An artificial intelligence-based medical network collaborative penetration testing system and method

Abstract

The application discloses a medical network collaborative penetration testing system and method based on artificial intelligence, and belongs to the technical field of medical information security. The method comprises the following steps: integrating a hospital intranet, medical equipment, cloud data center data and historical network delay data to construct a medical network data hub; analyzing the correlation between network vulnerabilities and delay data through a graph neural network; constructing an attack path analysis model containing delay weight; quantifying risk scores to generate a test target priority list; defining protocol vulnerabilities and delay thresholds, designing test scenarios and generating attack vectors, matching attack tools for simulation testing, calculating vulnerability trigger success rates and evaluating risks; generating penetration testing cases according to the test target priority list and the risk level, performing multiple rounds of attack testing and generating a report; monitoring the change of the vulnerability trigger success rate by dynamically adjusting the delay parameter, setting an early warning threshold, and real-time monitoring and sending a risk early warning notification.

Description

Technical Field

[0001] This invention relates to the field of medical information security technology, specifically to an artificial intelligence-based collaborative penetration testing system and method for medical networks. Background Technology

[0002] With the continuous advancement of medical informatization, medical networks have evolved into complex networks composed of various medical devices, hospital internal management systems, and regional health information sharing platforms. This network carries critical business processes such as patients' health data and hospital treatment workflows; its security directly determines the continuous and stable operation of medical services and the protection of patients' lives. Penetration testing, as an important means of assessing network security, simulates the behavior of malicious attackers to detect vulnerabilities in the network system, providing crucial evidence for security protection.

[0003] In healthcare network scenarios, penetration testing can accurately locate various potential security vulnerabilities and assess the impact of cyberattacks on healthcare business continuity. However, most mainstream penetration testing techniques currently rely on general vulnerability scanning tools and pre-set attack script libraries, neglecting the interaction between the unique communication protocol characteristics of medical devices and the real-time requirements of healthcare services. Medical devices often use proprietary protocols for data interaction, and medical IoT devices need to maintain microsecond-level timely responses in emergency treatment scenarios. However, existing penetration testing techniques fail to fully consider the relevant impact of network latency on testing, resulting in simulated attacks failing to realistically reproduce the chain reaction triggered by vulnerabilities in high-latency scenarios. Furthermore, existing penetration testing attack path planning is based solely on static vulnerability priorities and cannot dynamically assess the actual feasibility of vulnerability triggering under different latency conditions. Ultimately, this leads to penetration testing's inability to accurately quantify the degree of disruption to healthcare business continuity caused by cyberattacks. Summary of the Invention

[0004] The purpose of this invention is to provide an artificial intelligence-based medical network collaborative penetration testing system and method to solve the problems mentioned in the background art.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a medical network collaborative penetration testing method based on artificial intelligence, the method comprising:

[0006] Step S100: Integrate the network topology information, device attributes, and vulnerability database of the hospital intranet, medical equipment, and cloud data center, and combine them with historical network latency data between each network node to construct a medical network data hub;

[0007] Step S200: Use graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, construct an attack path analysis model that includes latency weights, and generate a test target priority list based on the output of the model by quantifying the path risk score.

[0008] Step S300: Construct a multi-dimensional feature device set based on the medical network data hub, define a set of protocol vulnerabilities and determine the latency threshold of each network link by combining historical latency data and network topology features; design test scenarios covering different latency conditions, generate attack vectors for each scenario and automatically match attack tools for simulation testing; compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level by combining historical attack data.

[0009] Step S400: Based on the test target priority list and vulnerability risk level, generate penetration test cases by associating target device characteristics, protocol vulnerabilities and latency conditions, execute multiple rounds of attack tests under different latency thresholds, and generate a test report based on the test results;

[0010] Step S500: By dynamically adjusting the delay parameters, monitor and record the change value of vulnerability trigger success rate and delay parameter changes in real time, set a dynamic early warning threshold, and when the change value exceeds the early warning threshold in real time, locate the risk location and related network links and device nodes through the reverse node to issue a risk warning notification.

[0011] Furthermore, step S100 includes:

[0012] Step S101: Using the hospital network management system, scan and record the IP addresses, MAC addresses, and open ports of all devices; draw a network topology diagram; mark the physical and communication connection paths between devices; record the adjacency relationships and access permissions of each network node; collect device model, operating system version, firmware version, and service configuration information using the device management interface; associate the device's network region with the administrator's permission configuration; associate with a general vulnerability database; filter out entries related to medical devices; integrate the hospital's historical security event logs; and mark the vulnerability triggering conditions.

[0013] By deploying network performance monitoring tools, we continuously monitor the end-to-end latency of each communication link, store historical latency data, and associate the latency data with network topology nodes; for data involving patient personal information, we use virtual IDs to replace real patient identifiers, hide image file identification information, use encryption technology to store patient-related information, and unify and standardize data formats;

[0014] Step S102: A graph database is used to store the network topology and device relationships. The nodes of the graph database include medical devices, network regions, and cloud services. Edges represent the connection relationships between nodes and the access permissions between different nodes. A time-series database is used to store network latency data, and a relational database is established to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, scope of impact, and vulnerability attack difficulty. The various types of data collected in step S101 are integrated according to the corresponding data storage methods. The association between the various databases is established through device IDs and network region identifiers. Based on the integrated and associated data, a complete medical network data hub is formed.

[0015] Furthermore, step S200 includes:

[0016] Step S201: Perform data cleaning on the data in the medical network data hub constructed in step S102, removing duplicate, erroneous, and invalid data records; integrate various protocols used in the medical network; extract medical protocol interaction characteristics, including protocol type, port number, data packet format, and communication frequency; extract network latency data from the time-series database, and calculate the average latency, maximum latency, and latency fluctuation rate over different time periods as statistical features of network latency; simultaneously, combine the network topology structure to extract latency-related topological features, including node degree and path length; extract features from vulnerability details in the relational database, including vulnerability type, vulnerability level, impact scope, and vulnerability attack difficulty; and fuse these features with medical protocol features and network latency features; based on historical security event logs, annotate the data to mark vulnerable devices and paths, as well as the corresponding vulnerability triggering conditions and risk levels;

[0017] Step S202: Medical protocol features, network latency features, and vulnerability features are fused and encoded to construct an input vector; a multi-layer graph convolutional network architecture is constructed, and the topological association information and attribute features of neighboring nodes are aggregated layer by layer through a message passing mechanism. An attention mechanism is introduced into the graph convolutional layer, and the information of neighboring nodes is weighted and aggregated by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, the vulnerability trigger probability and latency weight of each node are output; at the edge level, the risk propagation probability and latency tolerance threshold of the communication link between adjacent nodes are calculated; the vulnerability trigger probability represents the probability that the vulnerability risk of one node will propagate to another node in the communication link between adjacent nodes; the latency tolerance threshold represents the maximum latency time that the communication link between adjacent nodes can tolerate; the graph neural network model is trained using labeled data, and the cross-entropy loss function and stochastic gradient descent algorithm are used to continuously adjust the model parameters until the model reaches the preset stopping condition;

[0018] Step S203: Based on the predicted values ​​output by the model, a weighted random walk algorithm is used to simulate the attack path generation process; starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the selection probability weight, and the network link latency tolerance is used as the adjustment coefficient for sampling.

[0019] P(v j |v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))];

[0020] Where v i Represents the current node, v j P(v) represents the candidate next-hop node. j |v i ) indicates that the current node is v i Under the condition of selecting neighbor node v j The conditional probability of being the next hop node; v k Indicates the current node v i Any neighboring node of P(v) k ) represents the node v output by the model. k The probability of vulnerability triggering; P(v j ) represents the node v output by the model. jThe probability of the vulnerability being triggered; e ik Indicates connection to the current node v i Its neighbor node v k The edge; D(e) ik ) represents the edge e output by the model. ik Delay weights; N i Represents node v i The set of neighboring nodes, e ij Indicates the connection node v i and v j The edge, D(e) ij ) represents the edge e output by the model. ij Delay weights;

[0021] Set termination conditions: Trigger any of the above conditions to terminate path sampling when the total path delay exceeds the set maximum network tolerance threshold, or the probability of triggering vulnerabilities in m consecutive nodes is lower than a preset threshold.

[0022] Step S204: Calculate the comprehensive risk score R for each sampling path:

[0023] R = Π e∈path P(e)·exp(-D total / D net );

[0024] Where path represents the sampling penetration path, represented by a sequence of edges; P(e) represents the vulnerability trigger probability of each edge e in the path; D total D represents the total path delay time. net The network diameter is defined as the maximum distance between any two nodes in the network. It is measured using a link tree, by calculating the shortest path between any two nodes in the network, and taking the maximum value among these shortest paths to determine the network diameter. The network diameter is then sorted in descending order based on the comprehensive risk score, ultimately forming a penetration test target list with priority ranking.

[0025] Furthermore, step S300 includes:

[0026] Step S301: Based on the device information scanned by the hospital network management system in step S101, construct a multi-dimensional feature device set as D = {d1, d2, ..., dn}, where dn represents the feature information of the nth device, including the device's IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network area, and administrator permission configuration.

[0027] The set of delay conditions is set as L = {l1, l2, ..., lm}, where lm represents the m-th composite delay constraint. Each composite delay constraint corresponds to a specific delay threshold. The delay threshold is determined by combining the end-to-end delay recorded in step S101, the average delay, maximum delay, and delay fluctuation rate calculated in step S201, as well as the node degree and path length extracted in step S201.

[0028] Define the protocol vulnerability set as U = {u1, u2, ..., uq}, where uq represents the q-th protocol vulnerability; each protocol vulnerability includes vulnerability type, vulnerability attack vector, target device characteristics, expected response mode, and risk level;

[0029] Step S302: Based on the graph database constructed in step S102, and combined with historical latency data from the time-series database, a network simulation engine dynamically generates a test environment that conforms to the L-set constraints. When a latency threshold is set, subgraphs that satisfy the node degree and path length constraints are selected from the network topology. Then, by adjusting the link bandwidth parameters and background traffic load, the end-to-end latency distribution between any two nodes in the subgraph conforms to the preset statistical characteristics. For each protocol vulnerability, the attack vector automatically selects a matching attack tool based on its vulnerability type. Simultaneously, key parameters are extracted from the device configuration information collected in step S101. After the attack payload is sent to the target device, it is processed through... Deep packet inspection technology captures response traffic and performs pattern matching against expected response patterns defined in the protocol vulnerability set. If a match is successful, a risk level assessment process is triggered, a comprehensive scoring rule is constructed, and a weighted sum is performed based on the vulnerability trigger probability, latency weight, and risk propagation probability output by the model. A risk level threshold is set, and the risk level is determined based on the comprehensive score, including low, medium, and high risk levels, and the risk information is recorded. If a match fails, the entire process of this attack attempt is recorded, including the attack time, the attack tools and parameters used, and the actual response of the target device. The number of successful matches and the total number of attempts are counted to obtain the vulnerability trigger success rate.

[0030] Furthermore, step S400 includes:

[0031] Step S401: Based on the priority-ranked penetration test target list generated in step S204, and the multi-dimensional feature device set and protocol vulnerability set constructed in step S301, combined with the test environment generated in step S302, test cases are generated. For paths with higher priority in the penetration test target list, test cases are designed by prioritizing the associated device features and corresponding protocol vulnerabilities, setting attack vectors, and simulating data packets sent to the device by an attacker using the vulnerability. Simultaneously, combined with the latency-constrained test environment generated in step S302, the test is repeated multiple times under different latency thresholds to monitor whether the vulnerability triggering success rate is affected. Under simulated latency conditions, the generated test cases are executed one by one to monitor the response of the target device and the vulnerability exploitation success rate. The device response traffic is captured in real time using the deep packet inspection technology deployed in step S302, and compared with the expected response pattern to determine whether the vulnerability has been successfully exploited. At the same time, by dynamically adjusting the latency parameters, the network latency environment is gradually changed, and values ​​are taken multiple times from low latency to high latency range to record the changes in the vulnerability triggering success rate under different latency conditions.

[0032] Step S402: After the test is completed, a test report containing latency thresholds is generated. The report includes: the execution status of all test cases, including the target device, the attack vector used, the latency conditions of the test scenario, whether the vulnerability was successfully triggered, the comprehensive risk score, and the determined risk level. Together with the above test results, they constitute a complete test report.

[0033] Furthermore, step S500 involves real-time monitoring and recording of changes in vulnerability trigger success rate and latency parameters, collecting historical data on vulnerability trigger success rate and latency parameters, and calculating the mean and standard deviation. The thresholds for vulnerability trigger success rate and latency parameters are set as the mean plus a set multiple of the standard deviation. When a change value exceeds the warning threshold, the medical data center traces back from the abnormal end node to locate the specific risk location and related network links and device nodes, and issues a risk warning notification.

[0034] An AI-based collaborative penetration testing system for medical networks includes a medical network data hub construction module, an attack path analysis module, a composite attack scenario generation module, a penetration testing execution module, and an adaptive risk warning module.

[0035] The medical network data hub construction module integrates the network topology information, device attributes, and vulnerability databases of the hospital intranet, medical equipment, and cloud data center, and combines historical network latency data between various network nodes to construct the medical network data hub.

[0036] The attack path analysis module uses graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, constructs an attack path analysis model that includes latency weights, and generates a test target priority list based on the output of the model by quantifying the path risk score.

[0037] The composite attack scenario generation module constructs a multi-dimensional feature device set based on the medical network data hub, combines historical latency data and network topology features, defines a set of protocol vulnerabilities and determines the latency threshold of each network link; designs test scenarios covering different latency conditions, generates attack vectors for each scenario and automatically matches attack tools for simulation testing; compares the simulated attack test results with the expected response results, calculates the vulnerability trigger success rate, and evaluates the vulnerability risk level in combination with historical attack data;

[0038] The penetration test execution module generates penetration test cases based on the test target priority list and vulnerability risk level, as well as the target device characteristics, protocol vulnerabilities, and latency conditions. It executes multiple rounds of attack tests under different latency thresholds and generates a test report based on the test results.

[0039] The adaptive risk warning module dynamically adjusts the latency parameter, monitors and records the changes in vulnerability trigger success rate and latency parameter changes in real time, sets a dynamic warning threshold, and when the real-time monitoring shows that the change value exceeds the warning threshold, it uses the reverse node to locate the risk location and related network links and device nodes to send a risk warning notification.

[0040] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0041] This invention achieves efficient aggregation and deep fusion of multi-source heterogeneous data by constructing a medical network data hub. In this way, medical devices and network topology can be more accurately associated, improving the comprehensiveness and accuracy of medical network security testing.

[0042] This invention utilizes graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center. By constructing an attack path analysis model and quantifying path risk scores based on latency weights, it optimizes the priority ranking of penetration testing targets. This method can not only accurately identify potential attack paths but also dynamically adjust testing strategies, improving the efficiency and accuracy of penetration testing.

[0043] This invention generates multi-dimensional attack scenarios based on historical network latency data, device attributes, and protocol vulnerability information, and combines them with automatically matched attack tools for simulation testing. This allows penetration testing to be verified in a real-world operating environment. This testing method can not only discover potential security vulnerabilities, but also quantify the success rate of vulnerability triggering and assess the vulnerability risk level based on historical attack data, further enhancing the standardization and practicality of the testing process.

[0044] This invention dynamically adjusts latency parameters, monitors the relationship between vulnerability trigger success rate and latency changes in real time, sets early warning thresholds, and quickly determines risk locations and related network links through reverse node positioning technology, providing timely risk warning notifications. This effectively reduces the risk of network attacks and improves the overall security and protection capabilities of medical networks. Attached Figure Description

[0045] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0046] Figure 1 This is a flowchart of a collaborative penetration testing method for medical networks based on artificial intelligence. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] Please see Figure 1 This invention provides a technical solution: a collaborative penetration testing method for medical networks based on artificial intelligence, the method comprising:

[0049] Step S100: Integrate the network topology information, device attributes, and vulnerability database of the hospital intranet, medical equipment, and cloud data center, and combine them with historical network latency data between each network node to construct a medical network data hub;

[0050] Step S200: Use graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, construct an attack path analysis model that includes latency weights, and generate a test target priority list based on the output of the model by quantifying the path risk score.

[0051] Step S300: Construct a multi-dimensional feature device set based on the medical network data hub, define a set of protocol vulnerabilities and determine the latency threshold of each network link by combining historical latency data and network topology features; design test scenarios covering different latency conditions, generate attack vectors for each scenario and automatically match attack tools for simulation testing; compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level by combining historical attack data.

[0052] Step S400: Based on the test target priority list and vulnerability risk level, generate penetration test cases by associating target device characteristics, protocol vulnerabilities and latency conditions, execute multiple rounds of attack tests under different latency thresholds, and generate a test report based on the test results;

[0053] Step S500: By dynamically adjusting the delay parameters, monitor and record the change value of vulnerability trigger success rate and delay parameter changes in real time, set a dynamic early warning threshold, and when the change value exceeds the early warning threshold in real time, locate the risk location and related network links and device nodes through the reverse node to issue a risk warning notification.

[0054] Step S100 includes:

[0055] Step S101: Using the hospital network management system, scan and record the IP addresses, MAC addresses, and open ports of all devices; draw a network topology diagram; mark the physical and communication connection paths between devices; record the adjacency relationships and access permissions of each network node; collect device model, operating system version, firmware version, and service configuration information using the device management interface; associate the device's network region with the administrator's permission configuration; associate with a general vulnerability database; filter out entries related to medical devices; integrate the hospital's historical security event logs; and mark the vulnerability triggering conditions.

[0056] Historical security event logs are collected from various security devices and systems in the hospital. These logs record past security events, including attack attempts and abnormal access information. The collected logs are cleaned to remove duplicate, erroneous, and irrelevant records. Vulnerability entries related to medical devices are linked to the historical security event logs by time, IP address, and device identifier. The linked historical security event logs are then analyzed to understand the network environment, user behavior, and system configuration parameters at the time of the attack, and the triggering conditions for each vulnerability are summarized and marked on the corresponding vulnerability entry.

[0057] By deploying network performance monitoring tools, we continuously monitor the end-to-end latency of each communication link, store historical latency data, and associate the latency data with network topology nodes; for data involving patient personal information, we use virtual IDs to replace real patient identifiers, hide image file identification information, use encryption technology to store patient-related information, and unify and standardize data formats;

[0058] Step S102: A graph database is used to store the network topology and device relationships. The nodes of the graph database include medical devices, network regions, and cloud services. Edges represent the connection relationships between nodes and the access permissions between different nodes. A time-series database is used to store network latency data, and a relational database is established to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, scope of impact, and vulnerability attack difficulty. The various types of data collected in step S101 are integrated according to the corresponding data storage methods. The association between the various databases is established through device IDs and network region identifiers. Based on the integrated and associated data, a complete medical network data hub is formed.

[0059] Step S200 includes:

[0060] Step S201: Perform data cleaning on the data in the medical network data hub constructed in step S102, removing duplicate, erroneous, and invalid data records; integrate various protocols used in the medical network; extract medical protocol interaction characteristics, including protocol type, port number, data packet format, and communication frequency; extract network latency data from the time-series database, and calculate the average latency, maximum latency, and latency fluctuation rate over different time periods as statistical features of network latency; simultaneously, combine the network topology structure to extract latency-related topological features, including node degree and path length; extract features from vulnerability details in the relational database, including vulnerability type, vulnerability level, impact scope, and vulnerability attack difficulty; and fuse these features with medical protocol features and network latency features; based on historical security event logs, annotate the data to mark vulnerable devices and paths, as well as the corresponding vulnerability triggering conditions and risk levels;

[0061] Step S202: Medical protocol features, network latency features, and vulnerability features are fused and encoded to construct an input vector; a multi-layer graph convolutional network architecture is constructed, and the topological association information and attribute features of neighboring nodes are aggregated layer by layer through a message passing mechanism. An attention mechanism is introduced into the graph convolutional layer, and the information of neighboring nodes is weighted and aggregated by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, the vulnerability trigger probability and latency weight of each node are output; at the edge level, the risk propagation probability and latency tolerance threshold of the communication link between adjacent nodes are calculated; the vulnerability trigger probability represents the probability that the vulnerability risk of one node will propagate to another node in the communication link between adjacent nodes; the latency tolerance threshold represents the maximum latency time that the communication link between adjacent nodes can tolerate; the graph neural network model is trained using labeled data, and the cross-entropy loss function and stochastic gradient descent algorithm are used to continuously adjust the model parameters until the model reaches the preset stopping condition;

[0062] Step S203: Based on the predicted values ​​output by the model, a weighted random walk algorithm is used to simulate the attack path generation process; starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the selection probability weight, and the network link latency tolerance is used as the adjustment coefficient for sampling.

[0063] P(v j |v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))];

[0064] Where v i Represents the current node, v j P(v) represents the candidate next-hop node. j |v i ) indicates that the current node is v i Under the condition of selecting neighbor node v j The conditional probability of being the next hop node; v k Indicates the current node v i Any neighboring node of P(v) k ) represents the node v output by the model. k The probability of vulnerability triggering; P(v j ) represents the node v output by the model. jThe probability of the vulnerability being triggered; e ik Indicates connection to the current node v i Its neighbor node v k The edge; D(e) ik ) represents the edge e output by the model. ik Delay weights; N i Represents node v i The set of neighboring nodes, e ij Indicates the connection node v i and v j The edge, D(e) ij ) represents the edge e output by the model. ij Delay weights;

[0065] Set termination conditions: Trigger any of the above conditions to terminate path sampling when the total path delay exceeds the set maximum network tolerance threshold, or the probability of triggering vulnerabilities in m consecutive nodes is lower than a preset threshold.

[0066] Step S204: Calculate the comprehensive risk score R for each sampling path:

[0067] R = Π e∈path P(e)·exp(-D total / D net );

[0068] Where path represents the sampling penetration path, represented by a sequence of edges; P(e) represents the vulnerability trigger probability of each edge e in the path; D total D represents the total path delay time. net The network diameter is defined as the maximum distance between any two nodes in the network. It is measured using a link tree, by calculating the shortest path between any two nodes in the network, and taking the maximum value among these shortest paths to determine the network diameter. The network diameter is then sorted in descending order based on the comprehensive risk score, ultimately forming a penetration test target list with priority ranking.

[0069] Step S300 includes:

[0070] Step S301: Based on the device information scanned by the hospital network management system in step S101, construct a multi-dimensional feature device set as D = {d1, d2, ..., dn}, where dn represents the feature information of the nth device, including the device's IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network area, and administrator permission configuration.

[0071] The set of delay conditions is set as L = {l1, l2, ..., lm}, where lm represents the m-th composite delay constraint. Each composite delay constraint corresponds to a specific delay threshold. The delay threshold is determined by combining the end-to-end delay recorded in step S101, the average delay, maximum delay, and delay fluctuation rate calculated in step S201, as well as the node degree and path length extracted in step S201.

[0072] Define the protocol vulnerability set as U = {u1, u2, ..., uq}, where uq represents the q-th protocol vulnerability; each protocol vulnerability includes vulnerability type, vulnerability attack vector, target device characteristics, expected response mode, and risk level;

[0073] Step S302: Based on the graph database constructed in step S102, and combined with historical latency data from the time-series database, a network simulation engine dynamically generates a test environment that conforms to the L-set constraints. When a latency threshold is set, subgraphs that satisfy the node degree and path length constraints are selected from the network topology. Then, by adjusting the link bandwidth parameters and background traffic load, the end-to-end latency distribution between any two nodes in the subgraph conforms to the preset statistical characteristics. For each protocol vulnerability, the attack vector automatically selects a matching attack tool based on its vulnerability type. Simultaneously, key parameters are extracted from the device configuration information collected in step S101. After the attack payload is sent to the target device, it is processed through... Deep packet inspection technology captures response traffic and performs pattern matching against expected response patterns defined in the protocol vulnerability set. If a match is successful, a risk level assessment process is triggered, a comprehensive scoring rule is constructed, and a weighted sum is performed based on the vulnerability trigger probability, latency weight, and risk propagation probability output by the model. A risk level threshold is set, and the risk level is determined based on the comprehensive score, including low, medium, and high risk levels, and the risk information is recorded. If a match fails, the entire process of this attack attempt is recorded, including the attack time, the attack tools and parameters used, and the actual response of the target device. The number of successful matches and the total number of attempts are counted to obtain the vulnerability trigger success rate.

[0074] Step S400 includes:

[0075] Step S401: Based on the priority-ranked penetration test target list generated in step S204, and the multi-dimensional feature device set and protocol vulnerability set constructed in step S301, combined with the test environment generated in step S302, test cases are generated. For paths with higher priority in the penetration test target list, test cases are designed by prioritizing the associated device features and corresponding protocol vulnerabilities, setting attack vectors, and simulating data packets sent to the device by an attacker using the vulnerability. Simultaneously, combined with the latency-constrained test environment generated in step S302, the test is repeated multiple times under different latency thresholds to monitor whether the vulnerability triggering success rate is affected. Under simulated latency conditions, the generated test cases are executed one by one to monitor the response of the target device and the vulnerability exploitation success rate. The device response traffic is captured in real time using the deep packet inspection technology deployed in step S302, and compared with the expected response pattern to determine whether the vulnerability has been successfully exploited. At the same time, by dynamically adjusting the latency parameters, the network latency environment is gradually changed, and values ​​are taken multiple times from low latency to high latency range to record the changes in the vulnerability triggering success rate under different latency conditions.

[0076] Step S402: After the test is completed, a test report containing latency thresholds is generated. The report includes: the execution status of all test cases, including the target device, the attack vector used, the latency conditions of the test scenario, whether the vulnerability was successfully triggered, the comprehensive risk score, and the determined risk level. Together with the above test results, they constitute a complete test report.

[0077] Step S500 involves real-time monitoring and recording of changes in vulnerability trigger success rate and latency parameters, collecting historical data on vulnerability trigger success rate and latency parameters, and calculating the mean and standard deviation. The thresholds for vulnerability trigger success rate and latency parameters are set as the mean plus a set multiple of the standard deviation. When a change value is detected to exceed the warning threshold in real time, the medical data center traces back from the abnormal end node to locate the specific risk location and related network links and device nodes, and issues a risk warning notification.

[0078] Embodiments of the present invention:

[0079] Through the hospital's network management system, comprehensive equipment information was scanned and recorded. Taking an ultrasound diagnostic instrument as an example, this included its IP address, MAC address, open ports, and the connection paths between it and surrounding switches and servers, with access permissions marked. The device management interface was used to collect model number, operating system version, firmware version, and service configuration information showing that remote diagnostics was enabled. The associated network area was the 3rd floor, east wing of the outpatient building, and the administrator privileges were configured to the department head. Simultaneously, historical security event logs were collected, cleaned, and linked to a general vulnerability database, revealing a buffer overflow vulnerability in this device model, marked as triggered by receiving excessively long data packets. Network performance monitoring tools were deployed to continuously monitor latency across links, store data, and link topology nodes. Patient data was anonymized and encrypted. Finally, graph databases, time-series databases, and relational databases were used to integrate the data and construct a medical network data hub.

[0080] Data is cleaned, and medical protocol interaction features are extracted. Taking the image transmission protocol as an example, the port number is 5060, the data packet format follows the DICOM standard, and the communication frequency is once every 5 minutes. The average latency is 30ms, the maximum latency is 50ms, and the latency fluctuation rate is 10% calculated from the time series database. The node degree and path length are extracted by combining the topology. After extracting features from the vulnerability details, they are fused to label vulnerable devices and paths. Then, the input vector is constructed, and a multi-layer graph convolutional network is used to train the model, introducing an attention mechanism. For example, when training to detect the vulnerability risk of ECG monitors, the model focuses on the latency weight of the link between the monitor and the connected server. The output shows that at the node level, the probability of triggering the ECG monitor vulnerability is 30%, and the latency weight is 0.4; at the edge level, the probability of communication link risk propagation is 20%, and the latency tolerance threshold is 40ms. The weighted random walk algorithm is used to simulate the attack path, starting from the external network entry node and selecting the next hop according to the rules. If the vulnerability trigger probability of a node is low or the total path latency exceeds the threshold, the sampling is terminated. Finally, the comprehensive risk score of each sampled path is calculated and sorted to obtain a priority list of test targets.

[0081] A multi-dimensional set of characteristic devices is constructed, and the set of latency conditions is determined based on historical data. For example, the latency threshold during peak hours is set to twice the standard deviation of the average latency. The set of protocol vulnerabilities includes a vulnerability in a specific infusion pump protocol, which is classified as command injection. The attack vector is automatically matched with hacker tools. Based on a graph database and historical latency data, a network simulation engine generates a test environment and adjusts link bandwidth and background traffic to achieve the required latency. During an attack, an attack payload is sent targeting the infusion pump vulnerability. Deep packet inspection technology is used to capture the response and match it with the expected response. The risk level is assessed by weighted summation according to rules, and the number of successful matches and the total number of attempts are recorded to calculate the vulnerability triggering success rate.

[0082] Test cases are generated based on the priority list of test targets, device set, protocol vulnerability set, and test environment. High-priority path-related devices are tested first, simulating attackers sending specially crafted data packets to the devices. This is repeated multiple times with different latency thresholds. For high-risk image storage servers, tests are conducted in the low latency range of 20ms to high latency range of 60ms. The vulnerability triggering success rate and device response are monitored. Deep packet inspection technology is used to determine the vulnerability triggering status. Finally, a test report including latency thresholds is generated. Real-time monitoring of vulnerability triggering success rate and latency parameter changes is performed, historical data is collected to calculate the mean and standard deviation, and thresholds are set. Once the change exceeds the threshold, the risk location and link are located by tracing back from the abnormal end node based on the medical data center, and an early warning notification is issued.

[0083] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A collaborative penetration testing method for medical networks based on artificial intelligence, characterized in that: The method includes: Step S100: Integrate the network topology information, device attributes, and vulnerability database of the hospital intranet, medical equipment, and cloud data center, and combine them with historical network latency data between each network node to construct a medical network data hub; Step S200: Use graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, construct an attack path analysis model that includes latency weights, and generate a test target priority list based on the output of the model by quantifying the path risk score. Step S300: Construct a multi-dimensional feature device set based on the medical network data hub, define a set of protocol vulnerabilities and determine the latency threshold of each network link by combining historical latency data and network topology features; design test scenarios covering different latency conditions, generate attack vectors for each scenario and automatically match attack tools for simulation testing; compare the simulated attack test results with the expected response results, calculate the vulnerability trigger success rate, and evaluate the vulnerability risk level by combining historical attack data. Step S400: Based on the test target priority list and vulnerability risk level, generate penetration test cases by associating target device characteristics, protocol vulnerabilities and latency conditions, execute multiple rounds of attack tests under different latency thresholds, and generate a test report based on the test results; Step S500: By dynamically adjusting the delay parameters, monitor and record the change value of vulnerability trigger success rate and delay parameter changes in real time, set a dynamic early warning threshold, and when the change value exceeds the early warning threshold in real time, locate the risk location and related network links and device nodes through the reverse node to issue a risk warning notification.

2. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 1, characterized in that: Step S100 includes: Step S101: Using the hospital network management system, scan and record the IP addresses, MAC addresses, and open ports of all devices; draw a network topology diagram; mark the physical and communication connection paths between devices; record the adjacency relationships and access permissions of each network node; collect device model, operating system version, firmware version, and service configuration information using the device management interface; associate the device's network region with the administrator's permission configuration; associate with a general vulnerability database, filter out entries related to medical devices, and integrate the hospital's historical security event logs, marking vulnerability trigger conditions; deploy network performance monitoring tools to continuously monitor the end-to-end latency of each communication link, store historical latency data, and associate the latency data with network topology nodes; use virtual IDs to replace real patient identifiers for data involving patient personal information, hide image file identification information, use encryption technology to store patient-related information, and standardize the data format. Step S102: A graph database is used to store the network topology and device relationships. The nodes of the graph database include medical devices, network regions, and cloud services. Edges represent the connection relationships between nodes and the access permissions between different nodes. A time-series database is used to store network latency data, and a relational database is established to store vulnerability details and encrypted patient-related data. The vulnerability details include vulnerability type, vulnerability level, impact scope, and vulnerability attack difficulty. The various types of data collected in step S101 are integrated according to the corresponding data storage methods. The association between the various databases is established through device IDs and network region identifiers. Based on the integrated and associated data, a complete medical network data hub is formed.

3. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 1, characterized in that: Step S200 includes: Step S201: Clean the data in the medical network data hub to remove duplicate, erroneous, and invalid data records; integrate various protocols used in the medical network; extract medical protocol interaction characteristics, including protocol type, port number, data packet format, and communication frequency; extract network latency data from the time-series database, and calculate the average latency, maximum latency, and latency fluctuation rate over different time periods as statistical features of network latency; simultaneously, combine the network topology to extract latency-related topological features, including node degree and path length; extract features from vulnerability details in the relational database, including vulnerability type, vulnerability level, impact scope, and vulnerability attack difficulty; and fuse these features with medical protocol features and network latency features; based on historical security event logs, annotate the data to mark vulnerable devices and paths, as well as the corresponding vulnerability triggering conditions and risk levels; Step S202: Medical protocol features, network latency features, and vulnerability features are fused and encoded to construct an input vector; a multi-layer graph convolutional network architecture is constructed, and the topological association information and attribute features of neighboring nodes are aggregated layer by layer through a message passing mechanism. An attention mechanism is introduced into the graph convolutional layer, and the information of neighboring nodes is weighted and aggregated by calculating the attention weights between nodes; the model synchronously outputs two-dimensional prediction results: at the node level, the vulnerability trigger probability and latency weight of each node are output; at the edge level, the risk propagation probability and latency tolerance threshold of the communication link between adjacent nodes are calculated; the vulnerability trigger probability represents the probability that a vulnerability risk of one node will propagate to another node in the communication link between adjacent nodes; the latency tolerance threshold represents the maximum latency time that the communication link between adjacent nodes can tolerate; the graph neural network model is trained using labeled data, and the cross-entropy loss function and stochastic gradient descent algorithm are used to continuously adjust the model parameters until the model reaches the preset stopping condition.

4. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 3, characterized in that: Step S200 further includes: Step S203: Based on the predicted values ​​output by the model, a weighted random walk algorithm is used to simulate the attack path generation process; starting from the attack entry node, when selecting the next hop node at each step, the vulnerability trigger probability of the current node's neighbors is used as the selection probability weight, and the network link latency tolerance is used as the adjustment coefficient for sampling. P(v j ∣v i )=[P(v j )·exp(-D(e ij ))] / ∑ k∈Ni [P(v k )·exp(-D(e ik ))]; Where v i Represents the current node, v j P(v) represents the candidate next-hop node. j |v i ) indicates that the current node is v i Under the condition of selecting neighbor node v j The conditional probability of being the next hop node; v k Indicates the current node v i Any neighboring node of P(v) k ) represents the node v output by the model. k The probability of vulnerability triggering; P(v j ) represents the node v output by the model. j The probability of the vulnerability being triggered; e ik Indicates connection to the current node v i Its neighbor node v k The edge; D(e) ik ) represents the edge e output by the model. ik Delay weights; N i Represents node v i The set of neighboring nodes, e ij Indicates the connection node v i and v j The edge, D(e) ij ) represents the edge e output by the model. ij Delay weights; Set termination conditions: Trigger any of the above conditions to terminate path sampling when the total path delay exceeds the set maximum network tolerance threshold, or the probability of triggering vulnerabilities in m consecutive nodes is lower than a preset threshold. Step S204: Calculate the comprehensive risk score R for each sampling path: R=Π e∈path P(e)·exp(-D total / D net ); Where path represents the sampling penetration path, represented by a sequence of edges; P(e) represents the vulnerability trigger probability of each edge e in the path; D total D represents the total path delay time. net The network diameter is defined as the maximum distance between any two nodes in the network. It is measured using a link tree, by calculating the shortest path between any two nodes in the network, and taking the maximum value among these shortest paths to determine the network diameter. The network diameter is then sorted in descending order based on the comprehensive risk score, ultimately forming a penetration test target list with priority ranking.

5. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 1, characterized in that: Step S300 includes: Step S301: Construct a multi-dimensional feature device set D = {d1, d2, ..., dn} by scanning the device information through the hospital network management system, where dn represents the feature information of the nth device, including the device's IP address, MAC address, open port information, device model, operating system version, firmware version, service configuration information, network area, and administrator permission configuration. The set of delay conditions is set as L = {l1, l2, ..., lm}, where lm represents the m-th composite delay constraint. Each composite delay constraint corresponds to a specific delay threshold. The delay threshold is determined by combining the end-to-end delay recorded in step S101, the average delay, maximum delay, and delay fluctuation rate calculated in step S201, as well as the node degree and path length extracted in step S201. Define the protocol vulnerability set as U = {u1, u2, ..., uq}, where uq represents the q-th protocol vulnerability; each protocol vulnerability includes vulnerability type, vulnerability attack vector, target device characteristics, expected response mode, and risk level; Step S302: Based on the constructed graph database and combined with historical latency data from the time-series database, a network simulation engine dynamically generates a test environment that conforms to the constraints of set L. When a latency threshold is set, subgraphs that satisfy the constraints of node degree and path length are selected in the network topology. Then, by adjusting the link bandwidth parameters and background traffic load, the end-to-end latency distribution of any two nodes in the subgraph conforms to the preset statistical characteristics. For each protocol vulnerability, the attack vector automatically selects a matching attack tool according to its vulnerability type. At the same time, key parameters are extracted from the collected device configuration information. After the attack payload is sent to the target device, deep packet inspection is performed. The system captures response traffic and matches it against expected response patterns defined in the vulnerability set. If a match is successful, a risk level assessment process is triggered, a comprehensive scoring rule is constructed, and a weighted sum is performed based on the vulnerability trigger probability, latency weight, and risk propagation probability output by the model. A risk level threshold is set, and the risk level is determined based on the comprehensive score, including low, medium, and high risk levels, and the risk information is recorded. If a match fails, the entire process of this attack attempt is recorded, including the attack time, the attack tools and parameters used, and the actual response of the target device. The number of successful matches and the total number of attempts are counted to obtain the vulnerability trigger success rate.

6. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 1, characterized in that: Step S400 includes: Step S401: Based on the test target priority list, multi-dimensional feature device set, and protocol vulnerability set, and combined with the test scenario, generate test cases. For high-priority paths in the penetration test target list, prioritize the selection of associated device features and corresponding protocol vulnerabilities to design test cases, set attack vectors, and simulate the data packets sent by the attacker to the device using the vulnerability. Simultaneously, in conjunction with the test scenario, repeatedly test under different latency thresholds to monitor whether the vulnerability triggering success rate is affected. Under simulated latency conditions, execute the generated test cases one by one, monitor the target device's response and vulnerability exploitation success rate, capture device response traffic in real time using deep packet inspection technology, compare with the expected response pattern, and determine whether the vulnerability has been successfully exploited. At the same time, dynamically adjust latency parameters to gradually change the network latency environment, taking values ​​multiple times from low to high latency ranges, and record the changes in vulnerability triggering success rate under different latency conditions. Step S402: After the test is completed, a test report containing latency thresholds is generated. The report includes: the execution status of all test cases, including the target device, the attack vector used, the latency conditions of the test scenario, whether the vulnerability was successfully triggered, the comprehensive risk score, and the determined risk level. Together with the above test results, they constitute a complete test report.

7. The method for collaborative penetration testing of medical networks based on artificial intelligence according to claim 1, characterized in that: Step S500 involves real-time monitoring and recording of changes in vulnerability trigger success rate and latency parameters, collecting historical data on vulnerability trigger success rate and latency parameters, and calculating the mean and standard deviation. The thresholds for vulnerability trigger success rate and latency parameters are set as the mean plus a set multiple of the standard deviation. When a change value is detected to exceed the warning threshold in real time, the medical data center traces back from the abnormal end node to locate the specific risk location and related network links and device nodes, and issues a risk warning notification.

8. A medical network collaborative penetration testing system based on artificial intelligence, characterized in that: The system includes a medical network data hub construction module, an attack path analysis module, a composite attack scenario generation module, a penetration test execution module, and an adaptive risk warning module. The medical network data hub construction module integrates the network topology information, device attributes, and vulnerability databases of the hospital intranet, medical equipment, and cloud data center, and combines historical network latency data between various network nodes to construct the medical network data hub. The attack path analysis module uses graph neural networks to analyze the correlation characteristics between network vulnerability data and network latency in the medical network data center, constructs an attack path analysis model that includes latency weights, and generates a test target priority list based on the output of the model by quantifying the path risk score. The composite attack scenario generation module constructs a multi-dimensional feature device set based on the medical network data hub, combines historical latency data and network topology features, defines a set of protocol vulnerabilities and determines the latency threshold of each network link; designs test scenarios covering different latency conditions, generates attack vectors for each scenario and automatically matches attack tools for simulation testing; compares the simulated attack test results with the expected response results, calculates the vulnerability trigger success rate, and evaluates the vulnerability risk level in combination with historical attack data; The penetration test execution module generates penetration test cases based on the test target priority list and vulnerability risk level, as well as the target device characteristics, protocol vulnerabilities, and latency conditions. It executes multiple rounds of attack tests under different latency thresholds and generates a test report based on the test results. The adaptive risk warning module dynamically adjusts the latency parameter, monitors and records the changes in vulnerability trigger success rate and latency parameter changes in real time, sets a dynamic warning threshold, and when the real-time monitoring shows that the change value exceeds the warning threshold, it uses the reverse node to locate the risk location and related network links and device nodes to send a risk warning notification.

Images