Web automatic penetration testing method and device, electronic equipment and storage medium

Abstract

The invention provides a Web automatic penetration test method and device, electronic equipment and a storage medium, and belongs to the technical field of website vulnerability tests.The method comprises the steps that a web crawler collects target Web information to form a basic set; detecting vulnerability acquisition information; matching the adaptive script, and generating an intelligent load to verify vulnerability availability; constructing a knowledge graph to determine vulnerability association, and evaluating success rate and risk; planning an optimal attack route by using reinforcement learning, and determining attack depth and range, namely attack path risk features; and evaluating the risk by the dynamic scoring model, and generating a visual report containing detailed information, results and repair and improvement suggestions. According to the automatic penetration testing method, manual intervention is reduced in the whole process, dependence on professional experience is reduced, efficiency is improved, and the problems that traditional testing is tedious and low in efficiency are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of website vulnerability testing, and in particular relates to a Web automatic penetration testing method and device, an electronic device and a storage medium. Background Art

[0002] Web applications have become deeply integrated into everyday life and production, making the security of user data, business logic, and system resources they carry paramount. However, with the evolution of web technologies and the increasing complexity of businesses, vulnerabilities are becoming more diverse and hidden. Common vulnerabilities such as SQL injection, XSS, and permission bypass, as well as new supply chain vulnerabilities, continue to threaten system security. Once maliciously exploited, they can lead to data leaks, service interruptions, or even system compromise, resulting in severe economic losses and a crisis of trust.

[0003] Penetration testing, a key method for discovering security risks in web applications, simulates attacker behavior to uncover vulnerabilities and assess risks. However, traditional penetration testing has significant limitations: First, it relies heavily on manual experience, requiring testers to possess solid security knowledge and practical skills. This results in test quality being significantly affected by individual differences in ability, and it is difficult to cover all potential vulnerabilities in complex business scenarios. Second, the level of automation is low. Most tools can only detect a single vulnerability, lacking in-depth analysis of vulnerability relationships and unable to simulate the combined exploitation of multiple vulnerabilities in real attacks, resulting in high rates of missed and false positives. Third, the testing process is static, making it difficult to dynamically adapt to real-time state changes in the target system, such as defense strategy updates and business process adjustments. This results in a lack of flexibility in attack route planning and a deviation between risk assessment results and the actual threat. Fourth, the risk assessment dimension is single-dimensional, focusing primarily on the severity of the vulnerability itself, ignoring its position in the business process and the chain reaction with other vulnerabilities, making it difficult to quantify the actual threat posed by the vulnerability to the core business. Summary of the Invention

[0004] To solve the above problems, the present invention provides a Web automatic penetration testing method and device, electronic equipment and storage medium, so as to achieve a high degree of automation, deeply mine vulnerability correlations, dynamically plan attack routes and comprehensively assess risks.

[0005] The technical solution adopted in the present invention is as follows:

[0006] A web automatic penetration testing method includes the following steps:

[0007] Step 1: Collect information about the target web using a web crawler to form a basic information set;

[0008] Step 1 specifically configures web crawler parameters, adopts a hybrid strategy to traverse the site and filter links to focus on valid resources, parses pages to collect domain names, IP addresses, ports, directory structures, application fingerprints, and interactive element information, and combines search engines to supplement public content to form a structured basic information set.

[0009] Step 2: Perform vulnerability detection on the basic information set in step 1 to obtain vulnerability information in the target web application;

[0010] The vulnerability information includes: vulnerability type, location and feature information;

[0011] Step 3: From the preset vulnerability exploit library, match the script that matches the vulnerability information in step 2;

[0012] Call the basic payload template, which is dynamically adjusted by the mutation algorithm and the target Web application features identified in step 2 to generate an intelligent payload;

[0013] According to the business process sequence of the target web application, the adapted script carries the intelligent payload and sends it to the vulnerability locations of the target web in sequence. The exploitability of each vulnerability is verified, and the single exploitation results and the exploitation sequence relationship between different vulnerabilities are recorded.

[0014] Step 4: Build business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluate the success rate of each vulnerability exploitation and the potential risk to the target system, and output the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability;

[0015] The step 4 specifically includes:

[0016] Step 4.1: Based on the vulnerability set identified in Step 2 and the vulnerability exploitation sequence verified in Step 3, combined with the business process logic of the target web application, a knowledge graph G = (V, E) is constructed, with each vulnerability as a vulnerability node V and the dependency relationships formed by the vulnerability's preconditions and post-effects in the business process as edges E.

[0017] Step 4.2: Analyze the historical data of vulnerability joint exploitation and the business association features in the knowledge graph through the association rule mining algorithm to generate the dependency weight W ij , where W ij The probability that vulnerability j can be exploited after vulnerability i is successfully exploited is in the range of 0-1. The weight is calculated for the vulnerability pair (i, j) with edge E in the knowledge graph to quantify the degree of association.

[0018] Step 4.3: Based on the dependency weight W ij Combined with the vulnerability exploitability verification results in step 3, the success rate of exploitation of each vulnerability is comprehensively evaluated;

[0019] Step 4.4: Based on the importance level of the business module to which the vulnerability node V in the knowledge graph belongs, evaluate the potential risk of a single vulnerability to the target system after being exploited, and clarify the scope of the chain risk through the dependency relationship between the vulnerabilities.

[0020] The step 4.4 specifically includes:

[0021] Step 4.41: Classify the business modules to which the vulnerabilities belong into three levels: core, important, and general. Assign business module importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4, respectively, and bind them to the vulnerability nodes in the knowledge graph.

[0022] Vulnerabilities are scored based on the CVSS standard, with a score range of 0-10, which is converted into a vulnerability severity coefficient of 0-1;

[0023] The potential risk value of a single vulnerability = severity coefficient × weight of the module to which it belongs;

[0024] Step 4.42: Starting from the target vulnerability, based on the knowledge graph dependency and W ij , filter W ij A direct related vulnerability with a probability of ≥0.6 and an indirect related vulnerability with a cumulative related probability of ≥0.3 form a dependency chain, where the cumulative related probability refers to the total number of W on the path from the starting vulnerability to the indirect vulnerability. ij The product of

[0025] Extract all business modules to which the vulnerabilities belong in the dependency chain, remove duplicates, and use them as the scope of chain risk impact;

[0026] Chain risk degree = initial vulnerability risk value + sum of downstream vulnerability risk value and corresponding path weight multiplied by the product.

[0027] Step 5: Combining the vulnerability detection results from step 2, the vulnerability exploitation status from step 3, and the business dependencies from step 4, a reinforcement learning algorithm is used to plan the optimal attack path for the identified vulnerabilities in the target web application. The attack strategy is then dynamically adjusted based on the real-time status of the target system to ultimately determine the depth and scope of the attack.

[0028] The attack depth and scope are the risk characteristics of the attack path;

[0029] The step 5 specifically includes the following steps:

[0030] Step 5.1: Combine the vulnerability detection results of step 2, the vulnerability exploitation of step 3, and the knowledge graph constructed in step 4 with the dependency weight W ij, construct the state space S and action space A of reinforcement learning, where the state space S contains the set of currently exploited vulnerabilities, the associated states of unexploited vulnerabilities and the business links they are in, and the action space A is the exploitation operation of unexploited vulnerabilities;

[0031] Step 5.2: Design the reward function , where Psuccess is the vulnerability exploitation success rate and dependency weight W evaluated based on step 4 ij The expected success rate of the calculation, Rrisk is the potential risk value based on the evaluation in step 4, α and β are weight coefficients whose initial values ​​are determined by the vulnerability correlation strength and business risk level in step 4;

[0032] Step 5.3: Iteratively update the action value function Q(S, A) through the Q-learning algorithm, and select the action sequence with the largest cumulative reward and that meets the knowledge graph dependency constraints as the initial optimal attack route;

[0033] Step 5.4: Based on the real-time status of the target system, including defense strategy updates and traffic fluctuations, dynamically modify the weight coefficients α and β of the reward function and re-optimize the attack route;

[0034] Step 5.5: Based on the optimized attack route, define the attack depth D = max{d1, d2...d k}, and determine the attack scope based on the business modules covered by the high-weight dependency and the modules actually involved in the route, where d k is the penetration level of the kth path.

[0035] Step 6: Use a dynamic scoring model and combine the vulnerability severity coefficient, business module importance weight, and attack path risk characteristics to conduct a risk assessment, and generate a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0036] The step 6 specifically includes the following steps:

[0037] Step 6.1: Collect the vulnerability information from step 2, the business module importance weights and the correlation impact data between vulnerabilities from step 4, and the attack path and scope data from step 5, and summarize them to form a basic data set for risk assessment;

[0038] Step 6.2: Standardize the vulnerability severity coefficient to match the numerical range of the business module importance weight and attack path risk characteristics;

[0039] Step 6.3: Based on the business module level and attack threat level, assign impact factors to the business module importance weight and attack path risk characteristics;

[0040] Step 6.4: Calculate the standardized vulnerability severity coefficient, the importance weight of the business module carrying the impact factor, and the attack path risk characteristics using a weighted summation algorithm to obtain a comprehensive risk score for each vulnerability and convert it into a point system.

[0041] Step 6.5: Based on the comprehensive risk score of each vulnerability obtained in Step 6.4, combined with the correlation impact data between vulnerabilities in Step 4, the risk scores of each vulnerability are weighted and integrated according to the correlation relationship through an algorithm to calculate the comprehensive risk score of the entire system;

[0042] Step 6.6: Based on the overall system comprehensive risk score obtained in Step 6.5 and the comprehensive risk score of each vulnerability obtained in Step 6.4, determine the risk level of each vulnerability and analyze the degree of chain risk and system-level threats.

[0043] Step 6.7: Based on the assessment results, propose targeted repair suggestions and system security improvement measures and integrate them into a visual report.

[0044] A Web automatic penetration testing system, comprising:

[0045] Information collection module: collects information about the target web based on web crawlers to form a basic information set;

[0046] Vulnerability detection module: performs vulnerability detection on the basic information set in the information collection module to obtain the vulnerability type, location and characteristic information in the target Web application;

[0047] Vulnerability Exploitation Module: This module matches a script from a pre-set vulnerability exploitation library with the vulnerability information in the vulnerability detection module. It then calls a basic payload template, which is dynamically adjusted using a mutation algorithm and combined with the target web application features identified in the vulnerability detection module to generate an intelligent payload. The intelligent payload is then sent to each vulnerability location on the target web application, sequentially, using the adapted script and carrying the intelligent payload, in the order of the target web application's business processes. The module verifies the exploitability of each vulnerability and records the results of each exploit and the order in which different vulnerabilities are exploited.

[0048] Risk Assessment and Correlation Analysis Module: This module builds business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluates the success rate of exploiting each vulnerability and the potential risk to the target system, and outputs the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability.

[0049] Attack route planning module: This module combines vulnerability detection results, vulnerability exploitation, and business dependencies to plan the optimal attack route for identified vulnerabilities in target web applications through a reinforcement learning algorithm. It then dynamically adjusts the attack strategy based on the real-time status of the target system to ultimately determine the depth and scope of the attack.

[0050] Comprehensive risk assessment and report generation module: uses a dynamic scoring model and combines vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct risk assessments, generating a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0051] An electronic device includes a processor and a memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the steps of a Web automatic penetration testing method.

[0052] A computer storage medium stores computer program instructions, which, when executed by a processor, enable the processor to perform steps of a Web automatic penetration testing method.

[0053] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0054] 1. This invention uses a web crawler to automatically collect target web information and form a structured basic information set. It then automatically matches adaptation scripts with a pre-set vulnerability exploit library, and dynamically generates intelligent payloads using a mutation algorithm, minimizing manual intervention throughout the entire process. This not only reduces over-reliance on the tester's professional experience but also significantly improves testing efficiency, enabling comprehensive scanning and detection of complex web applications in a short period of time. This addresses the cumbersome and inefficient manual operations inherent in traditional penetration testing.

[0055] 2. This invention constructs business dependencies between vulnerabilities based on a knowledge graph, generates dependency weights through an association rule mining algorithm, and accurately quantifies the probability of joint exploitation of vulnerabilities. Simultaneously, starting with the vulnerability, it screens highly correlated direct and indirect vulnerabilities to form a dependency chain, clearly defining the impact of the chain risk and calculating the degree of chain risk. This technical solution breaks through the limitation of traditional testing that focuses only on a single vulnerability, and can fully grasp the impact of the associations between vulnerabilities, providing a more comprehensive basis for subsequent risk assessment and attack route planning.

[0056] 3. This invention incorporates a reinforcement learning algorithm, integrating vulnerability detection results, exploitation status, and knowledge graph dependency weights into the state and action spaces. The initial optimal attack path is determined by iteratively updating the action-value function. Simultaneously, the reward function weight coefficients are dynamically modified based on the real-time state of the target system, continuously optimizing the attack path and ensuring that the attack strategy is compatible with the system state. This improves the success rate of vulnerability exploitation and makes the attack path more tailored to actual attack scenarios.

[0057] 4. This invention utilizes a dynamic scoring model to conduct risk assessments, integrating vulnerability severity coefficients, business module importance weights, and attack path risk characteristics. This model not only calculates a comprehensive risk score for each vulnerability but also integrates these relationships to derive a comprehensive risk score for the entire system, clarifying the risk level of individual vulnerabilities, the degree of cascading risks, and system-level threats. Compared to traditional, single-dimensional risk assessments, this system more accurately reflects the actual security status of web applications, providing precise guidance for security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The present invention will now be described by way of example with reference to the accompanying drawings, in which:

[0059] Figure 1 This is a flow chart of a Web automatic penetration testing method in Example 1 of the present invention;

[0060] Figure 2 This is a flowchart of step 4 of a Web automatic penetration testing method in Example 1 of the present invention;

[0061] Figure 3 This is a flowchart of step 5 of a Web automatic penetration testing method in Example 1 of the present invention. DETAILED DESCRIPTION

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0063] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are also within the scope of protection of the present invention.

[0064] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other.

[0065] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0066] In the present invention, unless otherwise expressly specified or limited, a first feature being "above" or "below" a second feature may include the first and second features being in direct contact, or may include the first and second features being in contact not directly but through another feature between them. Furthermore, a first feature being "above," "above," and "above" a second feature may include the first feature being directly above or obliquely above the second feature, or may simply mean that the first feature is higher in level than the second feature. A first feature being "below," "below," and "below" a second feature may include the first feature being directly below or obliquely below the second feature, or may simply mean that the first feature is lower in level than the second feature.

[0067] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments of the present invention can be combined with each other.

[0068] Example 1

[0069] like Figure 1-Figure 3 As shown, an embodiment of the present invention discloses a Web automatic penetration testing method, including:

[0070] Step 1: Collect information about the target web using a web crawler to form a basic information set;

[0071] Step 1 specifically configures web crawler parameters, adopts a hybrid strategy to traverse the site and filter links to focus on valid resources, parses pages to collect domain names, IP addresses, ports, directory structures, application fingerprints, and interactive element information, and combines search engines to supplement public content to form a structured basic information set.

[0072] Step 2: Perform vulnerability detection on the basic information set in step 1 to obtain vulnerability information in the target web application;

[0073] The vulnerability information includes: vulnerability type, location and feature information;

[0074] It should be understood that step 2 is specifically based on the structured basic information set formed in step 1, which includes information such as domain name, IP, port, directory structure, application fingerprint and interactive elements. It uses multiple vulnerability detection technologies (such as static code analysis, dynamic behavior monitoring, fuzz testing, etc.) to conduct a comprehensive scan of the target Web application, formulate differentiated detection strategies for different application fingerprints and directory structures, and focus on detecting common types of vulnerabilities such as SQL injection, XSS, command injection, permission bypass, and file upload. By analyzing the response data of page interactive elements to identify potential anomalies, the specific location of each vulnerability in the Web application (such as specific URL, parameters, page components, etc.) is accurately located, and the characteristic information of the vulnerability (such as triggering conditions, scope of impact, utilization method, etc.) is recorded. Finally, a complete vulnerability information set containing vulnerability type, location and characteristic information is summarized.

[0075] Step 3: From the preset vulnerability exploit library, match the script that matches the vulnerability information in step 2;

[0076] Call the basic payload template, which is dynamically adjusted by the mutation algorithm and the target Web application features identified in step 2 to generate an intelligent payload;

[0077] According to the business process sequence of the target web application, the adapted script carries the intelligent payload and sends it to the vulnerability locations of the target web in sequence. The exploitability of each vulnerability is verified, and the single exploitation results and the exploitation sequence relationship between different vulnerabilities are recorded.

[0078] It should be understood that step 3 specifically involves first selecting scripts that match the vulnerability information from a preset vulnerability exploit library using a feature matching algorithm based on the vulnerability type, location, and feature information obtained in step 2, ensuring that the script's attack logic is highly consistent with the vulnerability features. Next, the system's built-in basic payload template is called, and combined with the target web application features identified in step 2 (such as application type, version number, protection mechanism, etc.), the basic payload template is dynamically adjusted using a mutation algorithm to generate a targeted intelligent payload to circumvent the target system's basic defense strategy. Subsequently, according to the business process sequence of the target web application (such as the logical sequence of user login, data submission, permission change, etc.), the adapted script is associated and bound to the intelligent payload, and script requests carrying the intelligent payload are sequentially sent to the specific locations of each vulnerability (such as specific URLs, parameter interfaces, etc.). During the sending process, the target system's response status is monitored in real time to verify the likelihood of successful exploitation of each vulnerability, record the results of each exploit (including successful exploitation, exploitation failure, and reasons for failure, etc.), and track the sequential relationship between different vulnerabilities during the exploitation process (such as the need for a vulnerability to be successfully triggered after another vulnerability is exploited), ultimately forming a complete vulnerability exploitation verification record.

[0079] Step 4: Build business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluate the success rate of each vulnerability exploitation and the potential risk to the target system, and output the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability;

[0080] like Figure 2 As shown, the step 4 specifically includes:

[0081] Step 4.1: Based on the vulnerability set identified in Step 2 and the vulnerability exploitation sequence verified in Step 3, combined with the business process logic of the target web application, a knowledge graph G = (V, E) is constructed, with each vulnerability as a vulnerability node V and the dependency relationships formed by the vulnerability's preconditions and post-effects in the business process as edges E.

[0082] It should be understood that step 4.1 is based on the vulnerability set identified in step 2 (including the type, location, and feature information of each vulnerability) and the vulnerability exploitation sequence verified in step 3 (the recorded triggering relationship between different vulnerabilities). It is deeply integrated with the business process logic of the target web application (such as the flow rules of user registration → login → data query → order submission, etc.) to define each independent vulnerability as a vulnerability node V in the knowledge graph. Each node is associated with its corresponding vulnerability type, location, features, and business link attributes. At the same time, the preconditions (such as a vulnerability may only appear after the user completes the login operation) and post-effects (such as the failure of the permission verification mechanism after the exploitation of a vulnerability) of each vulnerability in the business link are analyzed. The dependency relationship formed by the business logic association is abstracted as an edge E connecting the corresponding vulnerability nodes. Finally, a knowledge graph G = (V, E) with the vulnerability node V and the dependency edge E as the core is constructed, which intuitively presents the distribution and interaction relationship of vulnerabilities in the business process.

[0083] Step 4.2: Analyze the historical data of vulnerability joint exploitation and the business association features in the knowledge graph through the association rule mining algorithm to generate the dependency weight W ij , where W ij The probability that vulnerability j can be exploited after vulnerability i is successfully exploited is in the range of 0-1. The weight is calculated for the vulnerability pair (i, j) with edge E in the knowledge graph to quantify the degree of association.

[0084] It should be understood that step 4.2 is specifically based on the knowledge graph G = (V, E) constructed in step 4.1, and the vulnerability pair (i, j) with edge E is selected as the analysis object. The historical data of joint exploitation of vulnerabilities, including the collaborative exploitation records of vulnerabilities i and j in historical penetration tests, the successful trigger frequency, etc., and the business association characteristics of the two in the knowledge graph, such as the correlation of the business links to which they belong, the matching degree of preconditions and post-effects, etc., are deeply analyzed through association rule mining algorithms such as the Apriori algorithm; the algorithm calculates the support degree, i.e., the probability of vulnerabilities i and j being exploited at the same time, the confidence degree, i.e., the conditional probability of vulnerability j being exploited after vulnerability i is successfully exploited, and other indicators, and maps them to dependency weights W with a value range between 0 and 1. ij , in order to quantify the probability that vulnerability j can be exploited subsequently after vulnerability i is successfully exploited. The higher the value, the stronger the correlation between the two, thus providing a quantitative basis for the subsequent assessment of vulnerability chain risks and planning attack routes.

[0085] Step 4.3: Based on the dependency weight W ij Combined with the vulnerability exploitability verification results in step 3, the success rate of exploitation of each vulnerability is comprehensively evaluated;

[0086] It should be understood that step 4.3 specifically converts the dependency weight W generated in step 4.2 into ij Combined with the results of the vulnerability exploitability verification in step 3, a comprehensive evaluation of the exploitation success rate of each vulnerability is performed. First, the success or failure results of each vulnerability exploitation recorded in step 3 are extracted to calculate its basic success rate; then, based on the correlation between vulnerabilities in the knowledge graph, the dependency weight W of the corresponding vulnerability pair is introduced. ij , analyze the impact of other related vulnerabilities being exploited on the success rate of current vulnerability exploitation - if the related vulnerability has been successfully exploited and W ij If the value is high, the success rate of the current vulnerability will increase accordingly. Otherwise, the basic success rate may remain the same or slightly decrease. By integrating the basic success rate and related influencing factors through weighted calculation, the actual exploitation success rate of each vulnerability is finally obtained after comprehensively considering its own exploitability and the impact of related vulnerabilities, providing key data support for subsequent attack route planning.

[0087] Step 4.4: Based on the importance level of the business module to which the vulnerability node V in the knowledge graph belongs, evaluate the potential risk of a single vulnerability to the target system after being exploited, and clarify the scope of the chain risk through the dependency relationship between the vulnerabilities.

[0088] It should be understood that step 4.4 specifically involves assessing the potential risk to the target system if a single vulnerability is exploited, based on the importance level of the business module to which the vulnerability node V belongs in the knowledge graph. By clarifying the core degree of each business module in the target system and determining its corresponding importance level, and then combining this level with the degree of harm of the vulnerability itself, the potential risk value that may be caused by the exploitation of a single vulnerability is quantified. At the same time, based on the dependencies between vulnerabilities in the knowledge graph, other vulnerabilities that are directly or indirectly related to the vulnerability are tracked, and how these dependencies will trigger a chain reaction after the vulnerability is exploited, and then clarifying the scope of business modules and systems affected by the chain risk, providing a basis for fully understanding the overall threat that the vulnerability may bring.

[0089] The step 4.4 specifically includes:

[0090] Step 4.41: Classify the business modules to which the vulnerabilities belong into three levels: core, important, and general. Assign business module importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4, respectively, and bind them to the vulnerability nodes in the knowledge graph.

[0091] Vulnerabilities are scored based on the CVSS standard, with a score range of 0-10, which is converted into a vulnerability severity coefficient of 0-1;

[0092] The potential risk value of a single vulnerability = severity coefficient × weight of the module to which it belongs;

[0093] Step 4.42: Starting from the target vulnerability, based on the knowledge graph dependency and W ij , filter W ij A direct related vulnerability with a probability of ≥0.6 and an indirect related vulnerability with a cumulative related probability of ≥0.3 form a dependency chain, where the cumulative related probability refers to the total number of W on the path from the starting vulnerability to the indirect vulnerability. ij The product of

[0094] Extract all business modules to which the vulnerabilities belong in the dependency chain, remove duplicates, and use them as the scope of chain risk impact;

[0095] Chain risk degree = initial vulnerability risk value + sum of downstream vulnerability risk value and corresponding path weight multiplied by the product.

[0096] Step 5: Combining the vulnerability detection results from step 2, the vulnerability exploitation status from step 3, and the business dependencies from step 4, a reinforcement learning algorithm is used to plan the optimal attack path for the identified vulnerabilities in the target web application. The attack strategy is then dynamically adjusted based on the real-time status of the target system to ultimately determine the depth and scope of the attack.

[0097] The attack depth and scope are the risk characteristics of the attack path;

[0098] It should be understood that step 5 specifically integrates the vulnerability detection results from step 2, the vulnerability exploitation results from step 3, and the business dependencies from step 4, building a reinforcement learning environment model based on these. The algorithm uses the identified vulnerability information, exploitation success records, and the dependencies between vulnerabilities as input, setting a learning task aimed at maximizing attack effectiveness. The reinforcement learning algorithm simulates the exploitation sequence and combination of different vulnerabilities. During training, the strategy is continuously adjusted based on the results of each simulated attack (such as the exploitation success rate and the degree of impact on the system), gradually planning the optimal attack path for the identified vulnerabilities in the target web application. Simultaneously, the real-time status of the target system is continuously monitored, including updates to system defense policies, fluctuations in network traffic, and temporary adjustments to business processes. When these conditions change, the attack strategy is dynamically revised and the exploitation value and priority of each vulnerability are reassessed. Ultimately, based on the optimized attack path, the attack depth is determined in conjunction with the hierarchical relationship of the vulnerabilities in the business process, and the attack scope is determined based on the scope of the business modules involved, forming an attack path risk profile tailored to the actual conditions of the target system.

[0099] like Figure 3 As shown, the step 5 specifically includes the following steps:

[0100] Step 5.1: Combine the vulnerability detection results of step 2, the vulnerability exploitation of step 3, and the knowledge graph constructed in step 4 with the dependency weight W ij, construct the state space S and action space A of reinforcement learning, where the state space S contains the set of currently exploited vulnerabilities, the associated states of unexploited vulnerabilities and the business links they are in, and the action space A is the exploitation operation of unexploited vulnerabilities;

[0101] It should be understood that step 5.1 specifically combines the vulnerability detection results obtained in step 2, including vulnerability type, location and feature information, the vulnerability exploitation recorded in step 3, including exploitability verification results, exploitation order relationship, etc., and the knowledge graph constructed in step 4, including vulnerability nodes, dependency edges and dependency weights W. ij , construct the state space S and action space A of reinforcement learning. Among them, the state space S is formed by integrating multi-dimensional information, specifically including the set of currently successfully exploited vulnerabilities, the set of unexploited vulnerabilities based on the knowledge graph and the dependency weight W ij The presented association states include dependencies with exploited vulnerabilities, potential possibilities of being triggered, and the business links where the current attack operations are located, such as user authentication and data interaction, to fully reflect the dynamic scenarios during the attack process. The action space A is defined as the exploitation operations that can be performed on all unexploited vulnerabilities, that is, for each unexploited vulnerability, you can choose to try to exploit the specific behavior of the vulnerability, providing clear decision options for the reinforcement learning algorithm.

[0102] Step 5.2: Design the reward function , where Psuccess is the vulnerability exploitation success rate and dependency weight W evaluated based on step 4 ij The expected success rate of the calculation, Rrisk is the potential risk value based on the evaluation in step 4, α and β are weight coefficients whose initial values ​​are determined by the vulnerability correlation strength and business risk level in step 4;

[0103] It should be understood that α and β are weight coefficients. By adjusting the ratio of the two to balance the attack effect and potential risk, the reward function can accurately measure the value of different attack actions and provide a quantitative basis for the decision-making of the reinforcement learning algorithm.

[0104] Step 5.3: Iteratively update the action value function Q(S, A) through the Q-learning algorithm, and select the action sequence with the largest cumulative reward and that meets the knowledge graph dependency constraints as the initial optimal attack route;

[0105] Step 5.4: Based on the real-time status of the target system, including defense strategy updates and traffic fluctuations, dynamically modify the weight coefficients α and β of the reward function and re-optimize the attack route;

[0106] Step 5.5: Based on the optimized attack route, define the attack depth D = max{d1, d2...d k}, and determine the attack scope based on the business modules covered by the high-weight dependency and the modules actually involved in the route, where d k is the penetration level of the kth path.

[0107] Step 6: Use a dynamic scoring model and combine the vulnerability severity coefficient, business module importance weight, and attack path risk characteristics to conduct a risk assessment, and generate a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0108] The step 6 specifically includes the following steps:

[0109] Step 6.1: Collect the vulnerability information from step 2, the business module importance weights and the correlation impact data between vulnerabilities from step 4, and the attack path and scope data from step 5, and summarize them to form a basic data set for risk assessment;

[0110] Step 6.2: Standardize the vulnerability severity coefficient to match the numerical range of the business module importance weight and attack path risk characteristics;

[0111] Step 6.2 specifically includes:

[0112] Assuming that the numerical ranges of the business module importance weight and the attack path risk characteristics are both [0, 1], the standardized target range of the vulnerability severity coefficient is also set to [0, 1].

[0113] Assume that the original value of the vulnerability severity coefficient after conversion in step 4.41 is C, and its original value range is [0, 1] (converted from the CVSS score of 0-10).

[0114] Use the min-max normalization formula for processing:

[0115] The standardized vulnerability severity coefficient is shown in the following formula:

[0116] C'=(C-C_min) / (C_max-C_min)

[0117] Among them, C_min is the minimum value of all vulnerability severity coefficients (usually 0), and C_max is the maximum value of all vulnerability severity coefficients (usually 1).

[0118] Calculate whether the standardized C' falls within the interval [0, 1]. If there are outliers outside the range, truncate them to 0 or 1 (i.e., when C' < 0, the value is 0, and when C' > 1, the value is 1). This ensures that it fully matches the numerical range of the business module importance weight and attack path risk characteristics, providing basic data with a unified dimension for subsequent weighted summation calculations.

[0119] Step 6.3: Based on the business module level and attack threat level, assign impact factors to the business module importance weight and attack path risk characteristics; specifically, including:

[0120] Step 6.31: Determine the impact factor corresponding to the business module level:

[0121] Core business module (Level 1): corresponds to an impact factor k1=0.8-1.0. Because it is directly related to the core functions of the system, its weight impact needs to be given special consideration;

[0122] Important business module (level 2): ​​corresponds to an impact factor k2=0.5-0.7, reflecting its key support role in the overall operation of the system;

[0123] General business module (level 3): The corresponding impact factor k3=0.1-0.4, reflecting its auxiliary position in the system.

[0124] The above factors are bound to the business module importance weights in step 4.41 to form the weighted module risk parameters.

[0125] Step 6.32: Determine the impact factor corresponding to the attack threat level:

[0126] High-threat attack path (Level A): corresponds to an impact factor m1=0.8-1.0, suitable for paths with a large attack depth and covering core modules;

[0127] Medium threat attack path (level B): corresponds to an impact factor m2 = 0.5-0.7, suitable for paths with limited attack range but involving important links;

[0128] Low-threat attack paths (Level C): Corresponding to an impact factor m3 of 0.1-0.4, these paths apply only to edge modules. This factor is associated with the attack path risk characteristics determined in Step 5 to quantify the threat weights of different paths. By mapping levels to factors, the importance weights of business modules and the risk characteristics of attack paths are factored into the calculations based on their actual impact in the subsequent comprehensive assessment, ensuring accurate risk scoring.

[0129] Step 6.4: Calculate the standardized vulnerability severity coefficient, the importance weight of the business module carrying the impact factor, and the attack path risk characteristics using a weighted summation algorithm to obtain a comprehensive risk score for each vulnerability and convert it into a point system.

[0130] Specifically include:

[0131] First, clarify the parameters involved in the calculation: let the standardized vulnerability severity coefficient be C', the importance weight of the business module carrying the impact factor be f×W (where f is the impact factor corresponding to the business module level, and W is the importance weight of the business module), and the risk characteristic of the attack path carrying the impact factor be g×P (where g is the impact factor corresponding to the attack threat level, and P is the risk characteristic of the attack path).

[0132] Then, the weighted summation algorithm is used to calculate the comprehensive risk score, and the formula is:

[0133] S=x×C'+y×(f×W)+z×(g×P).

[0134] Among them, x, y, and z are the weight coefficients of each parameter, and x+y+z=1. They can be set according to the severity of the vulnerability itself, the importance of the business module, and the emphasis on the attack path risk in the actual scenario. For example, the default values ​​are x=0.4, y=0.3, and z=0.3.

[0135] Finally, convert the calculated S value to a point scale. If the value of S is in the range [0, 1], converting to a 10-point scale can be done using the formula: 10-point score = S × 10, rounding the result to one decimal place. Converting to a 100-point scale can be done using the formula: 100-point score = S × 100, rounding the result to an integer. This intuitively presents the comprehensive risk level of a single vulnerability.

[0136] Step 6.5: Based on the comprehensive risk score of each vulnerability obtained in Step 6.4, combined with the correlation impact data between vulnerabilities in Step 4, the risk scores of each vulnerability are weighted and integrated according to the correlation relationship through an algorithm to calculate the comprehensive risk score of the entire system; specifically, this includes:

[0137] Step 6.51: Construct vulnerability correlation matrix. ij As the core, form an n×n matrix M, where the matrix element M(i, j)=W ij , which represents the correlation impact strength of vulnerability i on vulnerability j. When i=j, M(i, i)=1 (its own weight).

[0138] Step 6.52: Calculate the correlation weighted score of each vulnerability. For each vulnerability i, its correlation weighted score T i =S i ×Σ(M(i, j)×S j ), that is, by taking the weighted sum of the correlation effects of the vulnerability and all other vulnerabilities, the cumulative effect of highly correlated vulnerabilities on the overall risk of the system is amplified.

[0139] Step 6.53: Integrate to obtain the system comprehensive risk score. Use the weighted average algorithm to summarize the associated weighted scores of all vulnerabilities. The formula is: Overall system comprehensive risk score T = Σ(T i ×h i ), where h i is the system impact ratio of vulnerability i (Σh i =1, which can be set based on the core level of the business module where the vulnerability is located). If you need to convert to a point system, refer to the point system conversion method in step 6.4 and map the T value to a 10-point or 100-point system to intuitively reflect the overall risk level of the system.

[0140] Step 6.6: Based on the overall system comprehensive risk score obtained in Step 6.5 and the comprehensive risk score of each vulnerability obtained in Step 6.4, determine the risk level of each vulnerability and analyze the degree of chain risk and system-level threats. Specifically, this includes:

[0141] Step 6.61: Determine the risk level of a single vulnerability. Compare the comprehensive risk score Sᵢ of a single vulnerability with the preset threshold. If a 10-point system is used, the level classification standard can be set: S i ≥8 points are "very high risk", 6≤S i <8 is scored as "high risk", 4≤S i <6 is classified as “medium risk”, 2≤S i <4 points are “low risk”, S i <2 points is “very low risk”; at the same time, the level boundaries are adjusted in combination with the overall system comprehensive risk score T. When T ≥ 8 points, the threshold of each level is lowered by 1 point (for example, “very high risk” is adjusted to S i ≥7 points) to reflect the chain amplification effect of a single vulnerability in a high-risk system state.

[0142] Step 6.62: Analyze the degree of chain risk. Based on the vulnerability correlation matrix M in step 4, for vulnerabilities i with a "high risk" or higher level, calculate their correlation impact range index L i =Σ(M(i, j)×I(S j ≥4)) (where I is the indicator function, when S j ≥4, I=1, otherwise I=0), L i The larger the value, the higher the possibility that the vulnerability will trigger a chain reaction of medium- and high-risk vulnerabilities; at the same time, the system diffusion of the chain risk is judged by combining the T value. When T ≥ 6 and there is L i When there are ≥3 vulnerabilities, it is judged as "serious chain risk".

[0143] Step 6.63: Evaluate system-level threats. Combined with the T value and the distribution characteristics of high-risk vulnerabilities, if T ≥ 8 points and the number of "very high risk" vulnerabilities is ≥ 3, it is determined that "the system faces a fatal threat"; if 6 ≤ T < 8 points and "high risk" and above vulnerabilities are concentrated in the core business module (h i If T score is ≥0.6), it is judged as "the core functions of the system are seriously threatened"; if T score is less than 6 and the high-risk vulnerabilities are scattered in non-core modules, it is judged as "partial functions of the system are threatened", thus comprehensively presenting the overall threat situation of the vulnerability to the system.

[0144] Step 6.7: Based on the assessment results, propose targeted repair suggestions and system security improvement measures and integrate them into a visual report.

[0145] Example 2

[0146] This embodiment provides a Web automatic penetration testing system, including:

[0147] Information collection module: collects information about the target web based on web crawlers to form a basic information set;

[0148] Vulnerability detection module: performs vulnerability detection on the basic information set in the information collection module to obtain the vulnerability type, location and characteristic information in the target Web application;

[0149] Vulnerability Exploitation Module: This module matches a script from a pre-set vulnerability exploitation library with the vulnerability information in the vulnerability detection module. It then calls a basic payload template, which is dynamically adjusted using a mutation algorithm and combined with the target web application features identified in the vulnerability detection module to generate an intelligent payload. The intelligent payload is then sent to each vulnerability location on the target web application, sequentially, using the adapted script and carrying the intelligent payload, in the order of the target web application's business processes. The module verifies the exploitability of each vulnerability and records the results of each exploit and the order in which different vulnerabilities are exploited.

[0150] Risk Assessment and Correlation Analysis Module: This module builds business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluates the success rate of exploiting each vulnerability and the potential risk to the target system, and outputs the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability.

[0151] Attack route planning module: This module combines vulnerability detection results, vulnerability exploitation, and business dependencies to plan the optimal attack route for identified vulnerabilities in target web applications through a reinforcement learning algorithm. It then dynamically adjusts the attack strategy based on the real-time status of the target system to ultimately determine the depth and scope of the attack.

[0152] Comprehensive risk assessment and report generation module: uses a dynamic scoring model and combines vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct risk assessments, generating a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0153] Example 3

[0154] This embodiment provides an electronic device, including a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, enable the processor to perform steps of a Web automatic penetration testing method.

[0155] Example 4

[0156] This embodiment provides a computer storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the processor is caused to execute steps of a Web automatic penetration testing method.

[0157] The circuits, electronic components and modules involved are all existing technologies and can be fully implemented by those skilled in the art. Needless to say, the content protected by the present invention does not involve improvements to software and methods.

[0158] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0159] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A Web automatic penetration testing method, characterized in that: The following steps are involved: Step 1: Collect information about the target web using a web crawler to form a basic information set; Step 2: Perform vulnerability detection on the basic information set in step 1 to obtain vulnerability information in the target web application; Step 3: From the preset vulnerability exploit library, match the script that matches the vulnerability information in step 2; Calling a basic payload template, which is dynamically adjusted by a mutation algorithm and in combination with the target Web application features identified in step 2, to generate an intelligent payload; According to the business process sequence of the target web application, the adapted script carries the intelligent payload and sends it to the vulnerability locations of the target web in sequence. The exploitability of each vulnerability is verified, and the single exploitation results and the exploitation sequence relationship between different vulnerabilities are recorded. Step 4: Build business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluate the success rate of each vulnerability exploitation and the potential risk to the target system, and output the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability; Step 5: Combining the vulnerability detection results from step 2, the vulnerability exploitation status from step 3, and the business dependencies from step 4, a reinforcement learning algorithm is used to plan the optimal attack path for the identified vulnerabilities in the target web application. The attack strategy is then dynamically adjusted based on the real-time status of the target system to ultimately determine the depth and scope of the attack. The attack depth and scope are the risk characteristics of the attack path; Step 6: Use a dynamic scoring model and combine the vulnerability severity coefficient, business module importance weight, and attack path risk characteristics to conduct a risk assessment, and generate a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

2. A Web automatic penetration testing method according to claim 1, characterized in that: Step 1 specifically configures web crawler parameters, adopts a hybrid strategy to traverse the site and filter links to focus on valid resources, parses pages to collect domain names, IP addresses, ports, directory structures, application fingerprints, and interactive element information, and combines search engines to supplement public content to form a structured basic information set.

3. A Web automatic penetration testing method according to claim 1, characterized in that: The vulnerability information includes: vulnerability type, location and feature information.

4. A Web automatic penetration testing method according to claim 1, characterized in that: The step 4 specifically includes: Step 4.1: Based on the vulnerability set identified in Step 2 and the vulnerability exploitation sequence verified in Step 3, combined with the business process logic of the target web application, a knowledge graph G = (V, E) is constructed, with each vulnerability as a vulnerability node V and the dependency relationships formed by the vulnerability's preconditions and post-effects in the business process as edges E. Step 4.2: Analyze the historical data of vulnerability joint exploitation and the business association features in the knowledge graph through the association rule mining algorithm to generate the dependency weight W ij , where W ij It represents the probability that vulnerability j will be exploited after vulnerability i is successfully exploited. The value range is 0-1, and the weight is calculated for the vulnerability pair (i, j) with edge E in the knowledge graph to quantify the degree of association. Step 4.3: Based on the dependency weight W ij Combined with the vulnerability exploitability verification results in step 3, the success rate of exploitation of each vulnerability is comprehensively evaluated; Step 4.4: Based on the importance level of the business module to which the vulnerability node V in the knowledge graph belongs, evaluate the potential risk of a single vulnerability to the target system after being exploited, and clarify the scope of the chain risk through the dependency relationship between the vulnerabilities.

5. A Web automatic penetration testing method according to claim 4, characterized in that: The step 4.4 specifically includes: Step 4.41: Classify the business modules to which the vulnerabilities belong into three levels: core, important, and general. Assign business module importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4, respectively, and bind them to the vulnerability nodes in the knowledge graph. Vulnerabilities are scored based on the CVSS standard, with a score range of 0-10, which is converted into a vulnerability severity coefficient of 0-1; The potential risk value of a single vulnerability = severity coefficient × weight of the module to which it belongs; Step 4.42: Starting from the target vulnerability, based on the knowledge graph dependency and W ij , filter W ij A direct related vulnerability with a probability of ≥0.6 and an indirect related vulnerability with a cumulative related probability of ≥0.3 form a dependency chain, where the cumulative related probability refers to the total number of W on the path from the starting vulnerability to the indirect vulnerability. ij The product of Extract all business modules to which the vulnerabilities belong in the dependency chain, remove duplicates, and use them as the scope of chain risk impact; Chain risk degree = initial vulnerability risk value + sum of downstream vulnerability risk value and corresponding path weight multiplied by the product.

6. A Web automatic penetration testing method according to claim 1, characterized in that: The step 5 specifically includes the following steps: Step 5.1: Combine the vulnerability detection results of step 2, the vulnerability exploitation of step 3, and the knowledge graph constructed in step 4 with the dependency weight W ij , construct the state space S and action space A of reinforcement learning, where the state space S contains the set of currently exploited vulnerabilities, the associated states of unexploited vulnerabilities and the business links they are in, and the action space A is the exploitation operation of unexploited vulnerabilities; Step 5.2: Design the reward function R=α Psuccess β Rrisk, where Psuccess is the vulnerability exploitation success rate evaluated in step 4 and the dependency weight W ij The expected success rate of the calculation, Rrisk is the potential risk value based on the evaluation in step 4, α and β are weight coefficients whose initial values ​​are determined by the vulnerability correlation strength and business risk level in step 4; Step 5.3: Iteratively update the action value function Q(S, A) through the Q-learning algorithm, and select the action sequence with the largest cumulative reward and that meets the knowledge graph dependency constraints as the initial optimal attack route; Step 5.4: Based on the real-time status of the target system, including defense strategy updates and traffic fluctuations, dynamically modify the weight coefficients α and β of the reward function and re-optimize the attack route; Step 5.5: Based on the optimized attack route, define the attack depth D = max{d1, d2...d k }, and determine the attack scope based on the business modules covered by the high-weight dependency and the modules actually involved in the route, where d k is the penetration level of the kth path.

7. A Web automatic penetration testing method according to claim 1, characterized in that: The step 6 specifically includes the following steps: Step 6.1: Collect the vulnerability information from step 2, the business module importance weights and the correlation impact data between vulnerabilities from step 4, and the attack path and scope data from step 5, and summarize them to form a basic data set for risk assessment; Step 6.2: Standardize the vulnerability severity coefficient to match the numerical range of the business module importance weight and attack path risk characteristics; Step 6.3: Based on the business module level and attack threat level, assign impact factors to the business module importance weight and attack path risk characteristics; Step 6.4: Calculate the standardized vulnerability severity coefficient, the importance weight of the business module carrying the impact factor, and the attack path risk characteristics using a weighted summation algorithm to obtain a comprehensive risk score for each vulnerability and convert it into a point system. Step 6.5: Based on the comprehensive risk score of each vulnerability obtained in Step 6.4, combined with the correlation impact data between vulnerabilities in Step 4, the risk scores of each vulnerability are weighted and integrated according to the correlation relationship through an algorithm to calculate the comprehensive risk score of the entire system; Step 6.6: Based on the overall system comprehensive risk score obtained in Step 6.5 and the comprehensive risk score of each vulnerability obtained in Step 6.4, determine the risk level of each vulnerability and analyze the degree of chain risk and system-level threats. Step 6.7: Based on the assessment results, propose targeted repair suggestions and system security improvement measures and integrate them into a visual report.

8. A Web automatic penetration testing system for implementing the Web automatic penetration testing method according to claim 1, characterized in that: include: Information collection module: collects information about the target web based on web crawlers to form a basic information set; Vulnerability detection module: performs vulnerability detection on the basic information set in the information collection module to obtain the vulnerability type, location and characteristic information in the target Web application; Vulnerability Exploitation Module: matches the scripts adapted to the vulnerability information in the vulnerability detection module from the preset vulnerability exploitation library; The basic payload template is called, and the basic payload template is dynamically adjusted through a mutation algorithm and combined with the target web application characteristics identified in the vulnerability detection module to generate an intelligent payload. According to the business process sequence of the target web application, the intelligent payload is sent to the vulnerability locations of the target web in sequence through an adapted script, verifying the exploitability of each vulnerability and recording the results of a single exploit and the exploitation order relationship between different vulnerabilities. Risk Assessment and Correlation Analysis Module: This module builds business dependencies based on the knowledge graph to clarify the impact of vulnerabilities, evaluates the success rate of exploiting each vulnerability and the potential risk to the target system, and outputs the vulnerability severity coefficient, business module importance weight, and the potential risk value of each vulnerability. Attack route planning module: This module combines vulnerability detection results, vulnerability exploitation, and business dependencies to plan the optimal attack route for identified vulnerabilities in target web applications through a reinforcement learning algorithm. It then dynamically adjusts the attack strategy based on the real-time status of the target system to ultimately determine the depth and scope of the attack. Comprehensive risk assessment and report generation module: uses a dynamic scoring model and combines vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct risk assessments, generating a visual report containing vulnerability details, risk assessment results, targeted remediation suggestions, and system security improvement measures.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor is caused to perform the steps of the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that The computer storage medium stores computer program instructions, which, when executed by a processor, enable the processor to perform the steps of the method according to any one of claims 1 to 7.

Images