Automated penetration testing method and system

Abstract

The present invention discloses an automated penetration testing method and system, which includes: establishing a protection capability baseline for a target network system and setting basic network parameters according to the security protection level; deploying attack agents at each network level of the target network system to simulate a jump machine after a hacker attack; creating an automated penetration task to detect the exposed surface of each network level and collect vulnerability information; performing vulnerability scanning based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface; determining whether to proceed to the penetration task of the next network level through penetration decision-making; if so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next network level of the attack agent; generating a penetration test result report based on the penetration data of each network level, and providing an estimated probability of penetration of each network level. The present invention can quickly achieve in-depth testing of penetration attacks across the entire network.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and in particular to an automated penetration testing method and system. Background Art

[0002] Network security penetration testing is a method used to assess the security performance of computer network systems by simulating the attack methods of malicious hackers. This testing method can identify vulnerabilities, technical flaws, or malware in the system, helping organizations strengthen the security of their information systems. Penetration testing typically consists of two phases: the first phase involves a series of information gathering and reconnaissance to identify the target. This includes network mapping, collecting information related to the target system (such as open ports, services, applications, protocols, etc.), and leveraging publicly available sources to obtain information about the organization. The second phase involves the actual penetration process, which involves analyzing the collected information using manual and automated testing tools and attempting to attack the target system. This attack typically begins by identifying vulnerabilities in the target, using both public and private exploits, and then conducting attacks and penetration tests against the target. These attacks may involve denial of service, data leakage, data destruction, injection, and remote control. By simulating the exploitation chain of a real hacker attack, the effectiveness of in-depth security protection across the entire network is assessed.

[0003] Currently, typical penetration testing tools consist of attack platforms utilizing information collection tools, vulnerability scanning tools, and vulnerability exploitation tools to locate targets. These tools are then supplemented with privilege escalation tools, lateral movement tools, data theft and backdoor implantation tools, proxies, and tunneling tools to implant malware and maintain and build attack chains. In practice, information collection tools, vulnerability scanning tools, and vulnerability libraries are relatively open and widely used within the industry. These common technologies enable rapid data accumulation and program development. For example, vulnerability libraries can use crawlers to collect Common Vulnerabilities and Exposures (CVEs), and CNNVD's public vulnerability library has collected over 500,000 vulnerabilities. However, exploiting vulnerabilities and writing proof-of-concept (PoC) attack scripts to exploit them requires significant development effort from security researchers. This development process involves setting up a target environment, vulnerability analysis, and developing exploitation programs. Consequently, conventional penetration testing tools often only have a few thousand PoC scripts for exploiting vulnerabilities, and even fewer that actually achieve effective attacks and penetration. Once a vulnerability is discovered, exploit scripts can be injected with exploits, but the number of exploits that can achieve penetration is often limited to a few hundred.

[0004] Given the current capabilities of penetration testing tools, achieving automated deep penetration is challenging. They are often limited to general information collection on a single exposed network layer, performing password scanning and vulnerability scanning on exposed network surfaces. This makes it difficult to rapidly conduct deep penetration attacks based on true hacker attack capabilities, effectively failing to achieve the goal of a full-network penetration assessment. Penetration test results only represent the attack results of the attacker on the network and fail to reflect the potential threat capabilities of external hackers at all levels. Consequently, due to the limitations of the attacker's capabilities, penetration test results are highly biased. Summary of the Invention

[0005] In response to the problems that current automated penetration tools are difficult to conduct rapid and deep penetration and difficult to reflect the penetration risks of hackers at various levels of capabilities, the present invention proposes an automated penetration testing method and system. By adopting a simulated penetration method, through the evaluation of collected information, information modeling of attack data and defense data, the possibility of successful attack penetration at each stage is dynamically evaluated. In conjunction with pre-deployed attack agents, in-depth testing of penetration attacks on the entire network can be quickly achieved.

[0006] The technical solution adopted in the present invention is as follows:

[0007] In one aspect, the present invention provides an automated penetration testing method, comprising:

[0008] Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0009] Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0010] Create automated penetration tasks to detect exposures at all levels of the network and collect vulnerability information;

[0011] Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0012] Based on the vulnerability scan results of each network layer's exposed surface, a penetration decision is made to determine whether to proceed to the penetration task of the next layer of the network. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network.

[0013] A penetration test result report is generated based on the penetration data of each layer of the network, and an estimated probability of penetration of each layer of the network is given.

[0014] Furthermore, the vulnerability scanning results based on the exposed surface of each level of the network are used to determine whether to enter the penetration task of the next level of the network through penetration decision-making, including: evaluating the possibility of the vulnerability being exploited for attack based on the vulnerability information of the exposed surface, and / or evaluating the possibility of the vulnerability being exploited for attack based on the popularity of the exposed surface software, and then determining whether to enter the penetration task of the next level of the network.

[0015] Furthermore, the assessment of the possibility of vulnerability being exploited based on the exposed surface vulnerability information includes:

[0016] Based on weak password assessment, vulnerability and brute force script assessment, the technical complexity, public information, defense measures and novelty of the vulnerability are scored to calculate the possibility of the vulnerability being exploited for attack. When the vulnerability type is file injection, remote execution or remote control type, the vulnerability can be exploited for deep penetration.

[0017] Furthermore, the probability of vulnerability being exploited and attacked is evaluated based on the exposed surface vulnerability information, and the calculation method includes:

[0018] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0019] Among them, P(vul) represents the probability of penetration through the exposed surface vulnerability information, Nc(vul) represents the vulnerability complexity index, Tv(vul) represents the vulnerability novelty index, R(vul) represents the vulnerability interception parameter, and Hx represents the host protection index.

[0020] Furthermore, the calculation method of the vulnerability complexity index includes:

[0021] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0022] Among them, C vul Indicates vulnerability complexity; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 represents the complexity parameter of the public vulnerability. Gr represents the hacker technology level faced by the target network system.

[0023] Furthermore, the method for calculating the vulnerability novelty index includes:

[0024] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0025] Among them, t vIndicates the number of months from the current time when the vulnerability was disclosed.

[0026] Furthermore, the vulnerability interception parameter R(vul)=0 or 1, and the vulnerability interception parameter can be accessed through the penetration platform and its value is obtained according to whether the target network security protection device intercepts the access; the host protection index Hx is obtained according to the security verification test results, system setting parameters or virus protection verification based on the exposed server environment.

[0027] Furthermore, the method of evaluating the possibility of vulnerabilities being exploited for attacks based on the popularity of the exposed software includes: when the exposed software has no public vulnerabilities, evaluating the possibility of the software being exploited by hackers of various levels based on the historical vulnerabilities of the exposed software.

[0028] Furthermore, the probability of vulnerability being exploited and attacked is evaluated based on the popularity of the exposed software, and the calculation method includes:

[0029] P (s) =S s / S base *Cs*C svul / V count

[0030] Among them, P (s) represents the probability of penetration through the popularity of exposed software; S s Represents the popularity index of the software, S base is a constant; Cs represents the software vulnerability index in the past few years, C s =V count / V base, Max(C s )=1,V count Represents the number of software vulnerabilities in the past few years, V base is a constant; C svul Indicates the number of penetration vulnerabilities in the past few years.

[0031] In another aspect, the present invention provides an automated penetration testing system, comprising:

[0032] A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0033] The attack agent module is configured to deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0034] The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information;

[0035] A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0036] The penetration decision module is configured to determine whether to proceed to the penetration task of the next layer of the network based on the vulnerability scan results of each layer of network exposure. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network;

[0037] The data analysis module is configured to generate a penetration test result report based on the penetration data of each layer of the network, and provide an estimated probability of penetration of each layer of the network.

[0038] The beneficial effects of the present invention are:

[0039] This invention uses a simulated penetration method to evaluate collected information, model attack and defense data, and dynamically assess the probability of successful penetration at each stage. This method, combined with pre-deployed attack agents, allows for rapid, in-depth testing of network-wide penetration attacks. By calculating penetration assessment probabilities and setting up attack agents, this method assesses the likelihood of penetration across the entire network, avoiding the drawbacks of traditional automated penetration testing, which often only allows detection of one exposed layer due to a lack of exploit scripts and zero-day vulnerabilities. This method can intuitively assess the probability of penetration of a target network before various levels of hacker attacks, including the probability of successful attacks at each layer, better meeting the assessment requirements of actual network penetration capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 This is a flow chart of an automated penetration testing method according to embodiment 1 of the present invention.

[0041] Figure 2 This is a flow chart of an automated penetration testing method according to embodiment 2 of the present invention. DETAILED DESCRIPTION

[0042] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, the specific embodiments of the present invention are now described. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. That is, the embodiments described are only part of the embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present invention.

[0043] Example 1

[0044] like Figure 1 As shown, this embodiment provides an automated penetration testing method, including:

[0045] Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0046] Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0047] Create automated penetration tasks to detect exposures at all levels of the network and collect vulnerability information;

[0048] Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0049] Based on the vulnerability scan results of each network layer's exposed surface, a penetration decision is made to determine whether to proceed to the penetration task of the next layer of the network. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network.

[0050] A penetration test result report is generated based on the penetration data of each layer of the network, and an estimated probability of penetration of each layer of the network is given.

[0051] In this embodiment, a protection capability baseline is first established for the target network system, and basic network parameters are set, such as the level of protection compliance that needs to be met in network compliance and whether it belongs to the scope of critical infrastructure protection. These parameters represent the level of hacker capabilities that the network may face.

[0052] This embodiment method categorizes and assesses vulnerability information in a new way, classifying it according to its impact on the business: denial of service, information leakage, file leakage, database leakage, file injection, remote execution, information tampering, remote control, and more. By analyzing vulnerability information, the likelihood of a hacker penetrating the target is estimated. If the likelihood of penetration exceeds a set threshold, an attack proxy is used to implement a deep penetration attack and transition to the next round of vulnerability assessment. If no vulnerability information is available, the target network's business software is evaluated based on its historical vulnerability history to estimate the risk of zero-day vulnerabilities and assess the risk of hackers penetrating through unknown vulnerabilities. If the overall risk exceeds the threshold, the attack proxy is used to proceed to the next level of network assessment.

[0053] In this embodiment, the penetration decision can be made by evaluating the possibility of vulnerabilities being exploited based on the vulnerability information of the exposed surface, and evaluating the possibility of vulnerabilities being exploited based on the popularity of the exposed surface software, and then determining whether to enter the penetration task of the next level network.

[0054] Preferably, the likelihood of a vulnerability being exploited is assessed based on the exposed surface vulnerability information, including: based on weak password assessment, vulnerability and brute force script assessment, scoring the vulnerability's technical complexity, public information, defense measures, and novelty, and calculating the likelihood of the vulnerability being exploited; when the vulnerability type is file injection, remote execution, or remote control, the vulnerability can be exploited for deep penetration. Specifically, the calculation method includes:

[0055] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0056] Among them, P(vul) represents the probability of penetration through the exposed surface vulnerability information, Nc(vul) represents the vulnerability complexity index, Tv(vul) represents the vulnerability novelty index, R(vul) represents the vulnerability interception parameter, and Hx represents the host protection index.

[0057] More preferably, the calculation method of the vulnerability complexity index includes:

[0058] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0059] Among them, C vul Indicates vulnerability complexity; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 represents the complexity parameter of the public vulnerability. Gr represents the hacker technology level faced by the target network system.

[0060] More preferably, the method for calculating the vulnerability novelty index includes:

[0061] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0062] Among them, t v Indicates the number of months from the current time when the vulnerability was disclosed.

[0063] More preferably, the vulnerability interception parameter R(vul) = 0 or 1. The vulnerability interception parameter can verify access through the penetration platform and obtain a value based on whether the target network security protection device intercepts the access; it represents the host protection index Hx, and the value is obtained based on the security verification test results, system setting parameters or virus protection verification based on the exposed server environment.

[0064] Preferably, the likelihood of a vulnerability being exploited based on the popularity of the exposed software is assessed, including: if the exposed software has no public vulnerabilities, the likelihood of the software being exploited by hackers of various levels is assessed based on the historical vulnerability history of the exposed software. Specifically, the calculation method includes:

[0065] P (s) =S s / S base *Cs*C svul / V count

[0066] Among them, P (s) represents the probability of penetration through the popularity of exposed software; S s Represents the popularity index of the software, S base is a constant; Cs represents the software vulnerability index in the past few years, C s =V count / V base, Max(C s )=1,V count Represents the number of software vulnerabilities in the past few years, V base is a constant; C svul Indicates the number of penetration vulnerabilities in the past few years.

[0067] Example 2

[0068] This embodiment is based on embodiment 1:

[0069] like Figure 2 As shown, this embodiment provides an automated penetration testing method, including:

[0070] 1. Penetration parameter setting: After the system is initialized and deployed, the penetration parameter setting is based on the security protection level of the verification object. The parameters include the security protection level of the target network, whether it is a critical infrastructure, and the level of hacker attack it may face. Based on the settings, the attacker's attack skills and available attack resources are judged.

[0071] 2. Deploy attack agents: By deploying attack agents in each layer of the network, simulate the jump machine after the hacker attack.

[0072] 3. Create automated penetration tasks: Create automated penetration tasks. The task information includes the attack entry point of the target network, such as IP segment and domain name information; set parameters such as attack depth and detection time.

[0073] 4. Detect exposed surfaces and collect vulnerability information: Through information collection and vulnerability scanning, identify exploitable attack targets based on vulnerability type and attack level. Vulnerability information includes vulnerability difficulty, whether a proof-of-concept (POC) has been publicly released, vulnerability penetration type, and vulnerability release date. Also collected are the name of the exposed business software and historical vulnerability information for that software.

[0074] 5. Intelligent Penetration Decision-Making: Based on resource scans and information collection at each exposed layer, the module uses a penetration decision algorithm to determine whether to proceed to the next penetration level. This determination is based on the following: 1) whether the system vulnerability exploitation program has been successfully penetrated; 2) based on system weak password scanning; and 3) based on the likelihood of hacker intrusion, including vulnerabilities, resources, exposed surfaces, and protection levels. If penetration attacks can be carried out using methods 1) and 2), and if the metrics obtained using method 3) exceed the threshold, the pre-deployed attack agent in the inner layer is activated and used.

[0075] 6. The attack agent establishes covert communication with the outside world and initiates the next level of penetration activities of the attack agent.

[0076] 7. Repeat steps 4 to 6 for each level of attack penetration. Based on the penetration data at each layer, a report is generated for the penetration test results. The report provides the estimated probability of penetration at each level of the network.

[0077] In this embodiment, by deploying attack agents, simulating penetration results, and performing in-depth jump simulations, judgments are made through the intelligent penetration decision module. Based on vulnerability classification information, attack difficulty, whether the vulnerability POC is public, and preset system parameters, evaluation modeling is performed to calculate the probability that a real hacker can successfully complete the penetration, and determine whether to conduct an attack penetration to the next level of the network.

[0078] It should be noted that the attack and penetration channels in this embodiment are divided into two categories:

[0079] 1. Based on the vulnerability information assessment of the exposed surface: weak password assessment, vulnerability and brute force script assessment, scoring of the vulnerability's technical complexity, public information, defense measures, and novelty. For vulnerability types such as file injection, remote execution, and remote control, the vulnerability can be exploited for deep penetration, and the probability of the vulnerability being exploited is calculated through an algorithm.

[0080] 2. Based on the popularity of exposed software: If there are no public vulnerabilities in the exposed software, the likelihood of the software being exploited by hackers of various levels is assessed based on the historical vulnerability history of the exposed software.

[0081] The evaluation algorithm for vulnerability penetration is as follows:

[0082] 1. Evaluation algorithm for penetration through known vulnerabilities:

[0083] Complexity Index:

[0084] Nc(vul)=(1 / C vul +I vul *B0+Gr),Max(Nc(vul))=1

[0085] Among them, C vul Indicates the vulnerability complexity, ranging from 1 to 5; I vul Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1, and if it is not public, the value is 0. B0 is the complexity parameter of the public vulnerability, with a fixed value of 3 / 5. G r Indicates the hacker skill level that the network faces, with values ​​of 2 / 5, 3 / 5, and 4 / 5 corresponding to levels 2, 3, and 4, respectively.

[0086] Vulnerability Novelty Index:

[0087] Tv(vul)=1 / (1+t v ),Min(Tv(vul))=1 / 12,Max(Tv(vul))=1

[0088] Among them, t v Indicates the number of months since the vulnerability was disclosed.

[0089] Vulnerability interception parameters:

[0090] R(vul)=0 or 1

[0091] The vulnerability interception parameter can be accessed through the penetration platform to verify the access and obtain the value based on whether the target network security protection device intercepts the access.

[0092] Host protection index: H x The value is determined based on the security verification test results, which are obtained through system setting parameters or virus protection verification based on the exposed server environment.

[0093] Therefore, the probability that the vulnerability can be exploited is calculated as follows:

[0094] P(vul)=Nc(vul)*Tv(vul)*R(vul)*(1-Hx)

[0095] For a network at this level, the probability of successful penetration is:

[0096]

[0097] 2. Probability assessment of penetration through popular software:

[0098] P(s) =S s / S base *Cs*C svul / V count

[0099] Among them, S s Indicates the popularity index of the software, with a value of 1 to 5. For example, the value of common software such as Windows, openssl, mysql, ssh, apach, and tomcat is 5; S base The fixed value is 5; C s Indicates the software vulnerability index in the past three years, C s =V count / V base ,Max(C s )=1,V count Represents the number of software vulnerabilities in the past three years, V base Take a constant value of 5; C svul Indicates the number of penetration vulnerabilities in the software in the past three years.

[0100] Therefore, the probability of attack based on software popularity is evaluated as follows:

[0101]

[0102] 3. The probability of the entire network being vulnerable to penetration attacks is assessed as follows:

[0103] P=P net +P p ,(P<=1)

[0104] To summarize, in the penetration task, the probability assessment of each layer of the network being attacked is given, presenting a probability sequence: P1, P2, P3..., which represents the estimated probability of each layer of the network being penetrated under the attack corresponding to the network level protection.

[0105] Example 3

[0106] This embodiment provides an automated penetration testing system, including:

[0107] A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level;

[0108] The attack agent module is configured to deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack;

[0109] The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information;

[0110] A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface;

[0111] The penetration decision module is configured to determine whether to proceed to the penetration task of the next layer of the network based on the vulnerability scan results of each layer of network exposure. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network;

[0112] The data analysis module is configured to generate a penetration test result report based on the penetration data of each layer of the network, and provide an estimated probability of penetration of each layer of the network.

[0113] Example 4

[0114] This embodiment is based on embodiment 1:

[0115] This embodiment provides a computer device including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the automated penetration testing method of Embodiment 1 is implemented. The computer program may be in source code form, object code form, an executable file, or some intermediate form.

[0116] Example 5

[0117] This embodiment is based on embodiment 1:

[0118] This embodiment provides a computer-readable storage medium storing a computer program, which implements the automated penetration testing method of Example 1 when executed by a processor. The computer program may be in source code form, object code form, executable file, or some intermediate form. The storage medium includes any entity or device capable of carrying computer program code, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium. It should be noted that the content contained in the storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the storage medium does not include electric carrier signals and telecommunication signals.

[0119] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are described as a series of action combinations. However, those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

Claims

1. An automated penetration testing method, characterized in that: include: Establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level; Deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack; Create automated penetration tasks to detect exposures at all levels of the network and collect vulnerability information; Perform vulnerability scans based on the collected vulnerability information to determine the attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface; Based on the vulnerability scan results of each network layer's exposed surface, a penetration decision is made to determine whether to proceed to the penetration task of the next layer of the network. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network. Generate a penetration test result report based on penetration data of each layer of the network, and provide an estimated probability of penetration of each layer of the network; The vulnerability scanning results of each level of network exposure are used to determine whether to proceed to the penetration task of the next level of network through penetration decision-making, including: assessing the possibility of vulnerability exploitation based on the exposure surface vulnerability information and / or assessing the possibility of vulnerability exploitation based on the popularity of the exposed surface software, and then determining whether to proceed to the penetration task of the next level of network; The assessment of the possibility of vulnerability being exploited based on the exposed surface vulnerability information includes: Based on weak password assessment, vulnerability and brute force script assessment, the vulnerability's technical complexity, public information, defense measures and novelty are scored to calculate the likelihood of the vulnerability being exploited. When the vulnerability type is file injection, remote execution or remote control, the vulnerability can be exploited for deep penetration. The method for evaluating the possibility of vulnerability being exploited based on the exposed surface vulnerability information includes: in, represents the probability of penetration through the exposed surface vulnerability information, represents the vulnerability complexity index, represents the vulnerability novelty index, Indicates vulnerability interception parameters, Indicates the host protection index; The calculation method of the vulnerability complexity index includes: in, Indicates vulnerability complexity; Indicates whether the vulnerability PoC has been made public. If it is public, the value is 1; if it is not public, the value is 0. Indicates the complexity parameter of the public vulnerability; Indicates the hacker technology level faced by the target network system; The calculation method of the vulnerability novelty index includes: in, Indicates the number of months from the current time to the time when the vulnerability was made public; The vulnerability interception parameters ,The vulnerability interception parameter can verify access through the penetration platform and obtain its value based on whether the target network security protection device intercepts the access; The host protection index , the value is obtained based on the security verification test results, system setting parameters or virus protection verification based on the exposed server environment; The evaluation of the possibility of vulnerability being exploited based on the popularity of the exposed software includes: if the exposed software has no public vulnerabilities, evaluating the possibility of the software being exploited by hackers of various levels based on the historical vulnerabilities of the exposed software; The probability of vulnerability being exploited based on the popularity of exposed software is evaluated, and the calculation method includes: in, Indicates the probability of penetration through the popularity of exposed software; represents the popularity index of the software, is a constant; Indicates the software vulnerability index in the past few years, , Indicates the number of software vulnerabilities in the past few years. is a constant; Indicates the number of penetration vulnerabilities in the past few years.

2. An automated penetration testing system, based on the automated penetration testing method according to claim 1, characterized in that: include: A parameter setting module is configured to establish a protection capability baseline for the target network system and set basic network parameters according to the security protection level; The attack agent module is configured to deploy attack agents at all levels of the target network system to simulate the jump machine after the hacker attack; The information collection module is configured to create automated penetration tasks, detect exposed surfaces at all levels of the network, and collect vulnerability information; A vulnerability scanning module is configured to perform vulnerability scanning based on the collected vulnerability information to determine attack targets, vulnerability types, and attack levels that can be exploited on the exposed surface; The penetration decision module is configured to determine whether to proceed to the penetration task of the next layer of the network based on the vulnerability scan results of each layer of network exposure. If so, the attack agent establishes covert communication with the outside world and initiates the penetration task of the next layer of the network; The data analysis module is configured to generate a penetration test result report based on the penetration data of each layer of the network, and provide an estimated probability of penetration of each layer of the network.

Images