Knowledge-driven penetration test method and system

Abstract

The invention belongs to the technical field of network security, and discloses a penetration test method based on knowledge driving. The CK framework constructs a knowledge graph ontology, forms a structured knowledge graph by defining technical and tactical nodes, technology nodes, vulnerability nodes, service nodes, asset nodes and association relationships thereof, and comprehensively shows attack chain logic. In combination with target host detection information, service, port and operating system data are dynamically mapped into a knowledge graph, a recommended attack path is generated through reasoning, and the path is adjusted by using a dynamic optimization method, so that the rationality and practical applicability of the attack path are ensured. According to the method, the vulnerability nodes and the technical nodes in the recommended attack path are combined, the vulnerability utilization method is generated according to the preset rule, and the parameter configuration is adjusted according to the operation environment of the target host, so that the accuracy and the flexibility of the utilization method are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a knowledge-driven penetration testing method and system. Background Art

[0002] Penetration testing is a crucial component of network security protection. By simulating attacker behavior, it uncovers potential system vulnerabilities and provides critical insight for optimizing defenses. However, traditional penetration testing methods rely primarily on manual operations, limiting efficiency and accuracy due to the tester's limited experience. This makes them difficult to adapt to the rapid assessment requirements of complex network environments. While existing automated tools have improved vulnerability scanning and exploitation, they typically focus on detecting single vulnerabilities and lack a systematic analysis of the overall attack chain. This makes them particularly difficult to provide comprehensive guidance for security personnel when responding to multi-stage attacks.

[0003] The development of knowledge graphs and the ATT&CK framework has provided a new research perspective for systematically presenting attack chain logic. Knowledge graphs, through structured nodes and relationships, provide support for penetration testing analysis, helping to enhance understanding of attack paths. However, as a supporting tool, how to better integrate knowledge graphs with the professional judgment of security personnel to improve analysis efficiency and interpretability of results remains an urgent issue.

[0004] Through the above analysis, the problems and defects of the existing technology are as follows:

[0005] Traditional penetration testing methods rely primarily on manual operations, their efficiency and accuracy limited by the tester's experience, making them inadequate for the rapid assessment required in complex network environments. While existing automated tools have improved vulnerability scanning and exploitation, they typically focus on detecting single vulnerabilities and lack systematic analysis of the overall logic of the attack chain. This makes them particularly difficult to provide comprehensive reference for security personnel when responding to multi-stage attacks. Summary of the Invention

[0006] In response to the problems existing in the prior art, the present invention provides a knowledge-driven penetration testing method.

[0007] The present invention is implemented as follows: a knowledge-driven penetration testing method includes:

[0008] Step 1: Build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes.

[0009] Step 2: Detect the service, port, and operating system information of the target host, and map the detection results into the knowledge graph to generate nodes related to the target host and their association relationships;

[0010] Step 3: Based on the nodes and relationships in the knowledge graph, we generate vulnerability exploitation methods and attack paths through reasoning, analyze the technologies and vulnerabilities involved in the paths, and adjust the paths using dynamic optimization methods.

[0011] Step 4: Analyze the execution results of the attack path and its exploitation method, and generate a penetration test report containing the path logic, test results and related data.

[0012] Furthermore, in the knowledge nodes, the technical and tactical, tactics, and vulnerability node information includes: node name, node type, and node attribute description; service node information includes: node name, node type, node attribute description, and node location information; asset node information includes: node name, node type, node attribute description, node location information, and node permission level information, where the permission level information content is guest, user, or admin;

[0013] The relationships between knowledge node types include the connection order relationship between technical and tactical nodes, the support relationship between technical and tactical nodes and technology nodes, the utilization relationship between technology nodes and vulnerability nodes, the dependency relationship between vulnerability nodes and service nodes, the ownership relationship between service nodes and asset nodes, and the connection relationship between asset nodes.

[0014] Furthermore, the detected information includes the target host's open ports, the name and version of the running service, the type and version of the operating system, and the target host's network address information;

[0015] The detection method includes using port scanning technology to identify the open ports and communication protocols of the target host, determining the running services and their versions on the port through service fingerprint analysis technology, inferring the type and version of the operating system based on network characteristics, and using network scanning tools to obtain the IP address and MAC address of the target host.

[0016] Furthermore, the mapping process of the detection results includes defining the information of the target host as an asset node, defining the detected running service as a service node, and creating or updating the relevant nodes and their attribute information in the knowledge graph according to the detection information;

[0017] The relationships between nodes include the ownership relationship between service nodes and asset nodes, which is used to describe that the service runs on a specific target host, and the association relationship between service nodes and vulnerability nodes, which is used to describe possible security vulnerabilities in the service.

[0018] Furthermore, the reasoning process is executed by the knowledge graph reasoning engine, starting from the set asset node, combining the support relationship, utilization relationship and dependency relationship in the knowledge graph, and gradually deducing possible vulnerability exploitation methods; generating attack paths through the connection of asset nodes;

[0019] The inference engine calculates the shortest path from the starting host node to the target host node using the BFS breadth-first search algorithm;

[0020] When adding a new host, the inference engine will determine whether the network connection between the host and the existing hosts is smooth, and determine whether permissions can be obtained through the host based on the permission level of the current node; if the permissions of the host can be obtained, the permission attributes of the node will be updated.

[0021] Furthermore, the vulnerability exploitation rules are defined based on the technical nodes and vulnerability nodes in the attack path, and include the tools, steps, and parameter configuration methods required to implement specific technical operations;

[0022] The generation process selects the corresponding rules by matching the node information in the attack path, and adjusts the parameter configuration based on the service version, operating system type and other detected environmental information of the target host;

[0023] The content of the penetration test report is structured and presented in the order of the attack path. The technical nodes, vulnerability nodes and related information corresponding to each step are clearly marked. The test results are associated with the nodes in the path, and the execution status and output data of the exploitation method are recorded.

[0024] Another object of the present invention is to provide a knowledge-driven penetration testing system comprising:

[0025] Build a knowledge graph module to build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes.

[0026] The detection module is used to detect the service, port and operating system information of the target host, and map the detection results into the knowledge graph to generate nodes related to the target host and their association relationships;

[0027] The reasoning module is used to generate vulnerability exploitation methods and attack paths through reasoning based on the nodes and relationships in the knowledge graph, analyze the technologies and vulnerabilities involved in the path, and adjust the path using dynamic optimization methods;

[0028] The analysis module is used to analyze the execution results of the attack path and its utilization method, and generate a penetration test report containing path logic, test results and related data.

[0029] Another object of the present invention is to provide a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the knowledge-driven penetration testing method.

[0030] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the knowledge-driven penetration testing method.

[0031] Another object of the present invention is to provide an information data processing terminal, which is used to implement the knowledge-driven penetration testing system.

[0032] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0033] First, the present invention proposes a knowledge-driven penetration testing method, which is aimed at complex network security assessment scenarios. According to the ATT&CK framework knowledge, a knowledge graph ontology including knowledge node types and relationships between types is constructed. This process structures each link of the attack chain and clearly shows the logical relationship between each node, which is conducive to the systematic analysis of the attack chain. On this basis, by detecting the target host information and mapping the detection results to the knowledge graph, the vulnerability exploitation method and recommended attack path are generated by reasoning. After adjusting the generated parameter configuration in combination with the actual environment of the target host, a penetration test report containing path logic, test results and related data is generated. This process effectively reduces the complex work of manual analysis, assists security personnel to quickly understand the logical relationship of the attack path, and improves the analysis depth and efficiency of the penetration test. The knowledge-driven penetration testing method proposed by the present invention can assist in accurately analyzing complex attack paths, dynamically adapting to the actual environment and generating high-quality test reports, providing comprehensive decision support for network security assessment.

[0034] Second, traditional penetration testing relies on manual experience, is time-consuming, and is susceptible to human factors. The introduction of knowledge graphs and the ATT&CK framework systematically organizes and correlates security elements such as tactics, technologies, vulnerabilities, services, and assets, enabling automated reasoning and dynamic optimization to improve testing efficiency.

[0035] By building a comprehensive knowledge graph, the present invention can identify complex attack paths and potential threats, reduce missed alerts and false positives, and improve the accuracy of threat detection;

[0036] Automated penetration testing methods reduce reliance on highly skilled security experts and lower labor costs. At the same time, the ability to detect and fix vulnerabilities in advance can avoid economic losses caused by potential security incidents.

[0037] The systematic penetration testing method of the present invention helps enterprises meet the security assessment requirements of relevant laws and regulations and industry standards, and improve the compliance and credibility of enterprises.

[0038] Traditional security analysis tools mostly present attack techniques and strategies in a static manner and lack correlation analysis. The present invention innovatively combines the ATT&CK framework with a knowledge graph, and by constructing a dynamic knowledge graph, displays the correlation between attack techniques and tactics, technology, vulnerabilities, services, and assets, providing a new perspective; the traditional report generation process is cumbersome and inconsistent. The present invention provides a systematic penetration test report generation mechanism, which generates penetration test reports containing path logic, test results, and related data through automated means, improving the standardization and practicality of the report; in response to the vulnerability matching mechanism based on static knowledge bases in the existing technology, the present invention innovatively constructs a dynamic evolution knowledge graph, and realizes the semantic-level fusion of the ATT&CK framework and the CVE vulnerability library through ontology modeling, breaking through the information island problem between attack techniques, vulnerability exploits, and asset attributes in traditional methods; in response to the problem that existing automated penetration testing tools lack systematic knowledge support, the present invention constructs a knowledge-driven automated reasoning engine to encode expert experience into a quantifiable reasoning rule set, realizing the structured inheritance and machine enhancement of human expert knowledge. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 This is a flow chart of a knowledge-driven penetration testing method provided by an embodiment of the present invention;

[0040] Figure 2 This is a structural block diagram of a knowledge-driven penetration testing system provided by an embodiment of the present invention;

[0041] Figure 3 This is a design diagram of the penetration testing method provided by an embodiment of the present invention;

[0042] Figure 4 This is a schematic diagram of the simplified structure of the knowledge graph ontology mentioned in the penetration testing method provided by the present invention;

[0043] Figure 5 This is a target host information diagram provided by an embodiment of the present invention;

[0044] Figure 6 This is a schematic diagram of the knowledge-driven vulnerability exploitation method reasoning and attack path recommendation provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0046] like Figure 1 As shown, a knowledge-driven penetration testing method provided by an embodiment of the present invention includes the following steps:

[0047] S101: Build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes.

[0048] S102, detecting the service, port, and operating system information of the target host, and mapping the detection results to the knowledge graph to generate nodes related to the target host and their association relationships;

[0049] S103, based on the nodes and relationships in the knowledge graph, generates vulnerability exploitation methods and attack paths through reasoning, analyzes the technologies and vulnerabilities involved in the paths, and adjusts the paths using dynamic optimization methods;

[0050] S104: Analyze the attack path and the execution results of the exploitation method, and generate a penetration test report including the path logic, test results and related data.

[0051] In the knowledge nodes provided by the embodiments of the present invention, the technical and tactical, tactical, and vulnerability node information includes: node name, node type, and node attribute description; service node information includes: node name, node type, node attribute description, and node location information; asset node information includes: node name, node type, node attribute description, node location information, and node permission level information, where the permission level information includes guest permission (guest), user permission (user), or administrator permission (admin);

[0052] The relationships between knowledge node types include the connection order relationship between technical and tactical nodes, the support relationship between technical and tactical nodes and technology nodes, the utilization relationship between technology nodes and vulnerability nodes, the dependency relationship between vulnerability nodes and service nodes, the ownership relationship between service nodes and asset nodes, and the connection relationship between asset nodes.

[0053] The detection information provided by the embodiment of the present invention includes the open ports of the target host, the name and version of the running service, the type and version of the operating system, and the network address information of the target host;

[0054] The detection method includes using port scanning technology to identify the open ports and communication protocols of the target host, determining the running services and their versions on the port through service fingerprint analysis technology, inferring the type and version of the operating system based on network characteristics, and using network scanning tools to obtain the IP address and MAC address of the target host.

[0055] The mapping process of the detection results provided by the embodiment of the present invention includes defining the information of the target host as an asset node, defining the detected running service as a service node, and creating or updating the relevant nodes and their attribute information in the knowledge graph based on the detection information;

[0056] The relationships between nodes include the ownership relationship between service nodes and asset nodes, which is used to describe that the service runs on a specific target host, and the association relationship between service nodes and vulnerability nodes, which is used to describe possible security vulnerabilities in the service.

[0057] The reasoning process provided by the embodiment of the present invention is executed by the knowledge graph reasoning engine. Starting from the set asset node, it combines the support relationship, utilization relationship and dependency relationship in the knowledge graph to gradually deduce possible vulnerability exploitation methods; and generates attack paths by connecting asset nodes.

[0058] The inference engine calculates the shortest path from the starting host node to the target host node using the BFS breadth-first search algorithm;

[0059] When adding a new host, the inference engine will determine whether the network connection between the host and the existing hosts is smooth, and determine whether permissions can be obtained through the host based on the permission level of the current node; if the permissions of the host can be obtained, the permission attributes of the node will be updated.

[0060] The vulnerability exploitation rules provided by the embodiment of the present invention are based on the technical nodes and vulnerability node definitions in the attack path, and include the tools, steps, and parameter configuration methods required to implement specific technical operations;

[0061] The generation process selects the corresponding rules by matching the node information in the attack path, and adjusts the parameter configuration based on the service version, operating system type and other detected environmental information of the target host;

[0062] The content of the penetration test report is structured and presented in the order of the attack path. The technical nodes, vulnerability nodes and related information corresponding to each step are clearly marked. The test results are associated with the nodes in the path, and the execution status and output data of the exploitation method are recorded.

[0063] like Figure 2 As shown, an embodiment of the present invention provides a knowledge-driven penetration testing system including:

[0064] Build a knowledge graph module to build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes.

[0065] The detection module is used to detect the service, port and operating system information of the target host, and map the detection results into the knowledge graph to generate nodes related to the target host and their association relationships;

[0066] The reasoning module is used to generate vulnerability exploitation methods and attack paths through reasoning based on the nodes and relationships in the knowledge graph, analyze the technologies and vulnerabilities involved in the path, and adjust the path using dynamic optimization methods;

[0067] The analysis module is used to analyze the execution results of the attack path and its utilization method, and generate a penetration test report containing path logic, test results and related data.

[0068] The knowledge-driven penetration testing system provided by the embodiment of the present invention realizes the automation and intelligence of the entire process from information collection, vulnerability exploitation path generation, path optimization to penetration test result analysis by constructing a knowledge graph module, a detection module, a reasoning module and an analysis module. The system constructs a knowledge graph ontology based on the ATT&CK framework, ensuring comprehensive coverage and structured expression of attack techniques and tactics, while providing high-quality semantic support and associative reasoning capabilities for subsequent reasoning and optimization processes. The knowledge graph ontology includes the definition of node types and relationships between nodes, covering five types of nodes: techniques and tactics (Tactics & Techniques), technologies (Techniques), vulnerabilities (Vulnerabilities), services (Services) and assets (Assets), as well as the association relationships between them (such as dependencies, causal relationships, hierarchical relationships, etc.). This construction process provides a structured knowledge expression and reasoning framework based on the semantic web for the reasoning analysis of penetration testing.

[0069] The detection module systematically collects information about the target host's services, ports, and operating systems through a combination of active and passive reconnaissance. The detection data is matched with existing node types in the knowledge graph through a mapping function to generate new nodes related to the target host (such as specific service nodes or asset nodes). Logical associations between nodes are established based on association rules (for example, a service depends on the implementation of a specific operating system). This module improves the sophistication and accuracy of the detection process through methods such as Nmap scanning and service fingerprinting, providing high-quality data support for subsequent reasoning and analysis.

[0070] Based on a constructed knowledge graph, the reasoning module automatically generates and optimizes attack paths through a graph inference algorithm and a path optimization algorithm. The path generation process utilizes relational inference and pathfinding algorithms, such as depth-first search (DFS), breadth-first search (BFS), or the A* algorithm, within the knowledge graph. Combined with a comprehensive analysis of rule-based reasoning and probabilistic reasoning, it generates attack paths that meet the target conditions. During the path optimization phase, the system utilizes dynamic optimization methods, including simulated annealing and particle swarm optimization (PSO), to optimize the selection of tactics and resource allocation within the path to achieve optimal attack efficiency.

[0071] The analysis module conducts in-depth analysis of the generated attack paths and execution results, utilizing automated vulnerability validation and exploit chain generation techniques to assess the exploitability and attack effectiveness of each node in the path. The system compares and verifies the analysis results with the original data in the knowledge graph, generating a penetration testing report that includes the path logic, technology stack, testing results, and related data. Through feedback analysis of the path execution process, the system continuously optimizes the accuracy and coverage of the knowledge graph.

[0072] Furthermore, the computer device provided by the present invention includes memory and a processor, and implements efficient execution of the knowledge graph construction and reasoning process through a computer program stored in the memory. By invoking multithreading processing and parallel computing technologies, the program significantly improves the efficiency and accuracy of penetration testing. A framework design based on GPU acceleration and distributed computing enables the reasoning and optimization of large-scale knowledge graphs to be completed efficiently and in real time.

[0073] To implement the above method, the present invention also provides a computer-readable storage medium for storing a computer program to support the continuous optimization and updating of the knowledge graph. Through dynamic learning of new technologies and new vulnerabilities, the system can achieve real-time expansion and adaptive updating of the knowledge base. This design ensures that the system can maintain efficient and accurate attack path reasoning capabilities when facing complex and changing attack environments.

[0074] The knowledge-driven penetration testing system provided by this invention significantly improves the intelligence and efficiency of penetration testing by combining knowledge graph construction, automated reasoning analysis, and path optimization algorithms. Compared with traditional penetration testing methods, this system not only quickly generates efficient attack paths but also conducts in-depth analysis and feedback optimization of the execution effects of attack paths, providing an innovative solution for network security attack and defense.

[0075] The present invention provides a knowledge-driven penetration testing method, including:

[0076] 1) Knowledge graph construction:

[0077] Build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes.

[0078] In this embodiment, Figure 3 As shown in the figure, based on the ATT&CK framework, the node types of the knowledge graph are designed, including technical and tactical nodes, technology nodes, vulnerability nodes, service nodes and asset nodes, and the relationships between the nodes are defined. Specifically, the knowledge graph defines the ownership relationship between service nodes and asset nodes, indicating that the service runs on the target host; the dependency relationship between service nodes and vulnerability nodes, indicating that these services may be affected by vulnerabilities; the utilization relationship between vulnerability nodes and technology nodes, indicating that specific vulnerabilities can be exploited through specific technologies; the connection relationship between asset nodes, indicating the network connection between different hosts, attackers can penetrate from one host to another through these connections. Figure 4 As shown, when the knowledge graph is initialized, it combines the CVE vulnerability library and common service database, adds known vulnerabilities, services and their exploitation techniques to support the analysis and reasoning of the attack chain logic.

[0079] 2) Detect target host information and map it to the knowledge graph: Figure 5 As shown;

[0080] Detect the target host's services, ports, and operating system information, and map the detection results to the knowledge graph to generate nodes related to the target host and their associations;

[0081] In this example, we collected information about the target host, including open ports, running services, and operating system properties, through port scanning, service fingerprinting, and operating system detection techniques. The detection results were then mapped to a knowledge graph. Using Nmap, we discovered that target host A (192.168.1.3) had open ports 80 and 3306, running Nginx 1.18 and MySQL 5.7, respectively. Based on the scan results, we inferred that the operating system of target host A was Ubuntu 20.04.

[0082] 3) Vulnerability exploitation methods and attack paths based on knowledge graph reasoning: Figure 6 As shown,

[0083] Based on the nodes and relationships in the knowledge graph, vulnerability exploitation methods and attack paths are generated through reasoning, and the technologies and vulnerabilities involved in the path are analyzed, and the path is adjusted using dynamic optimization methods;

[0084] In this embodiment, the reasoning process of each host vulnerability exploitation method starts from each asset node in the knowledge graph, and combines the association between assets and services, services and vulnerabilities, vulnerabilities and technologies, and technologies and tactics to deduce possible vulnerability exploitation methods.

[0085] Regarding the possible vulnerability exploitation method of host A, the MySQL 5.7 service node of host A exploits the CVE-2020-2574 vulnerability to trigger SQL injection technology, and obtains administrator privileges by injecting malicious SQL queries. At this stage, the privileges of host A are upgraded to the admin level, and the permission information of the asset node corresponding to host A is updated to admin.

[0086] 4) Repeat 2) and 3):

[0087] In this example, after obtaining the permissions of host A, further detection discovered the target host B (192.168.2.3), with an open port of 6379, running the Redis 5.0 service. Regarding the possible vulnerability exploitation method for host B, the unauthorized access vulnerability CVE-2020-14147 of the Redis 5.0 service was exploited to gain control of host B. At this point, the permissions of host B were elevated to the user level, and the permission information of the asset node corresponding to host B was updated to user. Through host A, host C (192.168.2.4) was detected to have an open 443 / TCP port and to have deployed Nginx version 1.25. The scan results showed that WAF protection and TLS 1.3 encryption were enabled during compilation of the service. For host C, there were no exploitable vulnerabilities, and user or admin permissions could not be obtained. Host B also detected host D (192.168.3.3), which has open ports 22, 80, and 443, running SSH 7.7, Apache, and Nginx 1.26. The operating system of host D is presumed to be Ubuntu 20.04. Regarding possible exploits for host D, the SSH 7.7 service vulnerability CVE-2018-15473 was exploited to verify username information, and a brute force password attack was launched to obtain host D's permissions. At this point, host D's permissions were elevated to admin, and the permissions of the asset node corresponding to host D were updated to admin. ARP and routing information were used to deduce the existence of shared networks between hosts A and B, A and C, and B and D, and that there was a network connectivity problem between hosts A and D. By comparing the detection information with existing nodes in the knowledge graph, Nginx, MySQL, Redis, SSH, and Apache service nodes and their corresponding asset nodes were generated, and the service nodes were connected to the corresponding asset nodes.

[0088] 5) Inference attack path:

[0089] During the inference process, host A is marked as the starting point, and the goal is full control of host D. For asset nodes that can obtain user or admin permissions, if the network is connected, the corresponding nodes are connected in the knowledge graph. In this example, host A is connected to host B, and host B is connected to host D.

[0090] The optimal attack path is inferred by the inference engine through the BFS breadth-first search algorithm. In this embodiment, the optimal path is host A-host B-host D. Using the inferred vulnerability exploitation method of hosts A, B, and D, the attacker moves laterally through the shared network connection relationship between hosts, obtains the admin privileges of host A, then moves to host B, obtains the user privileges of host B, and then moves to host D, obtains the admin privileges of host D, and obtains full control of host D.

[0091] 6) Perform penetration testing and analyze the results:

[0092] Analyze the attack path and its execution results of the exploitation method, and generate a penetration test report containing the path logic, test results and related data;

[0093] In this embodiment, the recommended attack path is implemented and verified. Starting from host A, the CVE-2020-2574 vulnerability is used to trigger the SQL command injection technology to obtain the management rights of host A. After successfully controlling host A, turn to the Redis5.0 service node of host B through the connection relationship between the asset nodes in the knowledge graph. Further exploit the unauthorized access vulnerability CVE-2020-14147 of the Redis5.0 service of host B to successfully obtain the permissions of host B. Through the shared network connection relationship between host B and host D, penetrate horizontally to host D, and exploit the SSH7.7 service vulnerability CVE-2018-15473 on host D to further enhance permissions, and finally achieve complete control over host D. The test results of the path show that the path cost is low, the attack implementation process is simple and stable, and it can efficiently complete lateral movement and target control from host A to host D;

[0094] After the test is completed, a penetration test report is generated based on the test results. The penetration test report is as follows:

[0095]

[0096]

[0097] The application field of this invention is enterprise security protection and automated penetration testing.

[0098] Penetration testing is a crucial security assessment tool for modern enterprise network security, simulating real-world attack scenarios and uncovering potential vulnerabilities in systems, networks, applications, and configurations. Traditional penetration testing methods rely on manual operations, requiring testers to manually identify assets, detect services, analyze vulnerabilities, and attempt different attack paths. This not only consumes significant time and resources, but can also lead to missing critical security risks due to inexperienced testers or a single attack method. Furthermore, enterprise network environments are often complex, encompassing multiple operating systems, databases, middleware, cloud services, and office terminals. This results in a vast testing scope and diverse vulnerabilities, making systematic security assessments difficult.

[0099] The present invention uses a knowledge-driven penetration testing method to perform intelligent attack path reasoning on the internal network of an enterprise, thereby achieving efficient, accurate, and reproducible penetration testing. First, the system uses the ATT&CK framework to build an internal attack knowledge graph for the enterprise, covering various node information such as techniques and tactics, technology, vulnerabilities, services, assets, etc., and models the attack surface of the enterprise through the association relationship between them. This knowledge graph not only contains known vulnerability information, but also automatically generates possible attack chains based on the specific environment of the enterprise (such as the network topology of assets, permission distribution, etc.). By continuously updating and optimizing the knowledge graph, the system can synchronize with the latest threat intelligence and improve the accuracy of penetration testing.

[0100] When performing a penetration test, the present invention first performs intelligent detection on the target network, identifies all online hosts, and extracts the services, ports, operating system types, and version information running on each host. This step uses technologies such as port scanning, fingerprint recognition, and protocol parsing. The scan results are then mapped to a knowledge graph, and the system automatically creates or updates relevant nodes to form a complete enterprise security asset map. Once the knowledge graph of the target network is constructed, the system can perform reasoning analysis based on this information to generate the optimal attack path. Unlike traditional manual testing, which requires penetration testers to gradually try various vulnerability combinations, the present invention uses a knowledge graph reasoning engine combined with a breadth-first search algorithm to calculate the shortest path from the starting host to the target host for the attacker, and then conducts a penetration test. In addition, the system can also dynamically evaluate the authority distribution of internal assets of the enterprise, determine whether a compromised host has higher authority, such as administrator authority (admin), ordinary user authority (user), or guest authority (guest), and thus decide whether the host can be used for further attacks.

[0101] A major advantage of the present invention is that it can automatically generate penetration test reports. The system will present the test results in a structured manner according to the order of the attack path, including attack path logic, vulnerabilities involved, attack methods, test results, permission changes and other information.

[0102] In actual applications, the system can be widely used in scenarios such as enterprise security operation centers (SOCs), enterprise red-blue confrontation drills, vulnerability management and risk assessment.

[0103] Compared to traditional penetration testing methods, this method not only improves testing efficiency and coverage, but also significantly reduces reliance on tester experience, enabling enterprises to more quickly and accurately identify security vulnerabilities and enhance overall defense capabilities. This method has broad application value in areas such as APT attack protection, insider threat simulation, and security compliance assessment, making it an indispensable tool in modern enterprise security protection systems.

[0104] The knowledge-driven penetration testing method of the present invention can effectively reduce the complex work of manual analysis, improve testing efficiency and accuracy, and enhance the comprehensive analysis of attack paths compared to traditional penetration testing methods. In the traditional penetration testing process, testers need to manually collect asset information of the target environment, including servers, network topology, open ports, operating systems and their version information, etc., and then analyze the possible vulnerabilities therein one by one, and try different attack methods. This method is not only time-consuming and labor-intensive, but also relies on the experience of the testers, and is prone to missing certain hidden attack paths, resulting in incomplete and uncertain test results. The present invention is based on knowledge graph reasoning, which can automatically build a security knowledge base of the target system in a short time, and infer the optimal attack path, avoiding the inefficiency and omission problems that may occur in the manual analysis process.

[0105] The present invention can assist security personnel in quickly understanding the logical relationship of the attack path during the penetration test process. Traditional penetration test reports usually only list the vulnerabilities discovered and successful attack attempts, but often lack a global analysis of the attack chain, making it difficult for security teams to extract the complete path that the attacker may take. The system of the present invention can automatically generate a structured attack path report based on the knowledge graph, clearly showing every step of the attacker's actions from entering the enterprise network to ultimately controlling core assets. The entire path is automatically inferred by the system, allowing security personnel to clearly understand the formation process of the attack chain and strengthen defenses for each key link.

[0106] Furthermore, the present invention can significantly enhance the analytical depth of penetration testing. Traditional penetration testing often focuses on exploiting a single vulnerability. For example, testers may only attempt SQL injection, remote code execution, or weak password attacks without systematically analyzing the interactions between these vulnerabilities. The present invention, through the associative reasoning of the knowledge graph, can automatically analyze the exploitation relationships between multiple vulnerabilities and form a complete attack path. This cross-vulnerability attack method is easily overlooked in manual testing.

[0107] Another key technical advantage of this invention is its ability to generate high-quality penetration test reports. Traditional test reports are typically compiled manually by security personnel, which is not only time-consuming but also prone to missing important details. This invention, however, automatically extracts attack path information after the test is completed and presents the test results in a structured manner, aligning the attack chain.

[0108] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0109] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A knowledge-driven penetration testing method, characterized in that: The following steps are involved: Step 1: Build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes. Step 2: Detect the service, port, and operating system information of the target host, and map the detection results into the knowledge graph to generate nodes related to the target host and their association relationships; Step 3: Based on the nodes and relationships in the knowledge graph, we generate vulnerability exploitation methods and attack paths through reasoning, analyze the technologies and vulnerabilities involved in the paths, and adjust the paths using dynamic optimization methods. Step 4: Analyze the execution results of the attack path and its exploitation method, and generate a penetration test report containing the path logic, test results and related data.

2. The knowledge-driven penetration testing method according to claim 1, wherein: In the knowledge nodes, the technical and tactical, tactics, and vulnerability node information includes: node name, node type, and node attribute description; service node information includes: node name, node type, node attribute description, and node location information; asset node information includes: node name, node type, node attribute description, node location information, and node permission level information, where the permission level information content is guest, user, or admin; The relationships between knowledge node types include the connection order relationship between technical and tactical nodes, the support relationship between technical and tactical nodes and technology nodes, the utilization relationship between technology nodes and vulnerability nodes, the dependency relationship between vulnerability nodes and service nodes, the ownership relationship between service nodes and asset nodes, and the connection relationship between asset nodes.

3. The knowledge-driven penetration testing method according to claim 1, wherein: The detected information includes the target host's open ports, the name and version of the running service, the type and version of the operating system, and the target host's network address information; The detection method includes using port scanning technology to identify the open ports and communication protocols of the target host, determining the running services and their versions on the port through service fingerprint analysis technology, inferring the type and version of the operating system based on network characteristics, and using network scanning tools to obtain the IP address and MAC address of the target host.

4. The knowledge-driven penetration testing method according to claim 1, wherein: The mapping process of the detection results includes defining the information of the target host as an asset node, defining the detected running service as a service node, and creating or updating the relevant nodes and their attribute information in the knowledge graph according to the detection information; The relationships between nodes include the ownership relationship between service nodes and asset nodes, which is used to describe that the service runs on a specific target host, and the association relationship between service nodes and vulnerability nodes, which is used to describe possible security vulnerabilities in the service.

5. The knowledge-driven penetration testing method according to claim 1, wherein: The reasoning process is executed by the knowledge graph reasoning engine, starting from the set asset node, combining the support relationship, utilization relationship and dependency relationship in the knowledge graph, and gradually deducing possible vulnerability exploitation methods; Generate attack paths through asset node connections; The inference engine calculates the shortest path from the starting host node to the target host node using the BFS breadth-first search algorithm; When adding a new host, the inference engine will determine whether the network connection between the host and the existing hosts is smooth, and determine whether permissions can be obtained through the host based on the permission level of the current node; if the permissions of the host can be obtained, the permission attributes of the node will be updated.

6. The knowledge-driven penetration testing method according to claim 1, wherein: The vulnerability exploitation rules are defined based on the technical nodes and vulnerability nodes in the attack path, and include the tools, steps, and parameter configuration methods required to implement specific technical operations; The generation process selects the corresponding rules by matching the node information in the attack path, and adjusts the parameter configuration based on the service version, operating system type and other detected environmental information of the target host; The content of the penetration test report is structured and presented in the order of the attack path. The technical nodes, vulnerability nodes and related information corresponding to each step are clearly marked. The test results are associated with the nodes in the path, and the execution status and output data of the exploitation method are recorded.

7. A knowledge-driven penetration testing system that implements the knowledge-driven penetration testing method according to any one of claims 1 to 6, characterized in that: The knowledge-driven penetration testing system includes: Build a knowledge graph module to build a knowledge graph ontology based on the ATT&CK framework. The knowledge graph ontology includes knowledge node types and the relationship between any two knowledge node types. Knowledge node types include tactics, technology, vulnerability, service, and asset nodes. The detection module is used to detect the service, port and operating system information of the target host, and map the detection results into the knowledge graph to generate nodes related to the target host and their association relationships; The reasoning module is used to generate vulnerability exploitation methods and attack paths through reasoning based on the nodes and relationships in the knowledge graph, analyze the technologies and vulnerabilities involved in the path, and adjust the path using dynamic optimization methods; The analysis module is used to analyze the execution results of the attack path and its utilization method, and generate a penetration test report containing path logic, test results and related data.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the knowledge-driven penetration testing method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the knowledge-driven penetration testing method according to any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the knowledge-driven penetration testing system as described in claim 7.

Images