attack graph. Store the relevant information of the attribute state node, attack behavior node, and logical relationship node in the test platform database. Figure 6 The data information of 15 attribute status nodes is stored in the test platform database in the format of Table 3, the data information of 7 attack behavior nodes is stored in the test platform database in the format of Table 4, and the data information of 4 logical relationship nodes is stored in the test platform database in the format of Table 5.

[0103] Step F: Parse the attack graph model. Parsing the attack graph model is a prelude to implementing intelligent penetration testing. The implementation process of penetration testing has certain timing-related characteristics. When storing node information, the system cannot guarantee that logically adjacent nodes are also physically adjacent. Therefore, the test platform uses a chain storage structure to represent the penetration test sequence. That is, when storing node information, the test platform will store the node's direct predecessor node number and direct successor node number information in addition to the node's own information.

[0104] Step F.1: Find the initial attribute state node. The system determines the logical order between nodes based on the initial attribute state node and the chain relationship between nodes. The initial attribute state node is used to identify the initial state of the penetration test and has no specific content. The initial attribute state node is a special attribute state node. In the attribute state structure table, i.e., Table 3, the "IntializtionCrunode" item of the initial attribute state node is 1, and the "IntializtionCrunode" item of other attribute state nodes is 0. In the process of creating the attack graph model, other nodes are not allowed to point to the initial attribute state node. In an embodiment, the system searches for relevant information of the initial attribute state node p1 from the test platform database, creates a process process1 for p1, and is responsible for processing the node. According to the "Next_ID" value of the attribute state node in the attribute state node structure table, the content of the subsequent node is determined, and the corresponding process is called to process the subsequent node.

[0105] Step F.2: Parse the subsequent nodes according to the chain logic relationship. In the embodiment, a total of four types of node processing processes are included: initial attribute state node processing unit, attribute state node processing unit, attack behavior node processing unit, and logic relationship node processing unit. According to the "Next_ID" value in the initial attribute state node structure table, it is determined that the subsequent node is an attack behavior node, and the attack behavior node processing unit is called to process the node; according to the "Next_ID" value in the attack behavior node T1 structure table, it is determined that the subsequent node p2 is an attribute state node, and the attribute state node processing unit is called to process the node; the above process is repeated until all the elements of the network attack graph are traversed and the penetration test is completed. The various types of node processing steps are as follows:

[0106] Step F.2.1: Attack behavior node processing. That is, when the subsequent node is an attack behavior node, the attack tool number and parameter information of the node are found in the attack behavior structure table, and then the corresponding attack tool is called, the parameters are written, and the attack is carried out. The changes in the network connection relationship before and after the PC1 buffer attack are as follows: Figure 7 shown.

[0107] Step F.2.2: Attribute status node processing. That is, when the subsequent node is an attribute status node, determine whether the current network state satisfies certain information in the {IP_Addr, Hostname, Port, Hole} information described by the attribute status node, and find the subsequent node of the node in the attribute status node structure table. If the subsequent node is an attack behavior node, call the attack behavior node processing unit for processing; if the subsequent node is a logical relationship node, call the logical relationship node processing unit for processing. On the contrary, if the target network state does not meet the condition information described by the attribute status node, the attribute status node processing unit will terminate the penetration test and display the termination node information.

[0108] Step F.2.3: Logical relationship node processing, that is, when the subsequent node is a logical relationship node, the output logical relationship of the node is obtained in the logical relationship node structure table according to the logical relationship node number and the scheme number, and corresponding operations are taken. When the output logical relationship is "and", the logical relationship node processing unit creates an attribute state node processing process for each subsequent attribute state node and performs corresponding processing. When the output logical relationship is "or", the logical relationship node processing unit processes the subsequent attribute state nodes one by one. If the target network state meets the conditional information described by the attribute state node, the logical relationship node processing unit reads the number of the subsequent node of the attribute state node from the attribute state node structure table and calls the corresponding node processing process for processing.

[0109] The present invention uses the attack graph to describe the entire process of penetration testing based on the network parameter information collected by technical means and the attack means integrated in the system, realizes the formal description of the penetration test plan, and stores the graph information in the database; by operating the database, the corresponding process is called to intelligently implement the penetration test. The present invention uses a variety of attack methods to implement penetration testing according to the target network status; in contrast, the method of patent CN202011147031 only builds a vulnerability knowledge base for vulnerability features, and implements vulnerability attacks on the target terminal by matching the corresponding vulnerabilities with the attack graph. It has fewer integrated attack methods and cannot implement multiple attack methods such as denial of service attacks and deception attacks, and discovers the security risks of the target network from a more comprehensive perspective.

[0110] The method of patent CN202410881109 uses deep learning to select a large number of data sets for training, classifies system services through system service type recognition models, and selects the best combination of penetration methods. However, when this method faces situations where target network parameter information is incomplete, such as black box networks, it is impossible to accurately match the recognition model; the present invention establishes an attack graph model based on the target network parameter information obtained by technical means, and successfully implements penetration testing when facing situations where target network parameter information is incomplete, such as black box networks.

[0111] Patent CN202410881114 performs state space representation based on text embedding technology, performs penetration test action decisions based on deep reinforcement learning, and iteratively trains the target network environment to achieve decision-making capability evolution. However, the training cycle of the above method is long. After training in the simulation environment, environmental migration is required to implement penetration testing in the actual network, and the target network needs to be retrained and migrated after taking certain protection measures, which greatly affects the efficiency of penetration testing. The model used in the present invention does not need to be trained and can be directly applied to actual network penetration testing activities. It can dynamically adjust the penetration testing strategy according to the target network status to improve the efficiency of penetration testing.

Claims

1. An intelligent penetration testing method based on Petri net, comprising: Step A: Establish an attack tool library, that is, collect attack tools that can perform penetration testing, integrate the attack tools into the test platform database, and form an attack tool library; Step B: Scan the target network and establish a network information structure table, that is, the test platform obtains the terminal parameter information of the target network with the help of the scanning tool; Step C: matching the terminal parameter information obtained in step B with the parameter information of the attack tool in the attack tool library in step A; Step D: Create a network attack graph based on Petri net, that is, according to the matching result of step C, if there is an attack path, create a network attack graph based on Petri net; Step E: Storing the network attack graph, that is, storing the network attack graph created in step D into the test platform database; Step F: Analyze the network attack graph, that is, the test platform analyzes the network attack graph stored in the database in step E and automatically performs penetration testing on the target network.

2. The intelligent penetration testing method based on Petri net as claimed in claim 1, characterized in that: In step A, the test platform computer manages the attack tools in the network attack library to add, delete, modify, and search the network attack tools in the network attack library; the attack tools are represented by {a1, a2, a3, a4, ... an}, where a1 represents the number of the attack tool, a2 represents the name of the attack tool, a3 represents the storage path of the attack tool, and a4-an represents the parameter information of the attack tool; The terminal parameter information obtained in step B can be expressed as {p1, p2, p3, p4}, where p1 represents the IP address, p2 represents the host name, p3 represents the communication port number, and p4 represents the vulnerability.

3. The intelligent penetration testing method based on Petri net as claimed in claim 2, characterized in that: The scanning tool in step B is Nmap or NetScan.

4. The intelligent penetration testing method based on Petri net as claimed in claim 1, characterized in that: Step D specifically includes: Step D.1: Create a mold, that is, define the graphic element information in the drawing software, form a drawing, and finally place the drawing in the toolbox of the drawing software; Step D.2: Draw a network attack graph, that is, draw a network attack graph based on Petri net according to the attack path obtained from the matching result of step C.

5. The intelligent penetration testing method based on Petri net as claimed in claim 4, characterized in that: Step D.1 includes: Step D.1.1: Draw the primitive symbol in the drawing area, that is, use a spreadsheet to set attribute information for the primitive, the number and type of parameters attached to the primitive; Step D.1.2: Create a mold, that is, define the graphic element information in the drawing software, form a drawing, and finally place the drawing in the toolbox of the drawing software; Step D.1.3: Generate attribute status nodes, that is, the system draws attribute status node primitives on the topology interface, sets the conditions to be satisfied by subsequent attack behavior nodes, and writes configuration parameter information into the database; Step D.1.4: Generate an attack behavior node, that is, the system draws an attack behavior node graphic element on the topology interface, associates it with the attack tool in the attack tool library in step A, sets the parameter information of the attack tool, and writes the path for calling the attack tool and the parameter information of the attack tool into the database; Step D.1.5: Generate logical relationship nodes, that is, the system draws logical relationship node graphics in the topology interface, and writes the node number information connected to it into the database according to the set logical relationship.

6. The intelligent penetration testing method based on Petri net as claimed in claim 5, characterized in that: In step D.1.1, three types of primitives are included: attribute state node, attack behavior node, and logical relationship node.

7. The intelligent penetration testing method based on Petri net as claimed in claim 4, characterized in that: Step D.2 includes: Step D.2.1: Create an initial attribute state node primitive, that is, draw an initial attribute state node in the network attack graph; Step D.2.2: Create a partial attack graph in the network detection phase, that is, the system draws a scanning tool primitive on the topology interface, connects the initial attribute state node in step D.2.1 with the scanning tool primitive using a connecting line, that is, points from the initial attribute state node to the scanning tool, and outputs the target network parameter information primitive; Step D.2.3: Create a partial attack graph for selecting penetration testing tools, that is, compare the target network parameter information {p1, p2, p3, p4…pn} with the parameter information of the attack tools {a1, a2, a3, a4,…an} in the attack tool library of step A, find the attack tools that are consistent with the target network parameter information, that is, find the attack tool set {ai,…aj} that can implement penetration testing; automatically add the attack tool set {ai,…aj} graphic element to the attack graph; Step D.2.4: Draw an attack graph for the target network iteratively, that is, use connecting lines to connect the target network parameter information set {p1, p2, p3, p4…pn} graph elements with the matching attack tool set {ai,…aj} graph elements, output the target network parameter information set after the attack, match it with the attack tool set, and find the attack tool that can be used to implement the penetration test; Step D.2.5: Repeat step D.2.4 until the match between the target network parameter information set and the attack tool set is an empty set.

8. The intelligent penetration testing method based on Petri net as claimed in claim 7, characterized in that: In step D.2.1, the attribute state information of the initial attribute state node primitive is an empty set.

9. The intelligent penetration testing method based on Petri net as claimed in claim 1, characterized in that: Step E includes: Step E.1: Establish an attribute state node structure table, that is, store the attribute state node representing the attribute state required when a certain attack method is running into the attribute state node structure table; Step E.2: Establish an attack behavior node structure table, that is, store the attack behavior nodes representing the attack tools and their parameters used when implementing the penetration test into the attack behavior node structure table; Step E.3: Establish a logical relationship node structure table, that is, store the logical relationship nodes representing the logical relationship between attribute state nodes in the logical relationship node structure table.

10. The intelligent penetration testing method based on Petri net according to claim 1, characterized in that: Step F comprises: Step F.1: Find the initial attribute state node, that is, the system determines the logical order between nodes based on the initial attribute state node and the chain relationship between nodes; Step F.2: parse the subsequent node according to the chain logic relationship, that is, according to the "Next_ID" value in the initial attribute state node structure table, determine that the subsequent node is an attack behavior node, and call the attack behavior node processing unit to process the node; according to the "Next_ID" value in the attack behavior node structure table, determine that the subsequent node is an attribute state node, and call the attribute state node processing unit to process the node; Step F.2 includes: Step F.2.1: Attack behavior node processing, that is, when the subsequent node is an attack behavior node, the attack tool number and parameter information of the node are found in the attack behavior structure table, and then the corresponding attack tool is called, the parameters are written, and the attack is carried out; Step F.2.2: attribute state node processing, that is, when the subsequent node is an attribute state node, determine the current network state, and if the target network state satisfies the attribute state node description information, find the subsequent node of the node in the attribute state node structure table; Step F.2.3: Logical relationship node processing, that is, when the subsequent node is a logical relationship node, the output logical relationship of the node is obtained in the logical relationship node structure table according to the logical relationship node number and the scheme number, and corresponding operations are taken. When the output logical relationship is "and", the logical relationship node processing unit creates an attribute status node processing process for each subsequent attribute status node.

Images