Automatic penetration testing method and system

Abstract

The invention discloses an automatic penetration testing method and system, and the method comprises the steps: building a protection capability baseline for a target network system, and setting network basic parameters according to the safety protection level; deploying an attack agent in each level of network of the target network system, and simulating a skipping machine after hacker attack; creating an automatic penetration task, detecting an exposed surface of each level of network, and collecting vulnerability information; performing vulnerability scanning based on the collected vulnerability information, and judging an attack target, a vulnerability type and an attack level which can be utilized by the exposed surface; judging whether to enter a permeation task of a next-level network or not through a permeation decision; if yes, the attack agent establishes covert communication with the outside, and a penetration task of a next-level network of the attack agent is started; and forming a penetration test result report based on the penetration data of the network of each level, and giving a pre-estimation probability of the penetration of the network of each level. According to the invention, the deep test of the whole network penetration attack can be rapidly realized.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to an automated penetration testing method and system. Background Art

[0002] Network security penetration testing is a method of evaluating the security performance of computer network systems by simulating the attack methods of malicious hackers. This testing method can find vulnerabilities, technical defects or malware in the system to help enterprises or organizations strengthen the security of information systems. Penetration testing usually includes two stages: the first stage is a series of information collection and reconnaissance to find the attack target, which includes network mapping, collecting information related to the target system (such as open ports, services, applications, protocols, etc.), and using public channels to obtain information from the organization; the second stage is the actual penetration process, including using manual testing and automated testing tools to analyze the collected information and try to attack the target system. The attack method is generally to find the vulnerabilities of the attack target first, use public and private vulnerability attack methods, and attack and penetrate the target object. These attack behaviors may be denial of service, data leakage, data destruction, injection into the target, remote control, etc. By simulating the utilization link of real hacker attacks, the in-depth security protection effect of the entire network is evaluated.

[0003] At present, general penetration testing tools are used by the attack platform to locate the target using information collection tools, vulnerability scanning tools, and vulnerability exploitation tools, and to complete the implantation of malware and the maintenance and construction of the attack chain with supporting privilege escalation tools, lateral movement tools, data theft and backdoor implantation tools, agents and tunnel tools. In actual use, information collection tools, vulnerability scanning tools, and vulnerability libraries are relatively open and generalized technologies in the industry. The use of general technologies can achieve rapid data accumulation and program construction. For example, the vulnerability library can have crawlers to collect CVE, and CNNVD public vulnerability libraries can complete the collection of more than 500,000 vulnerabilities. However, exploiting vulnerabilities and writing attack programs POC that exploit vulnerabilities require a large number of security researchers to develop. The development process involves building a target machine environment, vulnerability analysis, vulnerability attack program writing, etc. Therefore, in conventional penetration tools, the number of POC scripts for exploiting vulnerabilities is often only a few thousand, and the number of truly effective attacks to achieve penetration POC is even less. After the vulnerability is discovered, the exp attack script is injected through the vulnerability, and the number of exps that can achieve penetration injection is only a few hundred at most.

[0004] Given the current capabilities of penetration testing tools, current penetration testing tools face great challenges in achieving automated deep penetration. They can often only achieve general information collection on a layer of exposed networks, and can only perform password scanning and vulnerability scanning functions on exposed network surfaces. It is difficult to quickly achieve deep penetration attacks based on real hacker attack functions, and cannot complete the purpose of whole network penetration assessment. The penetration test results only represent the attack results of the penetration attacker on the network, and cannot reflect the potential threat capabilities of external hackers at all levels to the network. Therefore, they are limited by the capabilities of the attacker, and the penetration test results are very one-sided. Summary of the invention

[0005] In view of the problems that current automated penetration tools are difficult to conduct rapid and deep penetration and difficult to reflect the penetration risks of hackers at various levels of capabilities into the network, the present invention proposes an automated penetration testing method and system, which adopts a simulated penetration method, evaluates the collected information, models the information of attack data and defense data, dynamically evaluates the possibility of successful attack penetration at each stage, and cooperates with pre-deployed attack agents to quickly achieve in-depth testing of penetration attacks on the entire network.

[0006] The technical solution adopted by the present invention is as follows:

[0007] In one aspect, the present invention provides an automated penetration testing method, comprising:

[0008] Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0009] Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0010] Create automated penetration tasks to detect exposure surfaces at all levels of the network and collect vulnerability information;

[0011] Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0012] Based on the vulnerability scanning results of each level of network exposure, the penetration decision is made to determine whether to enter the penetration task of the next level of network; if so, the attack agent establishes covert communication with the outside world and starts the penetration task of the next level of network of the attack agent;

[0013] A penetration test result report is generated based on the penetration data of each level of the network, and the estimated probability of penetration of each level of the network is given.

[0014] Furthermore, the vulnerability scanning results based on each level of network exposure surface determine whether to enter the penetration task of the next level of network through penetration decision, including: evaluating the possibility of vulnerability being exploited for attack based on exposure surface vulnerability information, and / or evaluating the possibility of vulnerability being exploited for attack based on exposure surface software popularity, and then determining whether to enter the penetration task of the next level of network.

[0015] Furthermore, the possibility of vulnerability being exploited and attacked based on the exposed surface vulnerability information is evaluated, including:

[0016] Based on weak password assessment, vulnerability and blasting script assessment, the technical complexity, public information, defense measures and novelty of the vulnerability are scored, and the possibility of the vulnerability being exploited is calculated; when the vulnerability type is file injection, remote execution or remote control type, the vulnerability can be exploited for deep penetration.

[0017] Furthermore, the possibility of vulnerability being exploited for attack is evaluated based on the exposed surface vulnerability information, and the calculation method includes:

[0018] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0019] Among them, P(vul) represents the probability of penetration through the exposed surface vulnerability information, Nc(vul) represents the vulnerability complexity index, Tv(vul) represents the vulnerability novelty index, R(vul) represents the vulnerability interception parameter, and Hx represents the host protection index.

[0020] Furthermore, the calculation method of the vulnerability complexity index includes:

[0021] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0022] Among them, C vul Indicates the complexity of the vulnerability; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 represents the complexity parameter of the public vulnerability. Gr represents the hacker technology level faced by the target network system.

[0023] Furthermore, the calculation method of the vulnerability novelty index includes:

[0024] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0025] Among them, t vIndicates the number of months from the current time when the vulnerability was made public.

[0026] Furthermore, the vulnerability interception parameter R(vul)=0 or 1, and the vulnerability interception parameter can be accessed through the penetration platform to verify whether the target network security protection device intercepts the access, and obtains a value; the host protection index Hx is obtained according to the security verification test results, system setting parameters or virus protection verification based on the exposed server environment.

[0027] Furthermore, the method of evaluating the possibility of a vulnerability being exploited for attack based on the popularity of the exposed software includes: in the case where the exposed software has no public vulnerabilities, evaluating the possibility of the software being exploited by hackers of various levels based on the historical vulnerabilities of the exposed software.

[0028] Furthermore, the probability of vulnerability being exploited for attack is evaluated based on the exposure software popularity, and the calculation method includes:

[0029] P (s) =S s / S base *Cs*C svul / V count

[0030] Among them, P (s) represents the probability of penetration through the popularity of the exposed software; S s Represents the popularity index of the software, S base is a constant; Cs represents the software vulnerability index in the past few years, C s =V count / V base, Max(C s )=1,V count Represents the number of software vulnerabilities in the past few years, V base is a constant; C svul Indicates the number of penetration vulnerabilities in the past few years.

[0031] On the other hand, the present invention provides an automated penetration testing system, comprising:

[0032] A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0033] The attack proxy module is configured to deploy attack proxies at all levels of the target network system to simulate the jump machine after the hacker attack;

[0034] The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information;

[0035] A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited by the exposed surface;

[0036] The penetration decision module is configured to determine whether to enter the penetration task of the next level of network based on the vulnerability scanning results of each level of network exposure surface through penetration decision; if so, the attack agent establishes covert communication with the outside and starts the penetration task of the next level of network of the attack agent;

[0037] The data analysis module is configured to form a penetration test result report based on the penetration data of each level of the network, and provide an estimated probability of penetration of each level of the network.

[0038] The beneficial effects of the present invention are:

[0039] The present invention adopts a simulated penetration method, through the evaluation of collected information, information modeling of attack data and defense data, dynamically evaluates the possibility of successful attack penetration at each stage, and cooperates with pre-deployed attack agents to quickly implement in-depth testing of penetration attacks on the entire network. The present invention evaluates the possibility of penetration of the entire network by calculating the penetration assessment probability and setting the attack agent, avoiding the defect that traditional automated penetration can only detect one layer of exposed surface due to the lack of vulnerability exploitation scripts, 0day vulnerabilities, etc. The present invention can intuitively evaluate the probability of penetration of the target network before various intensities of hacker attacks, including the probability of successful attacks on each layer of the network, which is more in line with the evaluation requirements of actual network penetration capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of an automated penetration testing method according to Embodiment 1 of the present invention.

[0041] Figure 2 This is a flow chart of an automated penetration testing method according to Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0042] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific implementation methods of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention, that is, the embodiments described are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] like Figure 1 As shown, this embodiment provides an automated penetration testing method, including:

[0045] Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0046] Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0047] Create automated penetration tasks to detect exposure surfaces at all levels of the network and collect vulnerability information;

[0048] Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0049] Based on the vulnerability scanning results of each level of network exposure, the penetration decision is made to determine whether to enter the penetration task of the next level of network; if so, the attack agent establishes covert communication with the outside world and starts the penetration task of the next level of network of the attack agent;

[0050] A penetration test result report is generated based on the penetration data of each level of the network, and the estimated probability of penetration of each level of the network is given.

[0051] In this embodiment, a protection capability baseline is first established for the target network system, and basic network parameters are set, such as the level of protection compliance that needs to be met in network compliance and whether it belongs to the protection scope of critical infrastructure. These parameters represent the level of hacker capabilities that the network may face.

[0052] The method of this embodiment has newly classified and evaluated the vulnerability information. According to the impact of the vulnerability on the business, it can be divided into: denial of service, information leakage, file leakage, database leakage, file injection, remote execution, information tampering, remote control, etc. Through the analysis of vulnerability information, the possibility of hackers completing the target penetration is estimated. If the penetration possibility is greater than the set threshold, the attack agent is used to achieve a deep penetration attack jump and the next round of vulnerability assessment is carried out; if there is no vulnerability information, the zero-day vulnerability risk of the software is estimated based on the historical vulnerability of the business software of the target network, and the risk of hackers penetrating through unknown vulnerabilities is assessed. When the overall risk is greater than the threshold, the attack agent is used to enter the next level of network assessment.

[0053] In this embodiment, the penetration decision can be made by evaluating the possibility of a vulnerability being exploited based on the vulnerability information of the exposed surface, and evaluating the possibility of a vulnerability being exploited based on the popularity of the exposed surface software, and then determining whether to enter the penetration task of the next level network.

[0054] Preferably, the possibility of vulnerability being exploited for attack is evaluated based on the vulnerability information of the exposed surface, including: based on weak password evaluation, vulnerability and blasting script evaluation, the technical complexity, public information, defense measures and novelty of the vulnerability are scored, and the possibility of vulnerability being exploited for attack is calculated; when the vulnerability type is file injection, remote execution or remote control type, the vulnerability can be exploited for deep penetration. Specifically, the calculation method includes:

[0055] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0056] Among them, P(vul) represents the probability of penetration through the exposed surface vulnerability information, Nc(vul) represents the vulnerability complexity index, Tv(vul) represents the vulnerability novelty index, R(vul) represents the vulnerability interception parameter, and Hx represents the host protection index.

[0057] More preferably, the calculation method of the vulnerability complexity index includes:

[0058] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0059] Among them, C vul Indicates the complexity of the vulnerability; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 represents the complexity parameter of the public vulnerability. Gr represents the hacker technology level faced by the target network system.

[0060] More preferably, the calculation method of the vulnerability novelty index includes:

[0061] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0062] Among them, t v Indicates the number of months from the current time when the vulnerability was made public.

[0063] More preferably, the vulnerability interception parameter R(vul)=0 or 1. The vulnerability interception parameter can verify access through the penetration platform and obtain a value based on whether the target network security protection device intercepts the access. It represents the host protection index Hx, and the value is obtained based on the security verification test results, system setting parameters or virus protection verification based on the exposed server environment.

[0064] Preferably, the possibility of vulnerability being exploited based on the popularity of the exposed software includes: if there is no public vulnerability in the exposed software, the possibility of the software being exploited by hackers of various levels is evaluated based on the historical vulnerability of the exposed software. Specifically, the calculation method includes:

[0065] P (s) =S s / S base *Cs*C svul / V count

[0066] Among them, P (s) represents the probability of penetration through the popularity of the exposed software; S s Represents the popularity index of the software, S base is a constant; Cs represents the software vulnerability index in the past few years, C s =V count / V base, Max(C s )=1,V count Represents the number of software vulnerabilities in the past few years, V base is a constant; C svul Indicates the number of penetration vulnerabilities in the past few years.

[0067] Example 2

[0068] This embodiment is based on embodiment 1:

[0069] like Figure 2 As shown, this embodiment provides an automated penetration testing method, including:

[0070] 1. Penetration parameter setting: After the system is initialized and deployed, the penetration parameter setting is based on the security protection level of the verification object. The parameters include the security protection level of the target network, whether it is a critical infrastructure, and what level of hacker attack it may face. Based on the settings, the attacker's attack skills and available attack resources are judged.

[0071] 2. Deploy attack agents: By deploying attack agents in each layer of the network, simulate the jump machine after a hacker attack.

[0072] 3. Create automated penetration tasks: Create automated penetration tasks. The task information includes the attack entry of the target network, such as IP segment and domain name information; set parameters such as attack depth and detection time.

[0073] 4. Conduct exposure detection and collect vulnerability information: Through information collection and vulnerability scanning, determine the attack targets that can be exploited on the exposure surface, based on the vulnerability type and attack level. Vulnerability information includes vulnerability exploitation difficulty, whether the vulnerability POC is public, vulnerability penetration type, vulnerability release time, etc. At the same time, collect the name of the business software on the exposure surface, the historical vulnerability information of the software, etc.

[0074] 5. Intelligent penetration decision: Based on the resource scanning and information collection results of each layer of exposure, the module determines whether it can enter the next layer of penetration task through the penetration decision algorithm. The judgment is based on the following: 1) Whether the penetration of the system vulnerability blasting program is completed; 2) Judging based on the scanning of the system weak password; 3) Judging the possibility of hacker intrusion based on vulnerabilities, resources, exposure, and protection level. Through method 1) and method 2), penetration attacks can be actually carried out. If the index obtained through method 3) is greater than the threshold, the attack agent pre-deployed in the inner layer is started and the attack agent is used.

[0075] 6. The attack agent establishes covert communication with the outside world and initiates the next level of penetration activity of the attack agent.

[0076] 7. Repeat steps 4 to 6 for each level of attack penetration; based on the penetration data of each layer, form a report on the results of this penetration test, which gives the estimated probability of network penetration at each level.

[0077] In this embodiment, by deploying attack agents, simulating penetration results, and performing in-depth jump simulations, judgments are made through the intelligent penetration decision module, and evaluation modeling is performed based on vulnerability classification information, attack difficulty, whether the vulnerability POC is public, and preset system parameters to calculate the probability that a real hacker can successfully complete the penetration, and determine whether to conduct an attack penetration to the next level of the network.

[0078] It should be noted that the attack and penetration channels in this embodiment are divided into two categories:

[0079] 1. Based on the vulnerability information assessment of the exposed surface: weak password assessment, vulnerability and blasting script assessment, the technical complexity of the vulnerability, public information, defense measures, and novelty of the vulnerability are scored. When the vulnerability type is file injection, remote execution, or remote control, the vulnerability can be deeply penetrated, and the possibility of the vulnerability being exploited is calculated through an algorithm.

[0080] 2. Evaluation based on the popularity of exposed software: If there are no public vulnerabilities in the exposed software, evaluate the possibility of the software being exploited by hackers of various levels based on the historical vulnerabilities of the exposed software.

[0081] Among them, the evaluation algorithm for vulnerability penetration is as follows:

[0082] 1. Evaluation algorithm through known vulnerabilities penetration:

[0083] Complexity Index:

[0084] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0085] Among them, C vul Indicates the complexity of the vulnerability, with a value of 1-5; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0; B0 is the public vulnerability complexity parameter, with a fixed value of 3 / 5; G r Indicates the hacker technology level that the network faces, with values ​​of 2 / 5 for level 2, 3 / 5 for level 3, and 4 / 5 for level 4 respectively.

[0086] Vulnerability Novelty Index:

[0087] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0088] Among them, t v Indicates the number of months from the current time when the vulnerability was made public.

[0089] Vulnerability blocking parameters:

[0090] R(vul)=0 or 1

[0091] The vulnerability interception parameter can be accessed through the penetration platform to verify the access and obtain the value according to whether the target network security protection device intercepts the access.

[0092] Host protection index: H x The value is determined based on the security verification test results, which are obtained through system setting parameters or virus protection verification based on the exposed server environment.

[0093] Therefore, the probability that the vulnerability can be exploited is calculated as follows:

[0094] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0095] For the network at this level, the probability of successful penetration is:

[0096]

[0097] 2. Probability assessment of penetration through popular software:

[0098] P(s) =S s / S base *Cs*C svul / V count

[0099] Among them, S s Indicates the popularity index of the software, with a value of 1 to 5. For example, the value of common software such as Windows, openssl, mysql, ssh, apach, tomcat, etc. is 5; S base The fixed value is 5; C s represents the software vulnerability index in the past three years, C s =V count / V base ,Max(C s )=1,V count Represents the number of software vulnerabilities in the past three years, V base Take a constant value of 5; C svul Indicates the number of penetration vulnerabilities of the software in the past three years.

[0100] Therefore, the probability of attack based on software popularity is evaluated as follows:

[0101]

[0102] 3. The probability of the entire network being vulnerable to penetration attacks is assessed as follows:

[0103] P=P net +P p ,(P<=1)

[0104] To sum up, in the penetration task, the probability assessment of each layer of the network being attacked is given, presenting a probability sequence: P1, P2, P3..., which represents the estimated probability of each layer of the network being penetrated under the attack corresponding to the network level protection.

[0105] Example 3

[0106] This embodiment provides an automated penetration testing system, including:

[0107] A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0108] The attack proxy module is configured to deploy attack proxies at all levels of the target network system to simulate the jump machine after the hacker attack;

[0109] The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information;

[0110] A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited by the exposed surface;

[0111] The penetration decision module is configured to determine whether to enter the penetration task of the next level of network based on the vulnerability scanning results of each level of network exposure surface through penetration decision; if so, the attack agent establishes covert communication with the outside and starts the penetration task of the next level of network of the attack agent;

[0112] The data analysis module is configured to form a penetration test result report based on the penetration data of each level of the network, and provide an estimated probability of penetration of each level of the network.

[0113] Example 4

[0114] This embodiment is based on embodiment 1:

[0115] This embodiment provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the automated penetration testing method of Embodiment 1 is implemented. The computer program may be in source code form, object code form, executable file, or some intermediate form.

[0116] Example 5

[0117] This embodiment is based on embodiment 1:

[0118] This embodiment provides a computer-readable storage medium storing a computer program, which implements the automated penetration testing method of Embodiment 1 when executed by a processor. The computer program may be in source code form, object code form, executable file, or some intermediate form. The storage medium includes: any entity or device capable of carrying computer program code, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content contained in the storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the storage medium does not include electric carrier signals and telecommunication signals.

[0119] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Claims

1. An automated penetration testing method, characterized in that: include: Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level; Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack; Create automated penetration tasks to detect exposure surfaces at all levels of the network and collect vulnerability information; Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface; Based on the vulnerability scanning results of each level of network exposure, the penetration decision is made to determine whether to enter the penetration task of the next level of network; if so, the attack agent establishes covert communication with the outside world and starts the penetration task of the next level of network of the attack agent; A penetration test result report is generated based on the penetration data of each level of the network, and the estimated probability of penetration of each level of the network is given.

2. An automated penetration testing method according to claim 1, characterized in that: The vulnerability scanning results based on each level of network exposure surface determine whether to enter the penetration task of the next level of network through penetration decision, including: evaluating the possibility of vulnerability being exploited for attack based on exposure surface vulnerability information, and / or evaluating the possibility of vulnerability being exploited for attack based on exposure surface software popularity, and then determining whether to enter the penetration task of the next level of network.

3. An automated penetration testing method according to claim 2, characterized in that: The possibility of vulnerability being exploited based on the exposed surface vulnerability information is assessed, including: Based on weak password assessment, vulnerability and blasting script assessment, the technical complexity, public information, defense measures and novelty of the vulnerability are scored, and the possibility of the vulnerability being exploited is calculated; when the vulnerability type is file injection, remote execution or remote control type, the vulnerability can be exploited for deep penetration.

4. An automated penetration testing method according to claim 2, characterized in that: The method for evaluating the possibility of vulnerability being exploited based on the exposed surface vulnerability information includes: P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx) Among them, P(vul) represents the probability of penetration through the exposed surface vulnerability information, Nc(vul) represents the vulnerability complexity index, Tv(vul) represents the vulnerability novelty index, R(vul) represents the vulnerability interception parameter, and Hx represents the host protection index.

5. An automated penetration testing method according to claim 4, characterized in that: The calculation method of the vulnerability complexity index includes: Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1 Among them, C vul Indicates the complexity of the vulnerability; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 represents the complexity parameter of the public vulnerability. Gr represents the hacker technology level faced by the target network system.

6. An automated penetration testing method according to claim 4, characterized in that: The calculation method of the vulnerability novelty index includes: Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1 Among them, t v Indicates the number of months from the current time when the vulnerability was made public.

7. An automated penetration testing method according to claim 4, characterized in that: The vulnerability interception parameter R(vul)=0 or 1, and the vulnerability interception parameter can be accessed through the penetration platform and obtain a value according to whether the target network security protection device intercepts the access; The host protection index Hx is obtained according to the security verification test results, system setting parameters or virus protection verification based on the exposed server environment.

8. An automated penetration testing method according to claim 2, characterized in that: The method of evaluating the possibility of a vulnerability being exploited for attack based on the popularity of the exposed software includes: in the case where the exposed software has no public vulnerabilities, evaluating the possibility of the software being exploited by hackers of various levels based on historical vulnerabilities of the exposed software.

9. An automated penetration testing method according to claim 8, characterized in that: The probability of vulnerability being exploited and attacked is evaluated based on the exposure software popularity, and the calculation method includes: P (s) =S s / S base *Cs*C svul / V count Among them, P (s) represents the probability of penetration through the popularity of the exposed software; S s Represents the popularity index of the software, S base is a constant; Cs represents the software vulnerability index in the past few years, C s =V count / V base, Max(C s )=1,V count Represents the number of software vulnerabilities in the past few years, V base is a constant; C svul Indicates the number of penetration vulnerabilities in the past few years.

10. An automated penetration testing system, characterized in that: include: A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level; The attack proxy module is configured to deploy attack proxies at all levels of the target network system to simulate the jump machine after the hacker attack; The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information; A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited by the exposed surface; The penetration decision module is configured to determine whether to enter the penetration task of the next level of network based on the vulnerability scanning results of each level of network exposure surface through penetration decision; if so, the attack agent establishes covert communication with the outside and starts the penetration task of the next level of network of the attack agent; The data analysis module is configured to form a penetration test result report based on the penetration data of each level of the network, and provide an estimated probability of penetration of each level of the network.

Images