Automated penetration system and method capable of being arranged based on knowledge graph feedback

Abstract

The invention belongs to the field of network security, and discloses a knowledge graph feedback-based orchestrable automatic penetration system and a knowledge graph feedback-based orchestrable automatic penetration method, the knowledge graph feedback-based orchestrable automatic penetration system is composed of a plurality of micro-services, the micro-services communicate with one another through message buses, and each micro-service comprises a plug-in library, a task executor, an attack engine, a knowledge graph and an orchestration engine. The plug-in library comprises a security test module which can be independently executed; the task executor runs in a target environment, executes the security test module in the plug-in library, collects an execution result and returns the execution result to the arrangement engine; the attack engine distributes a corresponding plug-in to a proper task executor to execute an attack according to an attack instruction of the arrangement engine, a target environment and an executor deployment condition; the knowledge graph comprises a series of reasoning algorithms, model data, analysis algorithms and a knowledge graph database; model data can be utilized to model a target environment, network topology, asset relationship and potential vulnerabilities of a target are analyzed, a result is analyzed, and an optimal penetration test strategy and execution steps are generated.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a programmable automated penetration system and method based on knowledge graph feedback. Background Art

[0002] Automated penetration is a method that uses tools and scripts to automatically perform penetration testing (i.e. testing system security). Traditional penetration testing is usually done manually, including steps such as finding vulnerabilities, verifying vulnerabilities, and generating reports. Automated penetration automates these steps to a certain extent by writing scripts or using specialized software tools, reducing the burden of manual operations and thus improving efficiency and accuracy. Its main purpose is to evaluate the security, compliance, and performance of the network. Automated penetration usually uses two methods: exhaustive traversal and iterative discovery, but both methods have major design drawbacks. An automated penetration system based on exhaustive traversal requires a lot of time and resources, and can cause great harm to the target network. Although an automated penetration system based on iterative discovery can reduce the amount of packets sent, its coverage is greatly reduced, and it cannot guarantee effective coverage of target network security issues.

[0003] The main tools used for automated penetration include crawlers, MSF, NMAP, etc. These tools can automatically scan the network, detect vulnerabilities and automatically exploit them.

[0004] Due to the diversity and flexibility of computer systems, the current automated penetration testing system cannot effectively understand the vulnerability and attack surface of cyberspace, and thus it is difficult to initiate targeted detection and exploitation. This results in the existing automated penetration testing system being ineffective in detection and exploitation, and can only reach the level of junior security engineers. It is unable to combine the knowledge accumulation of top security personnel with penetration tools, and thus cannot achieve efficient, accurate, and comprehensive automated penetration testing. Summary of the invention

[0005] In order to overcome the above problems, the present invention provides a programmable automated penetration system and method based on knowledge graph feedback, which can significantly improve the performance of existing systems. By combining the contextual information of the target network environment and dynamically adjusting the detection strategy according to the information in the knowledge graph in each detection operation, the system can achieve more efficient, accurate and comprehensive penetration testing. The knowledge graph can integrate and provide multi-dimensional security information to help the system better understand and analyze the vulnerabilities and potential attack paths in cyberspace. This dynamic adjustment capability based on knowledge graph feedback enables the system to simulate and construct complex attack behaviors, thereby improving the effectiveness of detection and utilization.

[0006] In addition, the programmable automated linkage mechanism means that the system can automatically adjust and optimize the penetration test process based on real-time feedback and analysis results. This not only improves the efficiency and accuracy of penetration testing, but also quickly updates and iterates detection strategies based on the environment in which new vulnerabilities are found, so that the system always runs under the latest security situation.

[0007] However, adding knowledge graph-based analysis and feedback capabilities does place higher demands on computing resources. The construction, update, and real-time analysis of knowledge graphs require powerful computing and data processing capabilities to ensure that the system can quickly respond and adjust detection strategies. Therefore, more computing resources are needed to support this advanced function and ensure that the system can maintain high performance and stability while providing efficient, accurate, and comprehensive penetration testing services.

[0008] A programmable automated penetration system and method based on knowledge graph feedback, wherein the system is composed of multiple microservices, which communicate with each other through a message bus. The microservices include a plug-in library, a task executor, an attack engine, a knowledge graph, and an orchestration engine.

[0009] The plug-in library contains independently executable security testing modules.

[0010] The task executor runs in the target environment, executes the security test module in the plug-in library and collects the execution results and returns them to the orchestration engine.

[0011] The attack engine distributes the corresponding plug-in to the appropriate task executor to execute the attack according to the attack instruction of the orchestration engine, the target environment and the deployment of the executor.

[0012] The knowledge graph includes a series of reasoning algorithms, model data, analysis algorithms and a knowledge graph database; the model data can be used to model the target environment, analyze the target's network topology, asset relationships and potential vulnerabilities, and analyze the results to generate optimized penetration testing strategies and execution steps.

[0013] The orchestration engine is used to select corresponding plug-ins and target environments according to the feedback results of the knowledge graph and the task objectives to build a workflow and integrate it into a task. After building the task, the task executor is scheduled to execute the workflow in the task; at the same time, the task execution results are collected and processed, and the cleaned data is sent to the knowledge graph for in-depth analysis.

[0014] The orchestration engine can query available plug-ins through the plug-in framework interface and can query specific plug-in information through the plug-in name; the orchestration engine can adjust the content of the parameter table to pass the necessary information to the component during execution.

[0015] The orchestration engine compares and associates the collected information with the existing data in the knowledge graph to identify the nodes that need to be attacked and the required related components of the target network.

[0016] The plug-in library can implement a plug-in framework interface, which includes information such as the plug-in name, category, parameter table, and plug-in address.

[0017] The attack engine can obtain the executable plug-in module of the specified executor through the component address.

[0018] The attack engine includes several task execution managers, and one task execution manager is responsible for managing several task executors running in the target environment.

[0019] The attack engine is in communication connection with the task executor, and the attack engine dispatches the task executor to execute the corresponding subtask by issuing the subtask.

[0020] The attack engine reports the target environment information and the task executor information in each target environment to the orchestration engine for orchestration.

[0021] The attack engine communicates with the orchestration engine through the message bus and obtains the workflow issued by the orchestration engine by subscribing to the Topic of the task publisher.

[0022] After receiving the workflow, the attack engine splits the workflow into several subtasks, selects a matching and appropriate task executor, sends the subtask information and executable plug-in modules to the task executor by issuing subtasks, downloads the executable plug-in modules of the executor according to the subtask information, and assigns the designated task executor to execute the subtask.

[0023] The task executor can configure the executable plug-in module through the parameter table in the subtask information and execute it, and collect the execution result after the execution is completed.

[0024] The task executor runs in the target environment or outside the environment and is used to execute the plug-in modules in the plug-in library. The task executor can be of multiple architectures and run multiple operating systems.

[0025] The task executor is managed by the designated attack engine and receives executable plug-in modules and subtask information sent by the attack engine.

[0026] The task executor runs the executable plug-in module according to the subtask information to obtain the running result, and sends it to the orchestration engine.

[0027] The programmable automated penetration method based on knowledge graph feedback is as follows:

[0028] S1: Create a new penetration test task in the system and set task information and target information;

[0029] S2: Receives penetration testing tasks and passes task configuration to the orchestration engine;

[0030] S3: The orchestration engine sends the target information of the task to the knowledge graph for preliminary analysis. The knowledge graph analyzes the target environment and available plug-ins, generates an initial execution strategy and returns it to the orchestration engine.

[0031] S4: The orchestration engine builds workflows based on the strategies provided by the knowledge graph;

[0032] S5: The orchestration engine sends several workflows and related plug-ins in the task to the attack engine;

[0033] S6: The attack engine decomposes the workflow into subtasks according to the orchestration strategy and distributes them to the corresponding task executors;

[0034] S7: The task executor executes the subtasks, collects the results and returns them to the orchestration engine;

[0035] S8: The orchestration engine cleans and structures the returned data and transmits it to the knowledge graph;

[0036] S9: The knowledge graph integrates new data, updates the target model, analyzes potential threats and attack paths, generates optimized penetration strategies and feeds them back to the orchestration engine; manually intervenes in the attack process by modifying attributes as needed or restoring target attributes to the state before the update or terminating / pausing the subsequent attributes of a certain attribute.

[0037] S10: Repeat steps S3 to S9 until the task goal is achieved or the execution is completed. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0039] Figure 1 The architecture and data flow diagram provided for the embodiments of the present application;

[0040] Figure 2 An example diagram of the ontology model provided in the embodiment of the present application;

[0041] Figure 3 The ontology model response framework diagram provided for the embodiment of the present application;

[0042] Figure 4 A data structured flow chart of the ontology model response framework provided in the embodiment of the present application;

[0043] Figure 5 A knowledge graph analysis flow chart provided for an embodiment of the present application;

[0044] Figure 6 This is a flowchart of the AMIE algorithm provided in the embodiment of the present application. DETAILED DESCRIPTION

[0045] The architecture and data flow of the programmable automated penetration system based on knowledge graph feedback (such as Figure 1 Its core capabilities include:

[0046] The system consists of multiple microservices, which communicate through a message bus. Microservices include task executors (Agents), attack engines, orchestration engines, plug-in libraries, and knowledge graphs.

[0047] Plugin library: Contains independently executable security testing modules, such as web crawlers, survival detection, fingerprint recognition, vulnerability scanning, PoC verification, vulnerability exploitation, and post-penetration modules.

[0048] Task executor (Agent): runs in the target environment, executes the security test modules in the plug-in library and collects the execution results and returns them to the orchestration engine.

[0049] Strike Engine: According to the strike instructions of the orchestration engine, the corresponding plug-ins are distributed to the appropriate task executors for strike execution according to the target environment and Agent deployment.

[0050] Knowledge graph: Contains a series of reasoning algorithms, model data, analysis algorithms, and knowledge graph databases. Model data can be used to model the target environment, analyze the target's network topology, asset relationships, and potential vulnerabilities. The results can be analyzed to generate the most optimized penetration test strategy and execution steps.

[0051] Orchestration engine: It is used to select corresponding plug-ins and target environments according to the feedback results of the knowledge graph and the task objectives to build a workflow and integrate it into a task. After the task is built, the task executor is scheduled to execute the workflow in the task. At the same time, the task execution results are collected and processed, and the cleaned data is sent to the knowledge graph for in-depth analysis.

[0052] The core capabilities of the plug-in library of the programmable automated penetration system based on knowledge graph feedback are:

[0053] S1: The plug-in library implements the plug-in framework interface, which contains information such as the plug-in name, category, parameter table, and plug-in address.

[0054] S2: The orchestration engine can query available plug-ins through the plug-in framework interface and query specific plug-in information through the plug-in name.

[0055] S3: The orchestration engine can adjust the content of the parameter table to pass the necessary information for execution to the component.

[0056] S4: The attack engine can obtain the executable plug-in module of the specified executor through the component address.

[0057] S5: The task executor can configure and execute the executable plug-in module through the parameter table in the subtask information, and collect the execution result after the execution is completed.

[0058] The core capabilities of the task executor of the programmable automated penetration system based on knowledge graph feedback are:

[0059] S1: runs in the target environment or outside the environment, and is used to execute plug-in modules in the plug-in library. The executor can be for multiple architectures and run multiple operating systems.

[0060] S2: The task executor is managed by the specified attack engine and receives executable plug-in modules and subtask information from the attack engine.

[0061] S3: The task executor runs the executable plug-in module according to the subtask information to obtain the running results and sends them to the orchestration engine.

[0062] The core capabilities of the attack engine of the programmable automated penetration system based on knowledge graph feedback are:

[0063] S1: The attack engine contains several task execution managers. One task execution manager is responsible for managing several task executors running in the target environment.

[0064] S2: The attack engine communicates with the task executor, and the attack engine schedules the task executor to execute the corresponding subtask by issuing subtasks.

[0065] S3: The attack engine reports the target environment information and the task executor information in each target environment to the orchestration engine for orchestration.

[0066] S4: The attack engine communicates with the orchestration engine through the message bus and obtains the workflow issued by the orchestration engine by subscribing to the Topic of the task publisher.

[0067] S5: After receiving the workflow, the attack engine splits the workflow into several subtasks, selects a matching and appropriate task executor, sends the subtask information and executable plug-in modules to the task executor by issuing subtasks, downloads the executable plug-in modules of the executor according to the subtask information, and assigns the designated task executor to execute the subtask.

[0068] The core capabilities of the orchestration engine of the programmable automated penetration system based on knowledge graph feedback are:

[0069] S1: Compare and associate the collected information with the existing data in the knowledge graph to identify the nodes that need to be attacked and the required related components of the target network.

[0070] S2: Based on the information in the knowledge graph, the AMIE algorithm is used to infer possible attack paths and exploitation methods. A preliminary penetration test scenario is generated, including goals, steps, tools, and expected results.

[0071] S3: Use the feedback mechanism based on knowledge graph to convert the generated penetration test scenario into an executable automated penetration test script. Define the operation of each step in the script, including the tools used (such as Metasploit, crawlers, POC, lateral movement, defense confrontation, etc.), parameter settings and expected outputs.

[0072] S4: Dynamically adjust the script steps and optimize the test process based on real-time feedback and knowledge graph update results.

[0073] S5: Generate a workflow that can orchestrate attacks based on the script, and then schedule task execution.

[0074] The workflow characteristics of the penetration target network environment of the programmable automated penetration system based on knowledge graph feedback are:

[0075] S1: The user creates a new penetration test task in the system and sets the task information and target information.

[0076] S2: The system receives the penetration test task and passes the task configuration to the orchestration engine.

[0077] S3: The orchestration engine sends the target information of the task to the knowledge graph for preliminary analysis. The knowledge graph analyzes the target environment and available plug-ins, generates an initial execution strategy and returns it to the orchestration engine.

[0078] S4: The orchestration engine builds workflows based on the strategies provided by the knowledge graph.

[0079] S5: The orchestration engine sends several workflows and related plug-ins in the task to the attack engine.

[0080] S6: The attack engine decomposes the workflow into subtasks according to the orchestration strategy and distributes them to the corresponding task executors.

[0081] S7: The task executor executes the subtasks, collects the results and returns them to the orchestration engine.

[0082] S8: The orchestration engine cleans and structures the returned data and transmits it to the knowledge graph.

[0083] S9: The knowledge graph integrates new data, updates the target model, analyzes potential threats and attack paths, generates optimized penetration strategies and feeds them back to the orchestration engine. Users can modify attributes as needed or restore target attributes to the state before the update or terminate / pause the subsequent attributes of a certain attribute to manually intervene in the attack process.

[0084] S10: Repeat steps 3 to 9 until the task goal is achieved or the execution is completed.

[0085] S11: After the task is completed, the system generates a comprehensive report including vulnerability details, attack paths, and repair suggestions.

[0086] Network attack and defense domain ontology model for programmable automated penetration system based on knowledge graph feedback (such as Figure 2 The characteristics of

[0087] The ontology model provides a basic semantic framework for the attack and defense confrontation in cyberspace, helping to clarify the relationship between various behaviors, events and entities in cyberspace. It not only supports the automated processing of network attack and defense, but also provides structured knowledge support for complex attack, detection, defense and response mechanisms. By defining semantic elements such as attack, defense, aggregation, event, association, etc., the domain ontology model can accurately describe the attributes, behaviors and interactions of different entities.

[0088] In this model, the relationships between defense entities, resource-scrambling entities, attack-related entities, adversarial point entities, and state machines constitute the basic framework of cyberspace. Each type of entity and its associated events, resources, and capabilities can be effectively modeled and reasoned through semantic rules. The flexibility of the model is also reflected in its derivability and scalability. Based on the existing ontology model, users can further refine and expand it to specific scenarios or attack and defense strategies, such as more detailed descriptions of attack methods or modeling of specific defense mechanisms, thereby forming a more complex and fine-grained model. This evolution and inheritance feature enables the domain ontology model to adapt to the rapidly changing network attack and defense environment and support more efficient decision-making and response mechanisms.

[0089] The knowledge graph data is derived from security-related data collected from various sources (such as vulnerability databases, threat intelligence, network logs, etc.). The storage process is as follows:

[0090] S1: Collect security-related data from multiple sources (such as vulnerability databases, threat intelligence, network logs, network and security knowledge bases, intelligence libraries, asset libraries, key entities in behavior logs, etc.).

[0091] S2: Combined with the ontology model, preprocess the data, including cleaning, standardization and deduplication.

[0092] S3: Use knowledge graph technology to convert the preprocessed data into entities and relations, and construct a knowledge graph in the form of <subject, predicate, object> triples through semantics.

[0093] S4: Use the AMIE algorithm to mine implicit relationships and rules in the data and represent them as triples (entity-relationship-entity).

[0094] S5: Add triples to the knowledge graph to form a network structure of entities and relationships.

[0095] Ontology model response framework for programmable automated penetration system based on knowledge graph feedback (such as Figure 3 The characteristic is:

[0096] In the design of digital knowledge graph models, the construction of a deduction and response framework is the key to ensuring the flexibility, completeness, and scalability of the model. The main goal of this framework is to ensure that different knowledge and attributes can be efficiently and accurately associated, while achieving rule-based deduction and dynamic response. In order to meet these requirements, the deduction and response framework should have the following core features:

[0097] Attribute association mechanism: The inference framework needs to support complex associations between different attributes and be able to dynamically associate the attributes of different entities or concepts during the model analysis process. Attribute association can be based on logical rule deduction or data-driven similarity analysis. By building a powerful attribute mapping framework, the framework can efficiently store and index static and dynamic relationships between attributes, thereby achieving efficient query and real-time reasoning.

[0098] Rule engine and reasoning engine: The core parts of the deduction framework are the rule engine and the reasoning engine, which determine how the model infers and responds based on the input data or state. The rule engine uses a series of well-defined rules to ensure that logic-based deductions or calculations can be performed based on the current knowledge state and data. The reasoning engine further applies the rules to specific instances in the knowledge graph to generate new knowledge or make decisions.

[0099] One-to-one and many-to-many adversarial analysis: In order to enhance the adaptability of the model in complex scenarios, the deduction framework must support one-to-one adversarial analysis and many-to-many adversarial analysis. One-to-one adversarial analysis refers to simple conflict detection and optimization at the attribute level, such as detecting whether there is a logical conflict between two attributes, or whether an attribute conforms to the expected rules. Many-to-many adversarial analysis involves more complex situations, cross-comparison between multiple attributes and methods to determine the optimal decision path or solution. This multi-dimensional analysis can help the system cope with complex decision-making problems, especially in the face of uncertainty and diverse inputs, to ensure the robustness of the system.

[0100] Resource and state association mechanism: In the deduction framework, the association between resources (such as computing resources, storage resources, etc.) and states is crucial. The framework should be able to dynamically adjust the allocation of resources according to changes in the current state, and adjust the state of the knowledge graph according to the deduction results. For example, the deduction result of a certain attribute or method may lead to a state transition, which in turn affects the allocation and use of related resources. This dynamic resource and state association mechanism not only improves the flexibility of the model, but also ensures the stable operation of the system under high load or complex scenarios.

[0101] Real-time response and feedback mechanism: The deduction framework also needs to have the ability to respond in real time. When faced with changing input data or external environment, the framework can respond quickly and adjust the model's derivation process through feedback mechanism. Real-time feedback can not only improve the decision-making efficiency of the model, but also help the system to optimize and adjust itself according to the actual situation.

[0102] The data structuring process of the ontology model response framework of the programmable automated penetration system based on knowledge graph feedback (such as Figure 4 The characteristic is:

[0103] According to the RDF (Resource Description Framework) standard and OWL (Web Ontology Language) specification, it provides structured representation and semantic association for data in cyberspace.

[0104] First, the data collected from the cyberspace is cleaned and structured to ensure data quality and consistency. The cleaned data will be converted into a format suitable for ontology model representation in order to further construct the graph.

[0105] During the construction process, the ontology model provides the semantic layer of the graph, defines various resources, entities, behaviors and their relationships in the field, and provides unified semantic annotations for each piece of data. Using the OWL standard, data entities and their attributes, the hierarchy of relationships, categories and constraints can be described more accurately, thus providing strong support for reasoning and querying in the graph.

[0106] By following the RDF standard, the knowledge graph constructed can efficiently represent knowledge in the form of triples (subject-predicate-object), and realize flexible storage and query of various types of information in cyberspace. The RDF standard ensures the interoperability between data, enabling different data sources to share and exchange information, thereby improving the scalability and applicability of cyberspace knowledge graphs.

[0107] The knowledge graph analysis process of the programmable automated penetration system based on knowledge graph feedback (such as Figure 5 The characteristic is:

[0108] After the orchestration engine sends the target information of the task to the knowledge graph, the knowledge graph constructs the initial knowledge graph in the form of triples in the form of <entity, relationship, entity>. Through the deduction and analysis algorithm, the relationship between model entities can be effectively derived, thereby revealing the complex interaction patterns in cyberspace. At the same time, the AMIE algorithm plays an important role in this process. Through learning and training between relationships and entities, it can discover hidden relationships that cannot be identified by traditional deduction methods.

[0109] The model of cyberspace covers a variety of resources, events, behaviors, and state entities, and there are often potential dependencies between these entities. For example, there is an implicit connection between the access rights of certain resources and the behavior pattern, or the change trajectory under different system states. The AMIE+ algorithm uses description logic (such as reasoning in OWL ontology) through its powerful rule mining capabilities to discover these hidden semantic connections. This process can not only reveal security events that may be triggered when a specific resource is accessed, but also identify concurrently executed behaviors in a specific system state, thereby effectively predicting resource load changes and potential risks.

[0110] AMIE+ describes these implicit relationships by generating rule triples (subject-predicate-object), enabling the cyberspace model to accurately infer the causal relationship between events, the concurrent execution of behaviors, and the dependencies between resources. This reasoning capability not only enhances the descriptive ability of the knowledge graph in the penetration of the target network, but also provides strong support for intelligent reasoning and attack plan decision-making based on the knowledge graph. For example, in the process of automated penetration in cyberspace, AMIE+ can combine the protective equipment, WEB knowledge, and encryption mechanisms that may exist in the target network to generate more accurate and efficient penetration plans and effectively launch attacks against the target.

[0111] Through this penetration system based on knowledge graph feedback, sufficient situational modeling and reasoning can be performed before the attack, maximizing the penetration success rate and reducing the risk of detection. The analysis based on secret relationships expands the dimension of the attack script, making the penetration effect against the target environment more significant.

[0112] The AMIE algorithm workflow of the programmable automated penetration system based on knowledge graph feedback (such as Figure 6 ) is characterized by:

[0113] The AMIE algorithm retrieval method can automatically mine potential semantic rules and patterns from the ontology knowledge base through efficient rule learning and reasoning mechanisms, and can effectively reason about the attributes of the cyberspace model. It is found that the cyberspace model contains hidden relationships between various resources, events, behaviors, and state entities, especially in the mining of hidden relationships and concurrent relationships. AMIE+ expresses these implicit relationships by generating rule triples (subject-predicate-object), so that the cyberspace model can accurately infer the causal relationship between events, the concurrent execution of behaviors, and the dependency between resources. It can accurately identify and infer potential attack paths and defense vulnerabilities, and provide data support and decision-making basis for formulating targeted penetration plans. The algorithm is as follows:

[0114] S1: Loading knowledge graph and ontology model

[0115] Load the knowledge graph and ontology model of cyberspace attack and defense from the file. These data include entities such as attackers, vulnerabilities, attack tools, target systems, and their relationships.

[0116] S2: Generate constraints

[0117] According to the ontology model, the constraint relationships between entities can be extracted, such as "attackers can only attack vulnerabilities in the system" and "vulnerabilities can only exist in the system".

[0118] S3: Extract triple data

[0119] All triples are extracted from the knowledge graph, each of which consists of entities and the relations between them.

[0120] S4: Initialize the parameters of the AMIE algorithm

[0121] Before starting rule generation, you need to set the parameters of the AMIE algorithm. Common parameters include the minimum support and minimum confidence thresholds, which are used to filter out rules that do not meet the requirements.

[0122] Extension of the Support Formula

[0123]

[0124] The support in the AMIE algorithm represents the frequency of occurrence of rules, which is the basis for generating effective rules. Traditional support only considers the frequency of occurrence of rules in a data set, but in practical applications, more dimensional information may be required, such as time, context, relationship type, etc.

[0125] in:

[0126] θ represents the set of all triples.

[0127] h and c represent the premise and conclusion of the rule respectively.

[0128] It represents the "inference relationship", that is, whether h and c satisfy a certain inference relationship.

[0129] Confidence e )Extension of the formula

[0130]

[0131] Confidence measures the probability that conclusion C is true when premise H is true. In the AMIE algorithm, confidence is usually obtained through a simple frequency calculation. However, in some business scenarios, confidence can be adjusted based on historical data, the order of events, context, and other factors.

[0132] in:

[0133] {(h, c)} represents all triple pairs that satisfy the rule.

[0134] {(h, x)} represents all triples related to premise h.

[0135] Temporal Rule Mining

[0136]

[0137] In some fields with dense time series data, the temporal dependencies of rules may be crucial. By considering the mining of temporal rules, the causal relationships of events can be identified more accurately.

[0138] in:

[0139] t is a timestamp, indicating whether the rule occurs before or after a specific point in time.

[0140] Redundancy and Correlation of Rules

[0141]

[0142] When generating a large number of rules, redundant rules may appear. Although these rules appear frequently in the data, they do not provide new information. Therefore, removing redundant rules is an important means to improve algorithm efficiency and rule quality. If the redundancy is high, it means that the rule H→C has a large duplication with other rules, and it can be considered to be removed.

[0143] S5: Generate candidate rules

[0144] The AMIE algorithm generates candidate rules based on the triples in the knowledge graph. The rules generated here are based on certain patterns, such as inferring the potential relationship between attackers and attack tools from the relationship between attackers and vulnerabilities.

[0145] S6: Evaluate candidate rules and calculate support and confidence

[0146] Calculate the support and confidence of each candidate rule, and filter out the rules that meet the minimum support and minimum confidence requirements.

[0147] S7: Reasoning about new triples

[0148] Based on the evaluated final rules, new triples are derived to expand the knowledge graph.

[0149] S8: Update the knowledge graph

[0150] Add the derived new triples to the existing knowledge graph.

[0151] S9: Save the updated knowledge graph

[0152] Save the updated knowledge graph back to a file for subsequent use.

Claims

1. A programmable automated penetration system and method based on knowledge graph feedback, characterized in that: The system consists of multiple microservices, which communicate through a message bus. The microservices include a plug-in library, a task executor, an attack engine, a knowledge graph, and an orchestration engine. The plug-in library includes independently executable security test modules; The task executor runs in the target environment, executes the security test module in the plug-in library and collects the execution results and returns them to the orchestration engine; The attack engine distributes the corresponding plug-in to the appropriate task executor to execute the attack according to the attack instruction of the orchestration engine, the target environment and the deployment of the executor; The knowledge graph includes a series of reasoning algorithms, model data, analysis algorithms and a knowledge graph database; the model data can be used to model the target environment, analyze the target's network topology, asset relationships and potential vulnerabilities, and analyze the results to generate optimized penetration testing strategies and execution steps.

2. The programmable automated penetration system based on knowledge graph feedback as claimed in claim 1, characterized in that: The orchestration engine is used to select corresponding plug-ins and target environments according to the feedback results of the knowledge graph and the task objectives to build a workflow and integrate it into a task. After building the task, the task executor is scheduled to execute the workflow in the task; at the same time, the task execution results are collected and processed, and the cleaned data is sent to the knowledge graph for in-depth analysis.

3. The programmable automated penetration system based on knowledge graph feedback according to claim 1 or 2, characterized in that: The orchestration engine can query available plug-ins through the plug-in framework interface and can query specific plug-in information through the plug-in name; the orchestration engine can adjust the content of the parameter table to pass the necessary information to the component during execution.

4. The programmable automated penetration system based on knowledge graph feedback as claimed in claim 3, characterized in that: The orchestration engine compares and associates the collected information with the existing data in the knowledge graph to identify the nodes that need to be attacked and the required related components of the target network.

5. The programmable automated penetration system based on knowledge graph feedback according to claim 1, characterized in that: The plug-in library can implement a plug-in framework interface, which includes information such as the plug-in name, category, parameter table, and plug-in address.

6. The programmable automated penetration system based on knowledge graph feedback according to claim 1, characterized in that: The attack engine can obtain the executable plug-in module of the specified executor through the component address.

7. The programmable automated penetration system based on knowledge graph feedback according to claim 6, characterized in that: The attack engine includes several task execution managers, one of which is responsible for managing several task executors running in the target environment; The attack engine is connected to the task executor for communication, and the attack engine dispatches the task executor to execute the corresponding subtask by issuing the subtask; The attack engine reports the target environment information and the task executor information in each target environment to the orchestration engine for orchestration; The attack engine communicates with the orchestration engine through the message bus, and obtains the workflow issued by the orchestration engine by subscribing to the Topic of the task publisher; After receiving the workflow, the attack engine splits the workflow into several subtasks, selects a matching and appropriate task executor, sends the subtask information and executable plug-in modules to the task executor by issuing subtasks, downloads the executable plug-in modules of the executor according to the subtask information, and assigns the designated task executor to execute the subtask.

8. The programmable automated penetration system based on knowledge graph feedback according to claim 1, characterized in that: The task executor can configure and execute the executable plug-in module through the parameter table in the subtask information, and collect the execution result after the execution is completed.

9. The programmable automated penetration system based on knowledge graph feedback according to claim 8, characterized in that: The task executor runs in the target environment or outside the environment and is used to execute the plug-in module in the plug-in library. The task executor can be of various architectures and run various operating systems; The task executor is managed by the designated attack engine and receives executable plug-in modules and subtask information sent by the attack engine; The task executor runs the executable plug-in module according to the subtask information to obtain the running result, and sends it to the orchestration engine.

10. A programmable automated penetration method based on knowledge graph feedback, characterized in that: S1: creating a new penetration test task in the system according to any one of claims 1 to 9, and setting task information and target information; S2: Receives penetration testing tasks and passes task configuration to the orchestration engine; S3: The orchestration engine sends the target information of the task to the knowledge graph for preliminary analysis. The knowledge graph analyzes the target environment and available plug-ins, generates an initial execution strategy and returns it to the orchestration engine. S4: The orchestration engine builds workflows based on the strategies provided by the knowledge graph; S5: The orchestration engine sends several workflows and related plug-ins in the task to the attack engine; S6: The attack engine decomposes the workflow into subtasks according to the orchestration strategy and distributes them to the corresponding task executors; S7: The task executor executes the subtasks, collects the results and returns them to the orchestration engine; S8: The orchestration engine cleans and structures the returned data and transmits it to the knowledge graph; S9: The knowledge graph integrates new data, updates the target model, analyzes potential threats and attack paths, generates optimized penetration strategies and feeds them back to the orchestration engine; manually intervenes in the attack process by modifying attributes as needed or restoring target attributes to the state before the update or terminating / pausing the subsequent attributes of a certain attribute; S10: Repeat steps S3 to S9 until the task goal is achieved or the execution is completed.

Images