A method and system for generating a network security penetration test report

Abstract

The application relates to a network security penetration test report generation method and system, and relates to the technical field of network security. The method comprises the following steps: collecting vulnerability information in a penetration test process; taking each vulnerability as a node and building an edge of the connected node based on the mutual relationship between the vulnerabilities to obtain a vulnerability relationship model; performing weight assignment on the nodes and the edges according to the vulnerability characteristics; calculating the correlation degree between the vulnerabilities to identify key vulnerabilities and a vulnerability chain; generating an attack path based on the established vulnerability relationship model and historical attack data; and generating a penetration test report based on the vulnerability relationship model and the attack path.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to a method and system for generating a network security penetration test report. Background Art

[0002] In today's digital age, cybersecurity is of paramount importance. With the rapid development of information technology, various network systems are widely used in many key areas such as finance, healthcare, and government affairs. However, the means of cyberattacks are becoming increasingly complex and diverse.

[0003] Network security penetration testing, as a crucial tool for safeguarding network security, can simulate hacker attacks to uncover potential system vulnerabilities. However, current report generation methods often focus on superficial descriptions and analysis of known vulnerabilities, lacking in-depth exploration of the potential connections and combined impacts between different vulnerabilities. As network environments become increasingly complex, a single vulnerability may only be the tip of the iceberg; a combination of multiple vulnerabilities can pose even more serious security threats. However, existing report generation technologies struggle to comprehensively and systematically identify and explain the complex relationships between these vulnerabilities, leading security personnel to focus solely on resolving individual vulnerabilities when developing remediation strategies.

[0004] Therefore, there is an urgent need for a method that can deeply analyze vulnerability relationships and accurately identify key vulnerabilities and vulnerability chains to meet the needs of network security assessment in the current complex and changing network security environment. Summary of the Invention

[0005] In order to at least partially solve the above technical problems, the present application provides a method and system for generating a network security penetration test report.

[0006] In a first aspect, the present application provides a method for generating a network security penetration test report using the following technical solution.

[0007] A method for generating a network security penetration test report, comprising:

[0008] Collect vulnerability information during penetration testing;

[0009] Each vulnerability is treated as a node and edges connecting the nodes are constructed based on the relationships between the vulnerabilities to obtain a vulnerability relationship model; weights are assigned to the nodes and edges based on the vulnerability characteristics; and the correlation between the vulnerabilities is calculated to identify key vulnerabilities and vulnerability chains.

[0010] Generate an attack path based on the established vulnerability relationship model and historical attack data;

[0011] Generate penetration test reports based on vulnerability relationship models and attack paths.

[0012] By adopting the above technical solution, vulnerability information collected during penetration testing is treated as a node, and edges are established based on their interrelationships to form a vulnerability relationship model. Nodes and edges are weighted according to vulnerability characteristics. Based on the importance of each vulnerability and its relationships, critical vulnerabilities and vulnerability chains can be identified through correlation calculation. Attack paths are generated based on the vulnerability relationship model and historical attack data, simulating the possible routes of action taken by an attacker. The success rate of each attack path is evaluated by combining vulnerability correlation and system business logic, allowing security personnel to understand the actual probability of different attack paths occurring.

[0013] Optionally, each vulnerability is treated as a node and edges connecting the nodes are built based on the relationships between the vulnerabilities to obtain a vulnerability relationship model, including:

[0014] Identify each vulnerability found during the penetration test and treat each vulnerability as an independent node;

[0015] Determine for each vulnerability whether there is a relationship between it and other vulnerabilities; the relationship includes: precondition relationship, concurrency relationship and subsequent impact relationship;

[0016] According to the determined mutual relationships between the vulnerabilities, edges are established between the nodes having the mutual relationships to form a vulnerability relationship model;

[0017] Assign weights to nodes and edges based on vulnerability characteristics, including:

[0018] The nodes corresponding to each vulnerability are weighted based on the severity, exploitability, impact scope, and business importance of the vulnerability.

[0019] Each edge connecting nodes is weighted based on the closeness of the relationship, the availability of the relationship, and the system impact.

[0020] Optionally, identify vulnerability chains, including:

[0021] Add each key vulnerability node to the search queue;

[0022] Initialize an empty vulnerability chain list to store the discovered vulnerability chains;

[0023] When the search queue is not empty, a vulnerability node is taken out of the queue; all outgoing edge connection relationships of the current vulnerability node are found; for each outgoing edge connection relationship, it is determined whether the comprehensive weight of the outgoing edge connection relationship and the comprehensive weight of the vulnerability node pointed to by the outgoing edge connection relationship meet the priority condition; if so, the vulnerability node pointed to by the outgoing edge connection relationship is added to the search queue, and the path from the current vulnerability node to the vulnerability node pointed to by the outgoing edge connection relationship is added to the current vulnerability chain; when the length of the current vulnerability chain reaches the termination condition, the vulnerability chain is stored in the vulnerability chain list.

[0024] Optionally, generating an attack path based on the established vulnerability relationship model and historical attack data includes:

[0025] Initialize a stack data structure and sequentially push all key vulnerabilities and their initial paths into the stack; the stack data structure is used to store the nodes to be visited and the current access path; initialize an empty attack path set, the attack path set is used to store the generated attack paths;

[0026] When the stack is not empty, do the following:

[0027] Popping an element from the stack, wherein the popped element includes a vulnerable node and the current access path;

[0028] For all outgoing edges of the vulnerability node contained in the element, determine the next vulnerability node pointed to by the outgoing edge and check whether the next vulnerability node meets the conditions for continuing the search, where the conditions for continuing the search are based on historical attack data considerations, business logic, and weights;

[0029] If the conditions for continuing the search are met, the next vulnerable node and the updated access path are pushed into the stack;

[0030] When the current vulnerability node has no outgoing edges, the current access path is added to the attack path set;

[0031] If for the vulnerability node represented by the element popped from the stack, the next vulnerability node pointed to by all its outgoing edges does not meet the conditions for continuing the search, the corresponding element is marked as visited.

[0032] Optionally, before generating a penetration test report based on the vulnerability relationship model and the attack path, the method further includes:

[0033] Before generating a penetration test report, first identify the identity of the user requesting the report;

[0034] Define different report access permissions and information visibility levels for users with different identities;

[0035] Determine the content displayed in the penetration test report based on the reporting access rights and information visibility levels.

[0036] Optionally, a pruning marker set is created; the pruning marker set is used to store known pruning path information; based on historical attack data, find a low-risk node combination that has never been successfully exploited in history, and add the node combination to the pruning marker set.

[0037] Add it to the pruning marker set.

[0038] When an element is popped from the stack, generate a node combination identifier from the current node through the outgoing edge to the next vulnerability node; compare the node combination identifier with the information in the pruning marker set.

[0039] If the current node combination identifier exists in the pruning marker set, it indicates that the node combination has never been successfully exploited in historical data, and the subsequent search operation for the next vulnerability node pointed to by the outgoing edge is directly skipped.

[0040] In a second aspect, the application provides a network security penetration test report generation system using the following technical solution.

[0041] A network security penetration test report generation system, comprising:

[0042] A first processing module for collecting vulnerability information during the penetration test process.

[0043] A second processing module for connecting nodes by building edges between nodes based on the relationship between vulnerabilities to obtain a vulnerability relationship model; assigning weights to nodes and edges according to vulnerability characteristics; calculating the correlation between vulnerabilities to identify key vulnerabilities and vulnerability chains.

[0044] A third processing module for generating attack paths based on the established vulnerability relationship model and historical attack data.

[0045] A fourth processing module for generating a penetration test report based on the vulnerability relationship model and the attack paths. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 is a flowchart of a network security penetration test report generation method according to an embodiment of the application;

[0047] Figure 2 is a system block diagram of a network security penetration test report generation method according to an embodiment of the application;

[0048] In the figure, 201 is a first processing module; 202 is a second processing module; 203 is a third processing module; and 204 is a fourth processing module. DETAILED DESCRIPTION

[0049] The following is combined with Figure 1-2 The present application is further described with reference to the following specific examples:

[0050] The present invention discloses a method for generating a network security penetration test report, comprising the following steps:

[0051] Step 101: Collect vulnerability information found during the penetration test. Vulnerability information is data related to system security vulnerabilities discovered during the penetration test. Vulnerability information includes descriptions of vulnerability types (such as SQL injection and cross-site scripting attacks), discovery locations, vulnerability severity, and impact on system functions.

[0052] Step 102: Treat each vulnerability as a node and construct edges connecting the nodes based on the relationships between vulnerabilities to obtain a vulnerability relationship model. Weights are assigned to the nodes and edges based on vulnerability characteristics. The correlation between vulnerabilities is calculated to identify critical vulnerabilities and vulnerability chains. The vulnerability relationship model is formed by treating each vulnerability as a node and constructing edges connecting these nodes based on the relationships between them. A numerical value is assigned to each vulnerability node based on the vulnerability characteristics, reflecting the relative importance of the vulnerability to overall system security. Vulnerability characteristics can include vulnerability severity, ease of exploitation, and scope of impact. A higher weight indicates a greater potential threat to system security. Edge weights are numerical values ​​assigned to edges connecting vulnerability nodes based on vulnerability characteristics, indicating the closeness of the relationship between the two vulnerabilities. For example, if the existence of one vulnerability is a prerequisite for the exploitation of another, the edge weight connecting the two vulnerabilities may be higher, indicating a greater impact of the relationship on the overall security status.

[0053] Step 103: Generate an attack path based on the established vulnerability relationship model and historical attack data; and evaluate the success rate of each attack path based on vulnerability correlation and system business logic.

[0054] Step 104: Generate a penetration test report based on the vulnerability relationship model and attack path.

[0055] Specifically, vulnerability information collected during penetration testing is used, with each vulnerability treated as a node and edges established based on their interrelationships to create a vulnerability relationship model. Nodes and edges are weighted according to vulnerability characteristics, and critical vulnerabilities and vulnerability chains are identified through correlation calculations based on the importance of each vulnerability and its relationships. Attack paths are generated based on the vulnerability relationship model and historical attack data, simulating the possible routes of action taken by attackers. The success rate of each attack path is evaluated by combining vulnerability correlation and system business logic, allowing security personnel to understand the actual likelihood of different attack paths occurring, allowing them to prioritize and address risks with high success rates and the greatest potential for harm. Generating penetration test reports based on the vulnerability relationship model and attack paths improves the capabilities and efficiency of network security protection.

[0056] As a specific implementation of a method for generating a network security penetration test report, each vulnerability is regarded as a node and edges connecting the nodes are constructed based on the mutual relationships between the vulnerabilities to obtain a vulnerability relationship model, including:

[0057] Identify each vulnerability found during the penetration test and treat each vulnerability as an independent node;

[0058] Determine for each vulnerability whether there is a relationship between it and other vulnerabilities; the relationship includes: precondition relationship, concurrency relationship and subsequent impact relationship;

[0059] According to the determined mutual relationships between the vulnerabilities, edges are established between the nodes having the mutual relationships to form a vulnerability relationship model;

[0060] Assign weights to nodes and edges based on vulnerability characteristics, including:

[0061] The nodes corresponding to each vulnerability are weighted based on the severity, exploitability, impact scope, and business importance of the vulnerability.

[0062] Each edge connecting nodes is weighted based on the closeness of the relationship, the availability of the relationship, and the system impact.

[0063] Specifically, each vulnerability is identified as an independent node, the mutual relationship between vulnerabilities is determined, and the edge is established according to the mutual relationship to form a vulnerability relationship model. The precondition relationship is used to identify key vulnerabilities that must be exploited first to trigger other vulnerabilities. Once the preconditions are broken through by the attacker, they may lay the foundation for subsequent attacks. The concurrency relationship is used to identify multiple vulnerabilities that can be exploited simultaneously. The attacker may use a multi-pronged approach to attack multiple vulnerabilities simultaneously, causing greater threats to the system. The subsequent impact relationship is used to identify the chain reaction of other vulnerability exploitation triggered by the use of a vulnerability, which may lead to more serious damage to the system. According to the characteristics of the vulnerabilities, weight assignment is performed for the nodes and edges. For the nodes, weights are assigned according to the severity, exploitability, impact range, and business importance of the vulnerabilities. The size of the weight determines which vulnerabilities are more likely to cause more serious damage to the system, which vulnerabilities are more likely to be exploited by attackers, and which vulnerabilities have an impact on critical business of the system. For the weight assignment of the edges, the relationship between the relationship, the relationship between the relationship, and the system impact are considered to facilitate the understanding of the close degree of the relationship between different vulnerabilities, the possibility of using this relationship in the attack process, and the impact on the system. Based on the vulnerability relationship model, the most likely attack route from one vulnerability to another can be found, and the possible attack steps of the attacker can be inferred. By comprehensively considering the weights of the nodes and edges, the potential risks of different attack paths can be calculated, which helps to evaluate the security status of the entire system. According to the weights, the vulnerabilities can be sorted, and resources can be allocated to the repair work of high-weight vulnerabilities first, avoiding blind handling of vulnerabilities in defense, and improving the efficiency and pertinence of vulnerability repair.

[0064] As a specific implementation of the network security penetration testing report generation method, the correlation degree between vulnerabilities is calculated to identify key vulnerabilities, including:

[0065] Based on the vulnerability relationship network in the vulnerability relationship model, the total number of vulnerability nodes is counted, denoted as the total number of vulnerability nodes;

[0066] For each vulnerability node, the same initial page rank value is assigned;

[0067] The correlation degree is iteratively calculated and the page rank value of each vulnerability node is updated;

[0068] Vulnerabilities with a page rank value greater than a ranking threshold are marked as key vulnerability nodes;

[0069] Wherein, the correlation degree is iteratively calculated and the page rank value of each vulnerability node is updated, including:

[0070] Initialize a temporary representation value;

[0071] Find all the connections pointing to the current vulnerability node; for each connection pointing to the current vulnerability node, perform the following steps: determine the source vulnerability node, count the number of outgoing connection relationships of the source vulnerability node, obtain the comprehensive weight of the source vulnerability node, obtain the comprehensive weight of the current connection relationship, and obtain the current page ranking value of the source vulnerability node; calculate the increment of the new page ranking value; update the new temporary representation value of the current vulnerability node based on the increment; wherein the calculation formula of the increment is ;Wherein, a is the increment; b is the comprehensive weight of the source vulnerability node; c is the comprehensive weight of the current connection relationship; d is the page rank value of the source vulnerability node; e is the number of outgoing edge connection relationships of the source vulnerability node; repeat the iteration until the difference between the new temporary representation value and the previous temporary representation value is less than the difference threshold;

[0072] Update the page ranking value of each vulnerability node based on the final temporary representation value.

[0073] Specifically, during the iteration process, the connection relationship pointing to the current vulnerability node is found, and each connection relationship is analyzed, including determining the source vulnerability node, counting the number of outgoing connection relationships of the source vulnerability node, obtaining the comprehensive weight of the source vulnerability node, obtaining the comprehensive weight of the current connection relationship, and the current page ranking value of the source vulnerability node. The increment combines the comprehensive weight of the source vulnerability node, the comprehensive weight of the current connection relationship, the page ranking value of the source vulnerability node, and the number of outgoing connection relationships of the source vulnerability node. Through multiple iterations, the temporary representation value of each vulnerability node can reflect its importance and influence in the entire vulnerability relationship network. When the difference between the new temporary representation value and the previous temporary representation value is less than the difference threshold, it means that the page ranking value of the vulnerability node tends to be stable, and its final page ranking value comprehensively reflects its relevance in the entire network. Vulnerabilities with page ranking values ​​greater than the ranking threshold are marked as key vulnerability nodes. Vulnerability nodes that are at the core of the vulnerability relationship network, have important connections with many vulnerability nodes, and have high weights are screened out. This avoids judging only from the characteristics of a single vulnerability. Instead, from the perspective of the entire network, based on the relationships and weights between vulnerabilities, we identify key vulnerabilities that, once exploited, may trigger a chain reaction and pose a major threat to system security.

[0074] As a specific implementation of a method for generating a network security penetration test report, identifying a vulnerability chain includes:

[0075] Add each key vulnerability node to the search queue;

[0076] Initialize an empty vulnerability chain list to store the discovered vulnerability chains;

[0077] taking out a vulnerability node from the queue when the queue is not empty; finding all out-edge connection relationships of the current vulnerability node; judging whether the comprehensive weight of each out-edge connection relationship and the comprehensive weight of the vulnerability node pointed to by the out-edge connection relationship satisfy the priority condition; if yes, adding the vulnerability node pointed to by the out-edge connection relationship to the search queue, and adding the path from the current vulnerability node to the vulnerability node pointed to by the out-edge connection relationship to the current vulnerability chain; storing the vulnerability chain to the vulnerability chain list when the length of the current vulnerability chain reaches the termination condition.

[0078] Specifically, it is assumed that there is a vulnerability node A which may have some association with several other vulnerability nodes (such as B, C, and D), and the edge from node A to node B is an out-edge of node A.

[0079] The vulnerability chain is gradually constructed from the moment when the key vulnerability node is added to the search queue. An empty vulnerability chain list is initialized to store the discovered vulnerability chains. When the search queue is not empty, the vulnerability nodes are sequentially taken out and their out-edge connection relationships are found. For each out-edge connection relationship, it is judged whether the comprehensive weight satisfies the priority condition. Only when the condition is satisfied, the vulnerability chain is further expanded, which effectively avoids meaningless path exploration and improves the accuracy of vulnerability chain construction. Once the length of the current vulnerability chain reaches the termination condition, it is stored to the vulnerability chain list. In this way, the potential security threat paths in the system can be more clearly and accurately presented.

[0080] As one of the implementation manners of the network security penetration test report generation method, the attack path is generated based on the established vulnerability relationship model and historical attack data, including:

[0081] An empty stack data structure is initialized, and all key vulnerabilities and their initial paths are sequentially pushed into the stack; the stack data structure is used to store the to-be-accessed nodes and the current access path; an empty attack path set is initialized, and the attack path set is used to store the generated attack paths;

[0082] When the stack is not empty, the following operations are performed:

[0083] An element is popped out from the stack, and the popped element contains a vulnerability node and a current access path;

[0084] For all out-edges of the vulnerability node contained in the element, the next vulnerability node pointed to by the out-edge is determined, and it is checked whether the next vulnerability node satisfies the continue-searching condition; the continue-searching condition is based on historical attack data consideration, business logic, and weight;

[0085] If the continue-searching condition is satisfied, the next vulnerability node and the updated access path are pushed into the stack;

[0086] When the current vulnerability node has no outgoing edges, the current access path is added to the attack path set;

[0087] If for the vulnerability node represented by the element popped from the stack, the next vulnerability node pointed to by all its outgoing edges does not meet the conditions for continuing the search, the corresponding element is marked as visited.

[0088] Specifically, the stack data structure is initialized by sequentially pushing all key vulnerabilities and their initial paths onto it. The initialized empty attack path set is used to store the resulting attack paths, ensuring ordered storage of the results. While the stack is not empty, elements are continuously popped from the stack. The vulnerability nodes and access paths contained within them become the targets of further operations. By checking the next vulnerability node pointed to by all outgoing edges from the vulnerability node contained in that element, the search criteria for continued search are determined based on historical attack data, business logic, and weights. This screens out nodes with real attack potential, avoiding blind searches. The next vulnerability node and updated access path that meet the continued search criteria are pushed onto the stack, enabling dynamic expansion of the search path. If the current vulnerability node has no outgoing edges, the current access path is added to the attack path set, ensuring that the complete attack path is preserved. If none of the outgoing edges of the vulnerability node popped from the stack meet the continued search criteria, the node is marked as visited, avoiding repeated operations. Leveraging the stack's storage and operation mechanisms, attack paths that match actual attack scenarios can be accurately and efficiently generated, helping to discover potential security vulnerabilities in the system.

[0089] As one implementation of a method for generating a network security penetration test report, before generating the penetration test report based on the vulnerability relationship model and the attack path, the method further includes:

[0090] Before generating a penetration test report, first identify the identity of the user requesting the report;

[0091] Define different report access permissions and information visibility levels for users with different identities;

[0092] Determine the content of the penetration test report based on report access permissions and information visibility levels.

[0093] As one embodiment of a method for generating a network security penetration test report, the method further includes:

[0094] Creating a pruning marker set; the pruning marker set is used to store known pruning path information; based on historical attack data, finding low-risk node combinations that have never been successfully exploited in history and adding them to the pruning marker set;

[0095] When an element is popped from the stack, a node combination identifier is generated starting from the current node and passing through the outgoing edge to the next vulnerable node; the node combination identifier is compared with the information in the pruning mark set;

[0096] If the current node combination identifier exists in the pruning mark set, it indicates that the node combination has never been successfully exploited in historical data, and the subsequent search operation for the next vulnerable node pointed to by the outgoing edge is directly skipped.

[0097] Specifically, a pruning marker set is created to store information about known pruneable paths. Based on historical attack data, low-risk node combinations that have never been successfully exploited are identified and added to the pruning marker set. This allows the system to identify those node combinations that are low-risk and non-threatening in attack scenarios based on past experience. When an element is popped from the stack, a node combination identifier is generated that starts from the current node and passes through the outgoing edge to the next vulnerable node, and this identifier is compared with the information in the pruning marker set. If the node combination identifier exists in the pruning marker set, it indicates that it belongs to a low-risk node combination that has never been successfully exploited in historical data. The subsequent search for the next vulnerable node pointed to by the outgoing edge is skipped, avoiding ineffective exploration of these low-value nodes and saving system resources and time.

[0098] This application also provides a system for generating a network security penetration test report, including:

[0099] The first processing module 201 is used to collect vulnerability information during the penetration test;

[0100] The second processing module 202 is configured to: treat each vulnerability as a node and build edges connecting the nodes based on the relationships between the vulnerabilities to obtain a vulnerability relationship model; assign weights to the nodes and edges based on vulnerability characteristics; and calculate the correlation between the vulnerabilities to identify key vulnerabilities and vulnerability chains;

[0101] The third processing module 203 is used to generate an attack path based on the established vulnerability relationship model and historical attack data;

[0102] The fourth processing module 204 is used to generate a penetration test report based on the vulnerability relationship model and the attack path.

[0103] It should be noted that the above embodiments are only used to illustrate the present application and are not intended to limit the technical solutions described in the present application. Although this specification has described the present application in detail with reference to the above embodiments, ordinary technicians in this field should understand that technicians in the relevant technical field can still modify or replace the present application with equivalents, and all technical solutions and improvements that do not depart from the spirit and scope of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for generating a network security penetration test report, characterized in that: include: Collect vulnerability information during penetration testing; Each vulnerability is treated as a node and edges connecting the nodes are constructed based on the relationships between the vulnerabilities to obtain a vulnerability relationship model; weights are assigned to the nodes and edges based on the vulnerability characteristics; Calculate the correlation between vulnerabilities to identify critical vulnerabilities and vulnerability chains; Generate an attack path based on the established vulnerability relationship model and historical attack data; Generate penetration test reports based on vulnerability relationship models and attack paths; Calculate correlations between vulnerabilities to identify critical vulnerabilities, including: The total number of vulnerability nodes is counted based on the vulnerability relationship network in the vulnerability relationship model, and recorded as the total number of vulnerability nodes; For each vulnerable node, assign the same initial page rank value; Iteratively calculate the relevance and update the page ranking value of each vulnerability node; Mark vulnerabilities whose page ranking values ​​are greater than the ranking threshold as critical vulnerability nodes; The iterative calculation of the correlation degree and the update of the page ranking value of each vulnerability node include: Initialize a temporary representation value; Find all the connections pointing to the current vulnerability node; for each connection pointing to the current vulnerability node, perform the following steps: determine the source vulnerability node, count the number of outgoing connection relationships of the source vulnerability node, obtain the comprehensive weight of the source vulnerability node, obtain the comprehensive weight of the current connection relationship, and obtain the current page ranking value of the source vulnerability node; calculate the increment of the new page ranking value; update the new temporary representation value of the current vulnerability node based on the increment; wherein the calculation formula of the increment is ;Wherein, a is the increment; b is the comprehensive weight of the source vulnerability node; c is the comprehensive weight of the current connection relationship; d is the page rank value of the source vulnerability node; e is the number of outgoing edge connection relationships of the source vulnerability node; repeat the iteration until the difference between the new temporary representation value and the previous temporary representation value is less than the difference threshold; Update the page ranking value of each vulnerability node based on the final temporary representation value.

2. The method for generating a network security penetration test report according to claim 1, wherein: Each vulnerability is treated as a node and edges connecting the nodes are built based on the relationships between the vulnerabilities to obtain a vulnerability relationship model, including: Identify each vulnerability found during the penetration test and treat each vulnerability as an independent node; Determine for each vulnerability whether there is a relationship between it and other vulnerabilities; the relationship includes: precondition relationship, concurrency relationship and subsequent impact relationship; According to the determined mutual relationships between the vulnerabilities, edges are established between the nodes having the mutual relationships to form a vulnerability relationship model; Assign weights to nodes and edges based on vulnerability characteristics, including: The nodes corresponding to each vulnerability are weighted based on the severity, exploitability, impact scope, and business importance of the vulnerability. Each edge connecting nodes is weighted based on the closeness of the relationship, the availability of the relationship, and the system impact.

3. The method for generating a network security penetration test report according to claim 2, wherein: Identify vulnerability chains, including: Add each key vulnerability node to the search queue; Initialize an empty vulnerability chain list to store the discovered vulnerability chains; When the search queue is not empty, a vulnerability node is taken out of the queue; all outgoing edge connection relationships of the current vulnerability node are found; for each outgoing edge connection relationship, whether the comprehensive weight of the outgoing edge connection relationship and the comprehensive weight of the vulnerability node pointed to by the outgoing edge connection relationship meet the priority condition; if so, the vulnerability node pointed to by the outgoing edge connection relationship is added to the search queue, and the path from the current vulnerability node to the vulnerability node pointed to by the outgoing edge connection relationship is added to the current vulnerability chain; when the length of the current vulnerability chain reaches the termination condition, the vulnerability chain is stored in the vulnerability chain list.

4. The method for generating a network security penetration test report according to claim 3, wherein: Generating an attack path based on the established vulnerability relationship model and historical attack data includes: Initialize a stack data structure and sequentially push all key vulnerabilities and their initial paths into the stack; the stack data structure is used to store the nodes to be visited and the current access path; initialize an empty attack path set, the attack path set is used to store the generated attack paths; When the stack is not empty, do the following: Popping an element from the stack, wherein the popped element includes a vulnerable node and the current access path; For all outgoing edges of the vulnerability node contained in the element, determine the next vulnerability node pointed to by the outgoing edge and check whether the next vulnerability node meets the conditions for continuing the search, where the conditions for continuing the search are based on historical attack data considerations, business logic, and weights; If the conditions for continuing the search are met, the next vulnerable node and the updated access path are pushed into the stack; When the current vulnerability node has no outgoing edges, the current access path is added to the attack path set; If for the vulnerability node represented by the element popped from the stack, the next vulnerability node pointed to by all its outgoing edges does not meet the conditions for continuing the search, the corresponding element is marked as visited.

5. The method for generating a network security penetration test report according to claim 4, characterized in that: Before generating a penetration test report based on the vulnerability relationship model and the attack path, the method further includes: Before generating a penetration test report, first identify the identity of the user requesting the report; Define different report access permissions and information visibility levels for users with different identities; Determine the content displayed in the penetration test report based on report access permissions and information visibility levels.

6. The method for generating a network security penetration test report according to claim 5, characterized in that: The method further comprises: Create a pruning mark set; the pruning mark set is used to store known pruning path information; based on historical attack data, find a low-risk node combination that has never been successfully exploited in history. It is added to the set of pruning marks; When an element is popped from the stack, a node combination identifier is generated starting from the current node and passing through the outgoing edge to the next vulnerable node; the node combination identifier is compared with the information in the pruning mark set; If the current node combination identifier exists in the pruning mark set, it indicates that the node combination has never been successfully exploited in historical data, and the subsequent search operation for the next vulnerable node pointed to by the outgoing edge is directly skipped.

7. A system for generating a network security penetration test report, characterized in that: include: The first processing module is used to collect vulnerability information during the penetration test; The second processing module is used to: treat each vulnerability as a node and build edges connecting the nodes based on the mutual relationships between the vulnerabilities to obtain a vulnerability relationship model; assign weights to the nodes and edges according to the vulnerability characteristics; Calculate the correlation between vulnerabilities to identify critical vulnerabilities and vulnerability chains; A third processing module is configured to generate an attack path based on the established vulnerability relationship model and historical attack data; The fourth processing module is used to generate a penetration test report based on the vulnerability relationship model and the attack path; Calculate correlations between vulnerabilities to identify critical vulnerabilities, including: The total number of vulnerability nodes is counted based on the vulnerability relationship network in the vulnerability relationship model, and recorded as the total number of vulnerability nodes; For each vulnerable node, assign the same initial page rank value; Iteratively calculate the relevance and update the page ranking value of each vulnerability node; Mark vulnerabilities whose page ranking values ​​are greater than the ranking threshold as critical vulnerability nodes; The iterative calculation of the correlation degree and the update of the page ranking value of each vulnerability node include: Initialize a temporary representation value; Find all the connections pointing to the current vulnerability node; for each connection pointing to the current vulnerability node, perform the following steps: determine the source vulnerability node, count the number of outgoing connection relationships of the source vulnerability node, obtain the comprehensive weight of the source vulnerability node, obtain the comprehensive weight of the current connection relationship, and obtain the current page ranking value of the source vulnerability node; calculate the increment of the new page ranking value; update the new temporary representation value of the current vulnerability node based on the increment; wherein the calculation formula of the increment is ;Wherein, a is the increment; b is the comprehensive weight of the source vulnerability node; c is the comprehensive weight of the current connection relationship; d is the page rank value of the source vulnerability node; e is the number of outgoing edge connection relationships of the source vulnerability node; repeat the iteration until the difference between the new temporary representation value and the previous temporary representation value is less than the difference threshold; Update the page ranking value of each vulnerability node based on the final temporary representation value.

Images