Web automatic penetration testing method and device, electronic equipment and storage medium

Abstract

The application provides a web automatic penetration testing method and device, electronic equipment and storage medium, belongs to the technical field of website vulnerability testing, and comprises the following steps: collecting target web information by a web crawler to form a basic set; detecting a vulnerability to obtain information; matching an adaptive script to generate an intelligent payload to verify vulnerability exploitability; constructing a knowledge graph to clarify vulnerability correlation, evaluate success rate and risk; planning an optimal attack route by reinforcement learning, determining attack depth and range, that is, attack path risk characteristics; evaluating risk by a dynamic scoring model, and generating a visual report containing detailed information, results, repair and improvement suggestions. The automatic penetration testing method provided by the application reduces manual intervention throughout the process, reduces dependence on professional experience, improves efficiency, and solves the problems of traditional testing being complicated and inefficient.

Description

Technical Field

[0001] This invention belongs to the field of website vulnerability testing technology, specifically relating to a web automated penetration testing method and apparatus, electronic device and storage medium. Background Technology

[0002] Web applications have become deeply integrated into social production and daily life, making the security of user data, business logic, and system resources they carry crucial. However, with the iteration of web technologies and the increasing complexity of business operations, vulnerabilities are becoming more diverse and covert. Common vulnerabilities such as SQL injection, XSS, and privilege escalation, as well as emerging supply chain vulnerabilities, continue to threaten system security. Once maliciously exploited, these vulnerabilities can lead to data leaks, service interruptions, or even system control, causing serious economic losses and a crisis of trust.

[0003] Penetration testing, a key method for discovering security vulnerabilities in web applications, uncovers vulnerabilities and assesses risks by simulating attacker behavior. However, traditional penetration testing has significant limitations: First, it heavily relies on human experience, requiring testers to possess solid security knowledge and practical skills, leading to significant variations in test quality due to individual ability differences, and making it difficult to cover all potential vulnerabilities in complex business scenarios. Second, it has low automation; most tools can only detect single vulnerabilities, lacking in-depth analysis of vulnerability relationships and failing to simulate scenarios where multiple vulnerabilities are exploited together in real attacks, resulting in high false positive and false negative rates. Third, the testing process is static, making it difficult to dynamically adapt to real-time changes in the target system's state, such as updates to defense strategies and adjustments to business processes, resulting in a lack of flexibility in attack route planning and discrepancies between risk assessment results and actual threats. Fourth, risk assessment has a single dimension, focusing primarily on the severity of the vulnerability itself, ignoring its position in the business process and its cascading impact with other vulnerabilities, making it difficult to quantify the actual threat of vulnerabilities to core business operations. Summary of the Invention

[0004] To address the aforementioned issues, this invention provides a web automated penetration testing method and apparatus, electronic device, and storage medium, aiming to achieve a high degree of automation, in-depth vulnerability correlation mining, dynamic attack route planning, and comprehensive risk assessment.

[0005] The technical solution adopted in this invention is as follows:

[0006] A web automated penetration testing method includes the following steps:

[0007] Step 1: Collect information from the target web using web crawlers to form a basic information set;

[0008] Step 1 involves configuring web crawler parameters, employing a hybrid strategy to traverse the site and filter links to focus on valid resources, parsing pages to collect domain names, IPs, ports, directory structures, application fingerprints, and interactive element information, and combining this with publicly available content from search engines to form a structured basic information set.

[0009] Step 2: Perform vulnerability detection on the basic information set from Step 1 to obtain vulnerability information in the target web application;

[0010] The vulnerability information includes: vulnerability type, location, and characteristic information;

[0011] Step 3: From the preset vulnerability exploitation library, match the script that matches the vulnerability information in Step 2;

[0012] The basic payload template is invoked, and the basic payload template is dynamically adjusted by a mutation algorithm and combined with the target web application features identified in step 2 to generate intelligent payloads.

[0013] According to the business process sequence of the target web application, the intelligent payload is sent sequentially to each vulnerability location of the target web application through the adapted script to verify the exploitability of each vulnerability, and record the single exploitation result and the exploitation sequence relationship between different vulnerabilities.

[0014] Step 4: Construct business dependencies based on knowledge graph to clarify the correlation and impact between vulnerabilities, assess the success rate of each vulnerability exploitation and the potential risks to the target system, and output the vulnerability severity coefficient, the importance weight of business modules, and the potential risk value of individual vulnerabilities;

[0015] Step 4 specifically includes:

[0016] Step 4.1: Based on the vulnerability set identified in Step 2 and the vulnerability exploitation sequence verified in Step 3, and combined with the business process logic of the target web application, a knowledge graph G=(V,E) is constructed with a single vulnerability as a vulnerability node V and the dependency relationship formed by the preconditions and post-effects of the vulnerability in the business process as an edge E.

[0017] Step 4.2: Analyze historical data on vulnerability exploitation and business association features in the knowledge graph using association rule mining algorithms to generate dependency weights W. ij W ij This represents the probability that vulnerability j can be exploited after vulnerability i is successfully exploited. The value ranges from 0 to 1. This weight is calculated for vulnerability pairs (i, j) with edge E in the knowledge graph to quantify the degree of association.

[0018] Step 4.3: Based on the aforementioned dependency weight W ij Combine the results of the vulnerability exploitability verification in step 3 to comprehensively evaluate the exploit success rate of each vulnerability;

[0019] Step 4.4: Based on the importance level of the business module to which vulnerability node V belongs in the knowledge graph, assess the potential risks to the target system after a single vulnerability is exploited, and clarify the scope of the cascading risks through the dependencies between vulnerabilities.

[0020] Step 4.4 specifically includes:

[0021] Step 4.41: Divide the business module to which the vulnerability belongs into three levels: core, important, and general, and assign them importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4 respectively, and bind them to the vulnerability node in the knowledge graph;

[0022] Vulnerabilities are scored according to the CVSS standard, with a score range of 0-10, which is converted into a vulnerability severity coefficient of 0-1;

[0023] The potential risk value of a single vulnerability = severity coefficient × weight of the module to which it belongs;

[0024] Step 4.42: Starting with the target vulnerability, based on knowledge graph dependencies and W... ij Filter W ij Directly related vulnerabilities with a probability ≥ 0.6 and indirectly related vulnerabilities with a cumulative correlation probability ≥ 0.3 form a dependency chain, where the cumulative correlation probability refers to the probability of all W vulnerabilities along the path from the originating vulnerability to the indirect vulnerability. ij The product;

[0025] Extract all business modules to which vulnerabilities belong in the dependency chain, and use the deduplicated modules as the scope of the chain risk impact.

[0026] Chain risk level = Initial vulnerability risk value + Sum of the product of downstream vulnerability risk value and corresponding path weight.

[0027] Step 5: Combining the vulnerability detection results from Step 2, the vulnerability exploitation from Step 3, and the business dependencies from Step 4, the best attack route for the identified vulnerabilities in the target web application is planned using reinforcement learning algorithms. The attack strategy is then dynamically adjusted based on the real-time status of the target system to ultimately determine the attack depth and scope.

[0028] The attack depth and range are characteristics of the attack path risk.

[0029] Step 5 specifically includes the following steps:

[0030] Step 5.1: Combine the vulnerability detection results from Step 2, the vulnerability exploitation information from Step 3, and the knowledge graph and dependency weights W constructed in Step 4. ijConstruct a state space S and an action space A for reinforcement learning. The state space S contains the set of currently exploited vulnerabilities, the associated states of unexploited vulnerabilities, and the business process in which they are located. The action space A is the operation to exploit unexploited vulnerabilities.

[0031] Step 5.2: Design the reward function Psuccess represents the vulnerability exploitation success rate and dependency weight W based on the evaluation in step 4. ij The expected success rate is calculated, where Rrisk is the potential risk value based on the assessment in step 4, and α and β are the initial values ​​determined by the vulnerability association strength and business risk level in step 4.

[0032] Step 5.3: Iteratively update the action value function Q(S, A) using the Q-learning algorithm, and select the action sequence with the maximum cumulative reward that conforms to the knowledge graph dependency constraints as the initial optimal attack route;

[0033] Step 5.4: Based on the real-time status of the target system, including updates to defense strategies and traffic fluctuations, dynamically adjust the weight coefficients α and β of the reward function and re-optimize the attack route;

[0034] Step 5.5: Based on the optimized attack route, and combined with the business layer corresponding to the vulnerability node in the knowledge graph, define the attack depth D = max{d1, d2...d...} k}, and determine the attack scope based on the business modules covered by high-weight dependencies and the modules actually involved in the route, where d k Let k be the penetration level of the k-th path.

[0035] Step 6: Use a dynamic scoring model and combine it with vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct a risk assessment, and generate a visual report that includes detailed vulnerability information, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0036] Step 6 specifically includes the following steps:

[0037] Step 6.1: Collect the vulnerability information from Step 2, the importance weight of business modules and the correlation impact data between vulnerabilities from Step 4, and the attack route and scope data from Step 5, and summarize them to form a basic dataset for risk assessment.

[0038] Step 6.2: Standardize the vulnerability severity coefficient to make it compatible with the numerical range of the importance weight of business modules and the risk characteristics of attack paths;

[0039] Step 6.3: Assign influencing factors to the importance weight of business modules and the risk characteristics of attack paths based on the business module level and the attack threat level;

[0040] Step 6.4: Calculate the standardized vulnerability severity coefficient, the importance weight of the business module with impact factors, and the attack path risk characteristics using a weighted summation algorithm to obtain a comprehensive risk score for a single vulnerability, and convert it into a point system;

[0041] Step 6.5: Based on the comprehensive risk score of a single vulnerability obtained in Step 6.4, and combined with the correlation impact data between vulnerabilities in Step 4, the risk scores of the individual vulnerabilities are weighted and integrated according to their correlation relationships using an algorithm to calculate the comprehensive risk score of the entire system.

[0042] Step 6.6: Based on the overall system risk score obtained in Step 6.5 and the individual vulnerability risk score obtained in Step 6.4, determine the risk level of the individual vulnerability and analyze the degree of cascading risks and system-level threats;

[0043] Step 6.7: Based on the assessment results, propose targeted remediation suggestions and system security improvement measures, and integrate them into a visual report.

[0044] A web automated penetration testing system includes:

[0045] Information gathering module: Collects information from the target Web using web crawlers to form a basic information set;

[0046] Vulnerability detection module: Performs vulnerability detection on the basic information set in the information collection module to obtain the types, locations, and characteristics of vulnerabilities in the target web application;

[0047] Vulnerability Exploitation Module: From the preset vulnerability exploitation library, it matches scripts that are compatible with the vulnerability information in the vulnerability detection module; it calls the basic payload template, which is dynamically adjusted by a mutation algorithm and combined with the target web application characteristics identified in the vulnerability detection module to generate a smart payload; according to the business process sequence of the target web application, the smart payload is sent sequentially to each vulnerability location of the target web application through the adapted script, verifies the exploitability of each vulnerability, and records the single exploitation result and the exploitation order relationship between different vulnerabilities;

[0048] Risk assessment and correlation analysis module: Based on knowledge graph, business dependencies are constructed to clarify the correlation impact between vulnerabilities, assess the success rate of each vulnerability exploitation and the potential risks to the target system, and output the vulnerability severity coefficient, the importance weight of business modules, and the potential risk value of individual vulnerabilities;

[0049] Attack route planning module: Combining vulnerability detection results, vulnerability exploitation and business dependencies, it uses reinforcement learning algorithms to plan the best attack route for identified vulnerabilities in the target web application, and then dynamically adjusts the attack strategy according to the real-time status of the target system to finally determine the attack depth and scope.

[0050] Comprehensive Risk Assessment and Report Generation Module: Employs a dynamic scoring model combined with vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct risk assessments and generate visualized reports containing detailed vulnerability information, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0051] An electronic device includes a processor and a memory, wherein computer program instructions are stored in the memory, and the computer program instructions, when executed by the processor, cause the processor to perform the steps of an automated web penetration testing method.

[0052] A computer storage medium storing computer program instructions, which, when executed by a processor, cause the processor to perform the steps of an automated web penetration testing method.

[0053] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0054] 1. In this invention, target web information is automatically collected via web crawler to form a structured basic information set. This is combined with a pre-set vulnerability exploitation library to automatically match and adapt scripts. Furthermore, intelligent payloads are dynamically generated using mutation algorithms, minimizing manual intervention throughout the process. This not only reduces over-reliance on the professional experience of testers but also significantly improves testing efficiency. It enables comprehensive scanning and detection of complex web applications in a short time, solving the problems of cumbersome and inefficient manual operations in traditional penetration testing.

[0055] 2. In this invention, business dependencies between vulnerabilities are constructed based on a knowledge graph. Dependency weights are generated through association rule mining algorithms to accurately quantify the probability of joint vulnerability exploitation. Simultaneously, highly correlated direct and indirect vulnerabilities are selected from vulnerabilities to form dependency chains, clarifying the scope of cascading risks and calculating their severity. This technical solution overcomes the limitations of traditional testing that focuses only on single vulnerabilities, enabling a comprehensive understanding of the interrelationships between vulnerabilities and providing a more comprehensive basis for subsequent risk assessment and attack route planning.

[0056] 3. In this invention, reinforcement learning algorithms are combined to integrate vulnerability detection results, exploitation status, and knowledge graph dependency weights into the state and action spaces. The initial optimal attack route is determined by iteratively updating the action value function. Simultaneously, the reward function weight coefficients are dynamically adjusted based on the real-time state of the target system, continuously optimizing the attack route and ensuring that the attack strategy is adapted to the system state. This improves the success rate of vulnerability exploitation and makes the attack route more closely aligned with actual attack scenarios.

[0057] 4. This invention employs a dynamic scoring model that comprehensively assesses risk by considering vulnerability severity coefficients, business module importance weights, and attack path risk characteristics. It not only calculates the comprehensive risk score for individual vulnerabilities but also integrates them through correlations to derive the overall system's comprehensive risk score, clearly defining the risk level of individual vulnerabilities, the degree of cascading risks, and system-level threats. Compared to traditional single-dimensional risk assessments, this system more accurately reflects the actual security status of web applications, providing precise guidance for security protection. Attached Figure Description

[0058] The present invention will be described by way of example and with reference to the accompanying drawings, wherein:

[0059] Figure 1 This is a flowchart of an automated web penetration testing method according to Embodiment 1 of the present invention;

[0060] Figure 2 This is a flowchart of step 4 of an automated web penetration testing method in Embodiment 1 of the present invention;

[0061] Figure 3 This is a flowchart of step 5 of an automated web penetration testing method in Embodiment 1 of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0063] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0064] It should be noted that, unless otherwise specified, the embodiments and features described in this invention can be combined with each other.

[0065] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0066] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0067] It should be noted that, unless otherwise specified, the embodiments and features described in this invention can be combined with each other.

[0068] Example 1

[0069] like Figures 1-3 As shown in the figure, an automated web penetration testing method is disclosed in this embodiment of the invention, including:

[0070] Step 1: Collect information from the target web using web crawlers to form a basic information set;

[0071] Step 1 involves configuring web crawler parameters, employing a hybrid strategy to traverse the site and filter links to focus on valid resources, parsing pages to collect domain names, IPs, ports, directory structures, application fingerprints, and interactive element information, and combining this with publicly available content from search engines to form a structured basic information set.

[0072] Step 2: Perform vulnerability detection on the basic information set from Step 1 to obtain vulnerability information in the target web application;

[0073] The vulnerability information includes: vulnerability type, location, and characteristic information;

[0074] It should be understood that step 2 is specifically based on the structured basic information set formed in step 1, which includes information such as domain name, IP address, port, directory structure, application fingerprint, and interactive elements. It uses various vulnerability detection technologies (such as static code analysis, dynamic behavior monitoring, fuzzing, etc.) to conduct a comprehensive scan of the target web application. Differentiated detection strategies are formulated for different application fingerprints and directory structures. The focus is on detecting common types such as SQL injection, XSS, command injection, privilege escalation, and file upload vulnerabilities. Potential anomalies are identified by analyzing the response data of page interactive elements. The specific location of each vulnerability in the web application (such as specific URLs, parameters, page components, etc.) is accurately located. At the same time, the characteristic information of the vulnerability (such as triggering conditions, scope of impact, and exploitation methods, etc.) is recorded. Finally, a complete vulnerability information set containing vulnerability type, location, and characteristic information is formed.

[0075] Step 3: From the preset vulnerability exploitation library, match the script that matches the vulnerability information in Step 2;

[0076] The basic payload template is invoked, and the basic payload template is dynamically adjusted by a mutation algorithm and combined with the target web application features identified in step 2 to generate intelligent payloads.

[0077] According to the business process sequence of the target web application, the intelligent payload is sent sequentially to each vulnerability location of the target web application through the adapted script to verify the exploitability of each vulnerability, and record the single exploitation result and the exploitation sequence relationship between different vulnerabilities.

[0078] It should be understood that step 3 specifically involves first, based on the vulnerability type, location, and characteristic information obtained in step 2, selecting scripts from a pre-set vulnerability exploitation database using a feature matching algorithm to ensure that the attack logic of the scripts highly matches the vulnerability characteristics; then, calling the system's built-in basic payload template, and combining it with the target web application characteristics identified in step 2 (such as application type, version number, protection mechanism, etc.), dynamically adjusting the basic payload template using a mutation algorithm to generate targeted intelligent payloads to circumvent the target system's basic defense strategies; subsequently, according to the business process sequence of the target web application (such as the logical order of user login, data submission, permission change, etc.), associating and binding the adapted scripts with the intelligent payloads, and sequentially sending script requests carrying intelligent payloads to the specific locations of each vulnerability (such as specific URLs, parameter interfaces, etc.); during the sending process, monitoring the target system's response status in real time, verifying the possibility of each vulnerability being successfully exploited, recording the results of a single exploit (including successful exploitation, exploitation failure, and reasons for failure, etc.), and simultaneously tracking the sequential relationship formed by different vulnerabilities during the exploitation process (such as a vulnerability needing to be successfully triggered after another vulnerability is exploited, etc.), ultimately forming a complete vulnerability exploitation verification record.

[0079] Step 4: Construct business dependencies based on knowledge graph to clarify the correlation and impact between vulnerabilities, assess the success rate of each vulnerability exploitation and the potential risks to the target system, and output the vulnerability severity coefficient, the importance weight of business modules, and the potential risk value of individual vulnerabilities;

[0080] like Figure 2 As shown, step 4 specifically includes:

[0081] Step 4.1: Based on the vulnerability set identified in Step 2 and the vulnerability exploitation sequence verified in Step 3, and combined with the business process logic of the target web application, a knowledge graph G=(V,E) is constructed with a single vulnerability as a vulnerability node V and the dependency relationship formed by the preconditions and post-effects of the vulnerability in the business process as an edge E.

[0082] It should be understood that step 4.1 specifically builds upon the vulnerability set identified in step 2 (including the type, location, and characteristic information of each vulnerability) and the vulnerability exploitation sequence verified in step 3 (recording the sequential triggering relationship between different vulnerabilities). It deeply integrates the business process logic of the target web application (such as the flow rules of user registration → login → data query → order submission, etc.), defining each independent vulnerability as a vulnerability node V in the knowledge graph. Each node is associated with its corresponding vulnerability type, location, characteristics, and business process attributes. At the same time, it analyzes the preconditions (such as a vulnerability can only appear after the user completes the login operation) and post-effects (such as a vulnerability causing the permission verification mechanism to fail after being exploited, thus making other vulnerabilities easier to trigger). This dependency relationship formed by the business logic is abstracted as an edge E connecting the corresponding vulnerability nodes. Finally, a knowledge graph G=(V, E) with vulnerability nodes V and dependency edges E as the core is constructed, which intuitively presents the distribution and interaction relationship of vulnerabilities in the business process.

[0083] Step 4.2: Analyze historical data on vulnerability exploitation and business association features in the knowledge graph using association rule mining algorithms to generate dependency weights W. ij W ij This represents the probability that vulnerability j can be exploited after vulnerability i is successfully exploited. The value ranges from 0 to 1. This weight is calculated for vulnerability pairs (i, j) with edge E in the knowledge graph to quantify the degree of association.

[0084] It should be understood that step 4.2 is specifically based on the knowledge graph G=(V,E) constructed in step 4.1. Vulnerability pairs (i,j) with edge E are selected as the analysis objects. A deep analysis is conducted using association rule mining algorithms such as the Apriori algorithm on historical data of vulnerability joint exploitation, including records of the collaborative exploitation of vulnerabilities i and j in historical penetration tests, the frequency of successful triggering, and the business association characteristics of the two in the knowledge graph, such as the correlation of their respective business processes and the matching degree of preconditions and post-effects. The algorithm calculates indicators such as support (the probability that vulnerabilities i and j are exploited simultaneously) and confidence (the conditional probability that vulnerabilities j are exploited after vulnerabilities i are successfully exploited), mapping these to dependency weights W ranging from 0 to 1. ij This quantifies the probability that vulnerability j can be exploited after vulnerability i is successfully exploited. The higher the value, the stronger the correlation between the two, thus providing a quantitative basis for assessing the cascading risks of vulnerabilities and planning attack routes.

[0085] Step 4.3: Based on the aforementioned dependency weight W ij Combine the results of the vulnerability exploitability verification in step 3 to comprehensively evaluate the exploit success rate of each vulnerability;

[0086] It should be understood that step 4.3 specifically involves applying the dependency weights W generated in step 4.2. ij Combined with the vulnerability exploitability verification results from step 3, a comprehensive evaluation of the exploit success rate of each vulnerability is conducted. First, the success or failure results of a single exploit recorded in step 3 are extracted, and its base success rate is calculated. Then, based on the relationships between vulnerabilities in the knowledge graph, a dependency weight W is introduced for each corresponding vulnerability pair. ij Analyze the impact of other related vulnerabilities being exploited on the success rate of the current vulnerability exploitation—if a related vulnerability has already been successfully exploited and W ij A higher value indicates a higher success rate for the current vulnerability, while a lower value may maintain the basic success rate or slightly decrease it. By integrating the basic success rate with related influencing factors through weighted calculation, the actual exploitation success rate of each vulnerability is finally obtained after comprehensively considering its own exploitability and the impact of related vulnerabilities, providing key data support for subsequent attack route planning.

[0087] Step 4.4: Based on the importance level of the business module to which vulnerability node V belongs in the knowledge graph, assess the potential risks to the target system after a single vulnerability is exploited, and clarify the scope of the cascading risks through the dependencies between vulnerabilities.

[0088] It should be understood that step 4.4 specifically involves assessing the potential risks to the target system after a single vulnerability is exploited, based on the importance level of the business module to which vulnerability node V belongs in the knowledge graph. By clarifying the core nature of each business module within the target system and determining its corresponding importance level, this level is then combined with the severity of the vulnerability itself to quantify the potential risk value that an exploited single vulnerability might cause. Simultaneously, based on the dependencies between vulnerabilities in the knowledge graph, other vulnerabilities that are directly or indirectly related to this vulnerability are tracked. This analysis examines how these dependencies trigger a chain reaction after the vulnerability is exploited, thereby clarifying the business modules and system scope affected by the chain risk, providing a basis for a comprehensive understanding of the overall threat that the vulnerability may pose.

[0089] Step 4.4 specifically includes:

[0090] Step 4.41: Divide the business module to which the vulnerability belongs into three levels: core, important, and general, and assign them importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4 respectively, and bind them to the vulnerability node in the knowledge graph;

[0091] Vulnerabilities are scored according to the CVSS standard, with a score range of 0-10, which is converted into a vulnerability severity coefficient of 0-1;

[0092] The potential risk value of a single vulnerability = severity coefficient × weight of the module to which it belongs;

[0093] Step 4.42: Starting with the target vulnerability, based on knowledge graph dependencies and W... ij Filter W ij Directly related vulnerabilities with a probability ≥ 0.6 and indirectly related vulnerabilities with a cumulative correlation probability ≥ 0.3 form a dependency chain, where the cumulative correlation probability refers to the probability of all W vulnerabilities along the path from the originating vulnerability to the indirect vulnerability. ij The product;

[0094] Extract all business modules to which vulnerabilities belong in the dependency chain, and use the deduplicated modules as the scope of the chain risk impact.

[0095] Chain risk level = Initial vulnerability risk value + Sum of the product of downstream vulnerability risk value and corresponding path weight.

[0096] Step 5: Combining the vulnerability detection results from Step 2, the vulnerability exploitation from Step 3, and the business dependencies from Step 4, the best attack route for the identified vulnerabilities in the target web application is planned using reinforcement learning algorithms. The attack strategy is then dynamically adjusted based on the real-time status of the target system to ultimately determine the attack depth and scope.

[0097] The attack depth and range are characteristics of the attack path risk.

[0098] It should be understood that step 5 specifically integrates the vulnerability detection results from step 2, the vulnerability exploitation status from step 3, and the business dependencies from step 4, and constructs a reinforcement learning environment model based on this. The identified vulnerability information, records of successful exploitation, and dependencies between vulnerabilities are used as algorithm input, with a learning task aimed at maximizing attack effectiveness. The reinforcement learning algorithm is used to simulate and train different vulnerability exploitation sequences and combinations. During training, the strategy is continuously adjusted based on the results of each simulated attack (such as vulnerability exploitation success rate and impact on the system), gradually planning the optimal attack route for the identified vulnerabilities in the target web application. Simultaneously, the real-time status of the target system is continuously monitored, including updates to system defense strategies, fluctuations in network traffic, and temporary adjustments to business processes. When these statuses change, the attack strategy is dynamically revised, and the exploit value and priority of each vulnerability are reassessed. Finally, based on the optimized attack route, the attack depth is determined by combining the hierarchical relationship of vulnerabilities in the business process, and the attack scope is determined based on the scope of business modules involved in the attack, forming an attack path risk profile that fits the actual situation of the target system.

[0099] like Figure 3 As shown, step 5 specifically includes the following steps:

[0100] Step 5.1: Combine the vulnerability detection results from Step 2, the vulnerability exploitation information from Step 3, and the knowledge graph and dependency weights W constructed in Step 4. ijConstruct a state space S and an action space A for reinforcement learning. The state space S contains the set of currently exploited vulnerabilities, the associated states of unexploited vulnerabilities, and the business process in which they are located. The action space A is the operation to exploit unexploited vulnerabilities.

[0101] It should be understood that step 5.1 specifically combines the vulnerability detection results obtained in step 2, which include vulnerability type, location, and characteristic information; the vulnerability exploitation information recorded in step 3, including exploitability verification results and exploitation order relationships; and the knowledge graph constructed in step 4, which includes vulnerability nodes, dependency relationship edges, and dependency weights W. ij The reinforcement learning process constructs a state space S and an action space A. The state space S is formed by integrating multi-dimensional information, specifically including a set of vulnerabilities that have been successfully exploited, and unexploited vulnerabilities based on a knowledge graph and dependency weights W. ij The presented associated states, such as dependencies with exploited vulnerabilities and potential triggering possibilities, as well as the business stages where the current attack operation is located, such as user authentication and data interaction stages, comprehensively reflect the dynamic scenario in the attack process; the action space A is defined as the exploitation operations that can be performed on all unexploited vulnerabilities, that is, for each unexploited vulnerability, the specific behavior that can be attempted to exploit the vulnerability can be selected, providing clear decision options for reinforcement learning algorithms.

[0102] Step 5.2: Design the reward function Psuccess represents the vulnerability exploitation success rate and dependency weight W based on the evaluation in step 4. ij The expected success rate is calculated, where Rrisk is the potential risk value based on the assessment in step 4, and α and β are the initial values ​​determined by the vulnerability association strength and business risk level in step 4.

[0103] It should be understood that α and β are weighting coefficients. By adjusting their ratio, the attack effect and potential risk are balanced, so that the reward function can accurately measure the value of different attack actions and provide a quantitative basis for the decision-making of reinforcement learning algorithms.

[0104] Step 5.3: Iteratively update the action value function Q(S, A) using the Q-learning algorithm, and select the action sequence with the maximum cumulative reward that conforms to the knowledge graph dependency constraints as the initial optimal attack route;

[0105] Step 5.4: Based on the real-time status of the target system, including updates to defense strategies and traffic fluctuations, dynamically adjust the weight coefficients α and β of the reward function and re-optimize the attack route;

[0106] Step 5.5: Based on the optimized attack route, and combined with the business layer corresponding to the vulnerability node in the knowledge graph, define the attack depth D = max{d1, d2...d...} k}, and determine the attack scope based on the business modules covered by high-weight dependencies and the modules actually involved in the route, where d k Let k be the penetration level of the k-th path.

[0107] Step 6: Use a dynamic scoring model and combine it with vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct a risk assessment, and generate a visual report that includes detailed vulnerability information, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0108] Step 6 specifically includes the following steps:

[0109] Step 6.1: Collect the vulnerability information from Step 2, the importance weight of business modules and the correlation impact data between vulnerabilities from Step 4, and the attack route and scope data from Step 5, and summarize them to form a basic dataset for risk assessment.

[0110] Step 6.2: Standardize the vulnerability severity coefficient to make it compatible with the numerical range of the importance weight of business modules and the risk characteristics of attack paths;

[0111] Step 6.2 specifically includes:

[0112] Assuming that the numerical range of the importance weight of the business module and the risk characteristics of the attack path are both [0, 1], then the standardization target range of the vulnerability severity coefficient is also set to [0, 1].

[0113] Let the original value of the vulnerability severity coefficient after conversion in step 4.41 be C, and its original value range is [0, 1] (converted from CVSS score of 0-10).

[0114] The min-max normalization formula is used for processing:

[0115] The standardized vulnerability severity coefficient is shown in the following formula:

[0116] C'=(C-C_min) / (C_max-C_min)

[0117] Where C_min is the minimum value (usually 0) among all vulnerability severity coefficients, and C_max is the maximum value (usually 1) among all vulnerability severity coefficients.

[0118] Calculate whether the standardized C' falls within the range of [0, 1]. If there are outliers outside the range, truncate them to 0 or 1 (i.e., take the value 0 when C' < 0, and take the value 1 when C' > 1) to ensure that the numerical range is fully compatible with the importance weight of business modules and the risk characteristics of attack paths, and to provide basic data with a unified dimension for subsequent weighted summation calculations.

[0119] Step 6.3: Based on the business module level and attack threat level, assign influencing factors to the importance weight of business modules and the risk characteristics of attack paths; specifically including:

[0120] Step 6.31: Determine the influencing factors corresponding to the business module level:

[0121] Core business modules (Level 1): Corresponding impact factor k1=0.8-1.0. As they are directly related to the core functions of the system, their weighting impact needs to be given special consideration.

[0122] Key business modules (Level 2): ​​corresponding to an impact factor k2 = 0.5-0.7, reflecting their crucial supporting role in the overall operation of the system;

[0123] General business modules (level 3): corresponding impact factor k3=0.1-0.4, reflecting their auxiliary role in the system.

[0124] The above factors are linked to the importance weights of the business modules in step 4.41 to form weighted module risk parameters.

[0125] Step 6.32: Determine the influencing factors corresponding to the attack threat level:

[0126] High-threat attack path (Level A): Corresponding impact factor m1=0.8-1.0, suitable for paths with large attack depth and coverage of core modules;

[0127] Medium-threat attack path (Level B): Corresponding impact factor m2=0.5-0.7, suitable for paths with limited attack scope but involving important links;

[0128] Low-threat attack paths (Level C): Corresponding impact factor m3 = 0.1-0.4, applicable to attack paths that only affect edge modules. This factor is correlated with the attack path risk characteristics determined in step 5, quantifying the threat weight of different paths. Through the mapping between levels and factors, the importance weight of business modules and the attack path risk characteristics are included in the calculation according to the actual degree of impact in the subsequent comprehensive assessment, ensuring the accuracy of risk scoring.

[0129] Step 6.4: Calculate the standardized vulnerability severity coefficient, the importance weight of the business module with impact factors, and the attack path risk characteristics using a weighted summation algorithm to obtain a comprehensive risk score for a single vulnerability, and convert it into a point system;

[0130] Specifically, it includes:

[0131] First, clarify the parameters involved in the calculation: Let the standardized vulnerability severity coefficient be C', the importance weight of the business module carrying the impact factor be f×W (where f is the impact factor corresponding to the business module level, and W is the importance weight of the business module), and the attack path risk characteristic carrying the impact factor be g×P (where g is the impact factor corresponding to the attack threat level, and P is the attack path risk characteristic).

[0132] Then, a weighted summation algorithm is used to calculate the comprehensive risk score, as shown in the formula:

[0133] S=x×C'+y×(f×W)+z×(g×P).

[0134] Where x, y, and z are the weight coefficients of each parameter, and x+y+z=1. They can be set according to the severity of the vulnerability itself, the importance of the business module, and the emphasis on the attack path risk in the actual scenario. For example, the default values ​​are x=0.4, y=0.3, and z=0.3.

[0135] Finally, the calculated S value is converted into a score system. If the range of S is [0, 1], when converting to a 10-point system, the formula can be: 10-point score = S × 10, and the result is rounded to one decimal place; when converting to a 100-point system, the formula is: 100-point score = S × 100, and the result is rounded to the nearest integer, thus intuitively presenting the comprehensive risk level of a single vulnerability.

[0136] Step 6.5: Based on the comprehensive risk score of individual vulnerabilities obtained in Step 6.4, and combined with the correlation impact data between vulnerabilities in Step 4, the risk scores of individual vulnerabilities are weighted and integrated according to their correlation relationships using an algorithm to calculate the comprehensive risk score of the entire system; specifically including:

[0137] Step 6.51: Construct a vulnerability correlation matrix. This is done using the dependency weight W between vulnerabilities. ij With W as the core, form an n×n matrix M, where matrix element M(i,j)=W ij M(i, i) represents the strength of the correlation between vulnerability i and vulnerability j. When i = j, M(i, i) = 1 (self-weight).

[0138] Step 6.52: Calculate the correlation weighted score for each individual vulnerability. For each vulnerability i, its correlation weighted score T i =S i ×Σ(M(i,j)×S j This means that by weighting and summing the impact of the vulnerability on the overall system risk of highly correlated vulnerabilities with all other vulnerabilities, the cumulative effect of highly correlated vulnerabilities on the system risk can be amplified.

[0139] Step 6.53: Integrate to obtain the overall system risk score. A weighted average algorithm is used to summarize the weighted scores associated with all vulnerabilities. The formula is: Overall System Risk Score T = Σ(T i ×h i ), where h i The system impact ratio of vulnerability i (Σh) i =1, which can be set according to the core nature of the business module where the vulnerability is located. If it needs to be converted to a points system, refer to the points system conversion method in step 6.4 to map the T value to a 10-point system or a 100-point system to intuitively reflect the overall risk level of the system.

[0140] Step 6.6: Based on the overall system risk score obtained in Step 6.5 and the individual vulnerability risk score obtained in Step 6.4, determine the risk level of each individual vulnerability and analyze the degree of cascading risks and system-level threats; specifically including:

[0141] Step 6.61: Determine the risk level of an individual vulnerability. Compare the overall risk score Sᵢ of an individual vulnerability with a preset threshold. If a 10-point scale is used, the level classification standard can be set: Sᵢ i A score of ≥8 indicates "extremely high risk", and 6≤S i <8 points indicates "high risk", 4≤S i <6 points indicates "medium risk", 2≤S i <4 points indicates "low risk", S i A score of <2 indicates "extremely low risk"; simultaneously, the level boundaries are adjusted based on the overall system comprehensive risk score T. When T ≥ 8 points, the threshold for each level is lowered by 1 point (e.g., "extremely high risk" is adjusted to S). i (≥7 points) to reflect the chain reaction effect of a single vulnerability under high-risk system conditions.

[0142] Step 6.62: Analyze the degree of cascading risk. Based on the vulnerability correlation matrix M from Step 4, calculate the correlation impact range index L for vulnerabilities i at the "high risk" level and above. i =Σ(M(i,j)×I(S) j ≥4)) (where I is the indicator function, when S j (I=1 when ≥4, otherwise I=0), L i A higher value indicates a higher likelihood that the vulnerability will trigger a chain reaction of medium- to high-risk vulnerabilities; simultaneously, the T-value is used to assess the systemic diffusion of the chain reaction risk. When T ≥ 6 and L exists... i Vulnerabilities with a severity level of ≥3 are classified as "serious cascading risks".

[0143] Step 6.63: Assess system-level threats. Based on the T-score and the distribution characteristics of high-risk vulnerabilities, if T ≥ 8 and the number of "extremely high-risk" vulnerabilities ≥ 3, the system is deemed to face a "fatal threat"; if 6 ≤ T < 8 and "high-risk" and above vulnerabilities are concentrated in core business modules (h... i If the score is ≥0.6, it is determined that "the core functions of the system are seriously threatened"; if the score is <6 and the high-risk vulnerability is scattered in non-core modules, it is determined that "the local functions of the system are threatened", thus comprehensively presenting the overall threat situation of the vulnerability to the system.

[0144] Step 6.7: Based on the assessment results, propose targeted remediation suggestions and system security improvement measures, and integrate them into a visual report.

[0145] Example 2

[0146] This embodiment proposes an automated web penetration testing system, including:

[0147] Information gathering module: Collects information from the target Web using web crawlers to form a basic information set;

[0148] Vulnerability detection module: Performs vulnerability detection on the basic information set in the information collection module to obtain the types, locations, and characteristics of vulnerabilities in the target web application;

[0149] Vulnerability Exploitation Module: From the preset vulnerability exploitation library, it matches scripts that are compatible with the vulnerability information in the vulnerability detection module; it calls the basic payload template, which is dynamically adjusted by a mutation algorithm and combined with the target web application characteristics identified in the vulnerability detection module to generate a smart payload; according to the business process sequence of the target web application, the smart payload is sent sequentially to each vulnerability location of the target web application through the adapted script, verifies the exploitability of each vulnerability, and records the single exploitation result and the exploitation order relationship between different vulnerabilities;

[0150] Risk assessment and correlation analysis module: Based on knowledge graph, business dependencies are constructed to clarify the correlation impact between vulnerabilities, assess the success rate of each vulnerability exploitation and the potential risks to the target system, and output the vulnerability severity coefficient, the importance weight of business modules, and the potential risk value of individual vulnerabilities;

[0151] Attack route planning module: Combining vulnerability detection results, vulnerability exploitation and business dependencies, it uses reinforcement learning algorithms to plan the best attack route for identified vulnerabilities in the target web application, and then dynamically adjusts the attack strategy according to the real-time status of the target system to finally determine the attack depth and scope.

[0152] Comprehensive Risk Assessment and Report Generation Module: Employs a dynamic scoring model combined with vulnerability severity coefficients, business module importance weights, and attack path risk characteristics to conduct risk assessments and generate visualized reports containing detailed vulnerability information, risk assessment results, targeted remediation suggestions, and system security improvement measures.

[0153] Example 3

[0154] This embodiment proposes an electronic device, including a processor and a memory, wherein computer program instructions are stored in the memory, and the computer program instructions, when executed by the processor, cause the processor to perform the steps of an automated web penetration testing method.

[0155] Example 4

[0156] This embodiment proposes a computer storage medium storing computer program instructions, which, when executed by a processor, cause the processor to perform the steps of an automated web penetration testing method.

[0157] The circuits, electronic components, and modules involved are all existing technologies, which can be fully implemented by those skilled in the art, and need not be elaborated upon. The scope of protection of this invention does not involve any improvement to the software and methods.

[0158] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0159] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method of web automated penetration testing, characterized in that, The method comprises the following steps: Step 1: Collecting information of the target Web based on a web crawler to form a basic information set; Step 2: Performing vulnerability detection on the basic information set in step 1 to obtain vulnerability information existing in the target Web application; Step 3: Matching scripts that are suitable for the vulnerability information in step 2 from a preset vulnerability library; Calling a basic payload template, which is dynamically adjusted by a mutation algorithm and combined with the characteristics of the target Web application identified in step 2 to generate an intelligent payload; According to the business process sequence of the target Web application, the intelligent payload is sent to each vulnerability position of the target Web in sequence through the adapted scripts to verify the exploitability of each vulnerability, and the single exploitation result and the exploitation order relationship between different vulnerabilities are recorded; Step 4: Based on the knowledge graph, the business dependency relationship is constructed to clarify the correlation and influence between vulnerabilities, the success rate of each vulnerability exploitation and the potential risk to the target system are evaluated, and the vulnerability severity coefficient, the business module importance weight and the potential risk value of a single vulnerability are outputted; Step 5: Combining the vulnerability detection result in step 2, the vulnerability exploitation in step 3 and the business dependency relationship in step 4, the best attack route for the identified vulnerabilities in the target Web application is planned through a reinforcement learning algorithm, and the attack strategy is dynamically adjusted according to the real-time state of the target system to finally determine the attack depth and range; The attack depth and range are attack path risk characteristics; Step 5 specifically comprises the following steps: Step 5.1: combine the vulnerability detection results of step 2, the vulnerability exploitation situation of step 3, and the knowledge graph and dependency weight W constructed in step 4 ij , and build the state space S and action space A of reinforcement learning, wherein the state space S includes the current set of exploited vulnerabilities, the associated state of unexploited vulnerabilities, and the business link in which they are located, and the action space A is the exploitation operation on unexploited vulnerabilities; Step 5.2: Design reward function R = a • Psuccess - β • Rrisk, where Psuccess is the success rate of exploit based on the evaluation of step 4 and the dependency weight W ij the expected success rate of the calculation, Rrisk is the potential risk value based on the evaluation of step 4, a and β are the initial values of the weight coefficients determined by the vulnerability correlation strength and business risk level in step 4; Step 5.3: The action value function Q(S, A) is iteratively updated through the Q-learning algorithm, and the action sequence with the maximum cumulative reward and meeting the dependency relationship constraints of the knowledge graph is selected as the initial best attack route; Step 5.4: According to the real-time state of the target system, including the defense strategy update and the traffic fluctuation, the weight coefficients α and β of the reward function are dynamically corrected, and the attack route is re-optimized; Step 5.5: Based on the optimized attack route, the attack depth D = max{d1, d2...d k} is defined in combination with the business level of the vulnerability nodes in the knowledge graph, and the attack range is determined according to the business modules covered by the high-weight dependency relationship and the modules actually involved in the route, where d k is the penetration level of the kth path; Step 6: A dynamic scoring model is used to conduct risk assessment in combination with the vulnerability severity coefficient, the importance weight of the business module, and the risk characteristics of the attack path, and a visual report containing detailed information of the vulnerability, the risk assessment result, targeted repair suggestions, and system security improvement measures is generated.

2. The method of claim 1, wherein, Step 1 specifically configures the network crawler parameters, uses a hybrid strategy to traverse the site and filter links to focus on effective resources, analyzes the page to collect domain name, IP, port, directory structure, application fingerprint and interactive element information, supplements the public content with a search engine, and then organizes and forms a structured basic information set.

3. The method of claim 1, wherein, The vulnerability information includes: vulnerability type, location and characteristic information.

4. The method of claim 1, wherein, Step 4 specifically comprises: Step 4.1: Based on the vulnerability set identified in step 2 and the vulnerability exploitation order verified in step 3, and combined with the business process logic of the target Web application, a knowledge graph G=(V, E) is constructed, taking a single vulnerability as a vulnerability node V, and a dependency relationship formed by the preconditions and post-impact of the vulnerability in the business link as an edge E; Step 4.2: Analyze the historical data of vulnerability joint exploitation and the business association characteristics in the knowledge graph by the association rule mining algorithm to generate dependency weight W ij wherein W ij represents the probability that vulnerability j is subsequently exploited after vulnerability i is successfully exploited, and the value range is 0-1, and the weight is calculated for the vulnerability pair (i, j) with the edge E in the knowledge graph to quantify the association closeness. Step 4.3: Based on the dependency weight W ij and the verification result of vulnerability exploitability in step 3, the exploit success rate of each vulnerability is comprehensively evaluated; Step 4.4: Combined with the importance level of the business module to which the vulnerability node V belongs in the knowledge graph, the potential risk of the target system after the single vulnerability is exploited is evaluated, and the influence range of the chain risk is clarified through the dependency relationship between vulnerabilities.

5. The method of claim 4, wherein, Step 4.4 specifically comprises: Step 4.41: Divide the business module to which the vulnerability belongs into three levels of core, important, and general, and assign business module importance weights of 0.8-1.0, 0.5-0.7, and 0.1-0.4, respectively, and bind them to the vulnerability nodes in the knowledge graph; According to the CVSS standard, the vulnerability score is 0-10, and the vulnerability severity coefficient is converted to 0-1; Single vulnerability potential risk value = vulnerability severity coefficient x module weight; Step 4.42: Starting from the target vulnerability, based on the knowledge graph dependency relationship and W ij , filter out the directly related vulnerabilities with W ij ≥ 0.6 and the indirectly related vulnerabilities with the cumulative correlation probability ≥ 0.3 to form a dependency chain, wherein the cumulative correlation probability refers to the product of all W ij from the starting vulnerability to the indirect vulnerability on the path. Extract all business modules of the vulnerabilities in the dependency chain, and after deduplication, the chain risk impact range is obtained; Chain risk degree = initial vulnerability risk value + the sum of the products of downstream vulnerability risk values and corresponding path weights.

6. The method of claim 1, wherein, The step 6 specifically includes the following steps: Step 6.1: Collect the vulnerability information in step 2, the business module importance weight in step 4, the associated impact data between vulnerabilities, the attack route and range data in step 5, and summarize them to form a risk assessment basic data set; Step 6.2: Standardize the vulnerability severity coefficient to adapt the numerical range of the vulnerability severity coefficient, business module importance weight, and attack path risk feature; Step 6.3: Based on the business module level and attack threat level, assign impact factors to the business module importance weight and attack path risk feature; Step 6.4: Calculate the single vulnerability comprehensive risk score by weighted summation algorithm based on the standardized vulnerability severity coefficient, business module importance weight carrying impact factors, and attack path risk feature, and convert it to a point system; Step 6.5: Based on the single vulnerability comprehensive risk score obtained in step 6.4, combined with the associated impact data between vulnerabilities in step 4, the risk score of a single vulnerability is integrated by weighting according to the correlation, and the comprehensive risk score of the whole system is calculated; Step 6.6: Based on the whole system comprehensive risk score obtained in step 6.5 and the single vulnerability comprehensive risk score obtained in step 6.4, determine the single vulnerability risk level, analyze the chain risk degree and system level threat; Step 6.7: Based on the evaluation results, propose targeted repair suggestions and system security improvement measures, and integrate them into a visual report.

7. A web automatic penetration testing system for implementing the web automatic penetration testing method of claim 1, characterized in that, It includes: Information collection module: Collect information of target Web based on web crawler to form basic information set; Vulnerability detection module: Perform vulnerability detection on the basic information set in the information collection module to obtain the type, location, and feature information of the vulnerabilities existing in the target Web application; Vulnerability exploitation module: From the preset vulnerability exploitation library, match the scripts that adapt to the vulnerability information in the vulnerability detection module; Call the basic payload template, and the intelligent payload is generated after the basic payload template is dynamically adjusted by the mutation algorithm combined with the target Web application features identified in the vulnerability detection module; According to the business process sequence of the target Web application, the intelligent payload is sent to each vulnerability location of the target Web in turn through the adapted script, the exploitability of each vulnerability is verified, and the single exploitation result and the exploitation order relationship between different vulnerabilities are recorded; The risk assessment and correlation analysis module: based on the knowledge graph, the business dependency relationship is constructed to clarify the correlation influence between the vulnerabilities, the success rate of each vulnerability exploitation and the potential risk to the target system are evaluated, and the vulnerability severity coefficient, the business module importance weight and the potential risk value of the single vulnerability are output; The attack route planning module: combined with the vulnerability detection result, the vulnerability exploitation situation and the business dependency relationship, the best attack route for the identified vulnerabilities in the target Web application is planned through the reinforcement learning algorithm, the attack strategy is dynamically adjusted according to the real-time state of the target system, and finally the attack depth and range are determined; The comprehensive risk assessment and report generation module: using a dynamic scoring model and combining the vulnerability severity coefficient, the business module importance weight and the attack path risk characteristics for risk assessment, a visual report containing detailed vulnerability information, risk assessment results, targeted repair suggestions and system security improvement measures is generated.

8. An electronic device, comprising: The computer storage medium stores computer program instructions, and the computer program instructions make the processor execute the steps of the method in any one of claims 1 to 6 when the processor runs.

9. A computer storage medium, characterized in that, The computer storage medium stores computer program instructions, and the computer program instructions make the processor execute the steps of the method in any one of claims 1 to 6 when the processor runs.

Images