Automatic red team penetration testing method, system and equipment based on partial order planning

Abstract

The invention discloses an automatic red team penetration testing method, system and equipment based on partial order planning, and the method comprises the steps: firstly extracting state information of a target system, constructing an action rule, extracting an action, and then defining a target space, a state space and an action space of an attack graph; reasoning an attack purpose in a target space through a recursive mode by applying a partial order planning reasoning engine, adding actions capable of realizing the attack purpose and updating sequence constraints between the actions, and constructing a complete attack plan and an attack graph capable of realizing the attack purpose; and constructing an atomic attack behavior evaluation model in combination with DREAD and CVSS to carry out threat evaluation on each attack path in the attack graph, carrying out screening by adopting an attack path screening algorithm to obtain an optimal attack path, and carrying out automatic penetration testing to verify the network security of the target system. The automatic red team penetration test process is realized, the attack steps can be automatically executed to efficiently verify the security state of the target network, and the penetration test efficiency and accuracy are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the technical field of network security, specifically relating to an automated red team penetration testing method, system, and device based on partial order programming. Background Technology

[0002] With the rapid development of digitalization, the digital transformation of critical infrastructure has led to a continuous expansion of the impact of cyber threats, making cybersecurity a core issue for national security and social stability. In recent years, the scale and complexity of cyberattacks have significantly increased. Attackers employ multi-stage and highly covert methods to breach traditional security defenses, posing severe technical challenges to enterprises and society. Against this backdrop, effectively predicting and preventing Advanced Persistent Threats (APTs) has become a highly relevant research topic. Red team testing, as a proactive security assessment method, is gaining increasing popularity among enterprises. Originating in the military field, red team testing helps organizations discover and patch security vulnerabilities and enhance system defense capabilities by simulating adversary attack strategies. In the cybersecurity field, red team testing typically involves experienced security experts simulating the strategies, techniques, and tactics of real attackers, comprehensively simulating multi-layered attacks on an organization's personnel, network, applications, and hardware facilities. Its goal is to assess an organization's defense capabilities under actual attacks, identify potential vulnerabilities caused by physical, hardware, software, and human factors, thereby improving overall security protection levels. Automated red team testing performs efficient penetration testing simulations by correlating attack behaviors with a large number of vulnerability databases. It aims to systematically assess network security and promptly identify potential security risks.

[0003] Mainstream research on red team testing techniques is divided into three parts: threat prediction of attack behavior, risk quantification of attack behavior, and automated penetration testing techniques. In threat prediction methods for attack behavior, MulVal is an efficient attack graph generation tool. This tool generates attack graphs in complex intranet environments by modeling vulnerabilities, configuration descriptions, and inference rules into a Datalog inference language. The research by Tayouri D et al., "A survey of MulVAL extensions and their attack scenarios coverage," extends MulVal, aiming to enhance interaction rules and improve the fine-grained representation of attack behavior. Regarding risk quantification research on attack behavior, Li Hongjiao et al., in their paper "An Improved Vulnerability Risk Assessment Framework Based on MulVAL," proposed an assessment index based on the amount of resources required to achieve the attack target. In the paper "A Security Assessment Model for RFID Systems Based on Bayesian Attack Graphs," Ma Huiping et al. constructed a Bayesian attack graph risk assessment model for RFID (Radio Frequency Identification) systems. Regarding research on automated penetration testing techniques, the papers "Automated Security Analysis and Penetration Testing Model Based on Attack Graph and Deep Q-Learning Network" and "DynPen: Automated Penetration Testing in Dynamic Network Scenarios Using Deep Reinforcement Learning" respectively proposed automatic attack action selection schemes based on reinforcement learning. These schemes capture dynamic changes in the network environment and assist penetration testing agents in making adaptive decisions based on historical experience.

[0004] The aforementioned existing research has promoted the development of automated red team testing techniques. However, these studies still have several problems. First, in terms of threat prediction for attack behaviors, the sequential decision-making of attack methods still faces significant challenges; further research is needed to optimize the decision-making process to improve the overall effectiveness of the defense system. Second, in the risk quantification research of attack behaviors, researchers usually use open-source threat knowledge bases, such as ATT&CK, CVE, CVSS, and CWE, to standardize the modeling of network attack methods in order to quantify and analyze potential threats in the system and their possible impact. In addition, some studies have achieved standardized risk assessment of attack paths by modeling the transfer relationships between various attack techniques; however, these assessment indicators are mostly derived from open-source network databases and often ignore the complexity and environmental impact at the actual operational level. For example, uncertainties in different environments may make certain vulnerabilities difficult to reproduce, or the same attack path may not be applicable in different scenarios. Finally, in terms of automated penetration testing techniques, there is currently no end-to-end automated red team testing tool that can achieve fully automated operation without the assistance of professional security analysts. Summary of the Invention

[0005] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide an automated red team penetration testing method, system, and device based on partial order programming. By reasoning about ordered attack behavior graphs and combining them with risk assessment schemes to screen feasible attack paths, the invention ultimately achieves automated weapon payload loading, completes the verification of potential network threats, and provides solid technical support for subsequent network security optimization.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: On the one hand, this invention provides an automated red team penetration testing method based on partial order programming, comprising the following steps: Log collection tools and vulnerability scanning tools are used to extract the state information of the target system to obtain a state set; the state set includes network connection, sensitive data, system information, service information and configuration information; Based on the descriptions of tactics and techniques and references in the vulnerability report, action rules are constructed and action sets are extracted; the action set includes action name, action condition and impact; Define the target space, state space, and action space of the attack graph; the target space is preset with an attack objective; the attack objective includes multiple sub-targets; the state space is constructed based on a set of states, and the action space is constructed based on a set of actions; Using a partial order planning reasoning engine based on the STRIPS language, the attack objective in the target space is reasoned step by step in a recursive manner based on the state space and action space. Actions that can achieve the attack objective and the order constraints between updating actions are added to construct a complete attack plan that can achieve the attack objective. An attack graph is constructed based on a complete attack plan that can achieve the attack objective. The attack graph includes AND nodes and OR nodes. An AND node is an action node that requires multiple parent nodes to satisfy a condition simultaneously to trigger an attack behavior. An OR node is an action node that requires any parent node to satisfy a condition to trigger an attack behavior. An atomic attack behavior assessment model is constructed by combining the DREAD threat measurement model and the CVSS vulnerability assessment system. The atomic attack behavior assessment model includes technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators. The atomic attack behavior assessment model is used to assess the threat of each attack path in the attack graph, and an improved attack path filtering algorithm based on depth-first search is used to filter the attack graph after threat assessment to obtain the optimal attack path. Automated penetration testing is used to verify the cybersecurity of the target system based on the optimal attack path.

[0007] As a preferred technical solution, the working process of the partial order planning inference engine based on the STRIPS language is as follows: Load multiple sub-targets of any attack objective in the target space into the target list, and initialize an empty current attack plan and an empty attack plan set; Check if the target list is empty; if so, end the construction of the current attack plan. Otherwise, select an incomplete sub-target from the target list, traverse the action space to see if there is an action that can achieve the incomplete sub-target, if it can be achieved, add the preconditions of the action to the current attack plan, update the action order constraints, and add the preconditions of the action to the target list according to the action order constraints; otherwise, skip the current sub-target and judge the next sub-target. Iterate through all possible sequential constraint combinations of actions in the current attack plan, and determine whether there is a combination that threatens the causal chain of the current action. If it exists, select the sequential constraint combination that does not pose a threat; otherwise, update the current attack plan and continue to judge the target list until the target list is empty to obtain the complete attack plan with the attack objective. The sequential constraint combination refers to the sequential relationship constraint between any two actions in the current attack plan; the causal chain is the logical execution path formed by the current action and its dependencies.

[0008] As a preferred technical solution, the technical feasibility index is evaluated using access control requirements, including three evaluation scores: high, medium, and low; the vulnerability harmfulness index is evaluated from three aspects: vulnerability confidentiality, vulnerability integrity, and vulnerability availability, with each aspect including three evaluation scores: high, medium, and low. The vulnerability impact index is evaluated using a vulnerability impact score; The network depth metric incorporates proxy depth for evaluation, and is calculated as follows: T level = e (-0.5⋅(level- 1)) ,in, level Proxy depth is used to measure the number of proxy layers an attacker needs to reach the target host during a penetration test. The atomic attack behavior evaluation model is expressed as follows: T impact = 10×( α × T L + β × T p + γ × T CIA + δ × T level ), in, T L Due to the vulnerability, T p As a technical feasibility indicator, T level This is a measure of network depth. T CIA The severity of the vulnerability is indicated as follows: T CIA = [1 - (1 - T C ) × (1 - T I ) × (1 - T A )], T C For the sake of vulnerability confidentiality, T I For vulnerability integrity, T A To assess vulnerability availability.

[0009] As a preferred technical solution, the use of an atomic attack behavior evaluation model to perform threat assessment on each attack path in the attack graph specifically involves: The risk value of each node in each attack path in the attack graph is calculated using an atomic attack behavior model. Update the risk value of nodes in the attack path according to node type, where: For nodes in the attack path, their risk values ​​are updated as follows: , in, p ( and i ) is the first in the updated attack path i Each node represents a risk value related to the node. Parents ( and i ) is the first in the attack path i Each node is a set of parent nodes of the node. p ( P j )for Parents ( and i ) j Risk value of each parent node; For any node in the attack path, its risk value is updated as follows: , in, p ( or i ) is the first in the updated attack path i Each node represents a risk value for another node. Parents ( or i ) is the first in the attack path i Each node is a set of parent nodes of another node. p ( P j )for Parents ( or i ) j Risk value of each parent node; After the update, the risk values ​​of nodes in each attack path are accumulated to obtain the threat value of each attack path.

[0010] As a preferred technical solution, the method of using an attack-improved depth-first search-based path filtering algorithm to filter the attack graph after threat assessment to obtain the optimal attack path is as follows: A depth-first search method is used to initially divide the attack paths in the attack graph, resulting in a set of all attack paths. Organize all attack path sets and group all paths with the same starting node and target node into one group to obtain all attack path groups; Based on the logical constraints of the nodes, all attack path groups are deduplicated and merged to select the optimal attack path.

[0011] As a preferred technical solution, the initial division of attack paths in the attack graph using a depth-first search method is specifically as follows: Randomly select a target node in the attack graph as the current node to start the path search, add the current node to the initially empty record path, and initialize an empty attack path set; Determine if the current node has a parent node. If not, add the recorded path to the attack path set and initialize the recorded path. If the parent node exists, add the parent node as the current node to the recorded path and continue searching until the current node has no parent node. Then, add the recorded path to the attack path set and initialize the recorded path. Select another target node in the attack graph as the current node and repeat the path search until all target nodes in the attack graph have been searched, thus obtaining a set of all attack paths.

[0012] As a preferred technical solution, the step of deduplicating and merging all attack path groups based on logical constraints with nodes specifically involves: Determine if the number of paths in each attack path group is 1. If the number of paths is not 1, then check if the node in each attack path group is an AND node. If it is an AND node, then merge its parent node until the number of paths in each attack path group is 1. Organize all attack path groups with a path count of 1, and the deduplicated and merged attack path is the optimal attack path.

[0013] On the other hand, the present invention provides an automated red team penetration testing system based on partial order programming, which is applied to the above-mentioned automated red team penetration testing method based on partial order programming. It includes an information acquisition module, an action extraction module, a space definition module, a plan construction module, an attack graph construction module, an evaluation construction module, an evaluation and screening module, and a penetration testing module. The information collection module is used to extract the status information of the target system using log collection tools and vulnerability scanning tools to obtain a status set; the status set includes network connection, sensitive data, system information, service information and configuration information; The action extraction module is used to construct action rules and extract action sets based on the descriptions of tactics and references in the vulnerability report; the action set includes action name, action conditions and impact; The space definition module is used to define the target space, state space, and action space of the attack graph; the target space has a preset attack objective; the attack objective includes multiple sub-targets; the state space is constructed based on a set of states, and the action space is constructed based on a set of actions; The plan is constructed by using a partial order planning inference engine based on the STRIPS language to recursively infer the attack objective in the target space based on the state space and action space, and adding actions that can achieve the attack objective and order constraints between update actions to construct a complete attack plan that can achieve the attack objective. The attack graph construction module is used to construct an attack graph based on a complete attack plan that can achieve the attack objective; the attack graph includes AND nodes and OR nodes; the AND node is an action node that can trigger an attack behavior only when multiple parent nodes are satisfied simultaneously; the OR node is an action node that can trigger an attack behavior only when any parent node is satisfied. The assessment module is used to construct an atomic attack behavior assessment model by combining the DREAD threat measurement model and the CVSS vulnerability assessment system; the atomic attack behavior assessment model includes technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators; The evaluation and filtering module is used to evaluate the threat of each attack path in the attack graph using the atomic attack behavior evaluation model, and to filter the attack graph after threat evaluation using an improved depth-first search-based attack path filtering algorithm to obtain the optimal attack path. The penetration testing module is used to perform automated penetration testing based on the optimal attack path to verify the network security of the target system.

[0014] In another aspect, the present invention provides an electronic device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor to enable the at least one processor to execute the automated red team penetration testing method based on partial order programming.

[0015] In another aspect, the present invention also provides a computer-readable storage medium storing a program that, when executed by a processor, implements the automated red team penetration testing method based on partial order programming.

[0016] Compared with the prior art, the present invention has the following advantages and beneficial effects: This invention provides an automated red team penetration testing method based on partial order programming. First, it formally defines attack behaviors and system asset nodes using the STRIPS language. Then, it implements attack graph reasoning considering state constraints through a partial order programming algorithm, accurately modeling the sequential dependencies and causal effects of attack behaviors, thereby improving the accuracy and reliability of the attack graph. Next, this invention innovatively combines the DREAD threat measurement model with the CVSS vulnerability assessment system to construct an atomic attack behavior assessment model. This model not only assesses the inherent risk of vulnerabilities but also introduces a network topology depth factor to quantify the decay law of attack feasibility with network depth, making risk assessment more closely aligned with actual attack scenarios. Furthermore, this invention improves the attack path selection algorithm based on depth-first search (DFS). By analyzing the logical dependencies between nodes in the attack graph, it identifies and merges path segments with shared nodes, ensuring that the generated attack path set satisfies the precondition constraints of all action nodes, effectively reducing redundancy and improving path quality. Based on the above technologies, this invention realizes an automated red team penetration testing process, which can automatically execute attack steps according to the optimal attack path, efficiently verify the network security status of the target network, and dynamically adjust subsequent attack strategies based on real-time execution feedback, significantly improving the efficiency and accuracy of penetration testing, while reducing reliance on the technical experience of professional personnel and lowering testing costs. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the automated red team penetration testing method based on partial order programming in an embodiment of the present invention.

[0019] Figure 2 This is a flowchart of the partial order planning inference engine based on the STRIPS language in an embodiment of the present invention.

[0020] Figure 3 This is a topology diagram of a network target range in an embodiment of the present invention.

[0021] Figure 4 This is an attack graph constructed based on a network target location in an embodiment of the present invention.

[0022] Figure 5 This is a simplified attack diagram that retains only the action nodes in this embodiment of the invention.

[0023] Figure 6This is a comparison diagram of attack graph effects in an embodiment of the present invention.

[0024] Figure 7 This is a flowchart of the path filtering algorithm in an embodiment of the present invention.

[0025] Figure 8 This is a schematic diagram of the structure of the automated red team penetration testing system based on partial order programming in an embodiment of the present invention.

[0026] Figure 9 This is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0028] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0029] like Figure 1 As shown, this embodiment discloses an automated red team penetration testing method based on partial order programming, including the following steps: S1. Use log collection tools and vulnerability scanning tools to extract the state information of the target system to obtain a state set.

[0030] In this application, the log collection tool and vulnerability scanning tool can be automated tools such as OVAL, Nessus, and Nmap; in this example, the Nessus tool is used to collect network connections, sensitive data (such as / etc / passwd storing account information, sensitive files, and private data), system information (such as system kernel version, whether critical security patches are installed, CPU architecture, and suspicious processes), service information (such as Apache, MySQL, and SSH), and configuration information (such as arbitrary user execution permissions in the / tmp directory and weak login passwords) as a status set.

[0031] S2. Based on the description of techniques and tactics and references in the vulnerability report, construct action rules and extract action sets, including action name (attack behavior), attack conditions (from the vulnerability description, including service information, system version, host configuration, etc., when all conditions are met, the attack action is considered to be able to be executed), and impact (from the consequences of the vulnerability, such as obtaining credentials, obtaining access permissions, achieving initial access, etc.).

[0032] S3. Define the target space, state space, and action space of the attack graph. The target space has a preset attack objective, such as obtaining administrator privileges on host1 or obtaining sensitive files on host2, and contains multiple sub-objectives. The state space is constructed based on the set of states, and the action space is constructed based on the set of actions.

[0033] Specifically, the target space defines the desired state that the attacker wishes to achieve, typically including gaining privileges through certain attack steps, performing specific operations or controlling the system, or aiming to obtain administrator privileges. Table 1 illustrates an example of gaining administrator privileges on hosts pc1 and pc2 through attack steps within the target space.

[0034] Table 1 Target Space Table

[0035] The state space represents all states of a system or network environment at a specific moment, including network connections, vulnerability information, account passwords, and current permissions. As the attack graph evolves, new attack steps may cause the system to enter unforeseen states; therefore, the state space dynamically expands during the attack. Table 2 illustrates examples of state spaces, including network connections, vulnerability information, and current permissions.

[0036] Table 2 State Space Table

[0037] The action space defines the set of all operations that an attacker can perform, including vulnerability exploitation, privilege escalation, credential theft, and other attack behaviors. Each action has specific preconditions and postconditions. Table 3 lists several attack behaviors, such as lateral movement and credential theft; the preconditions for lateral movement include network connectivity and exploitable vulnerabilities, while the postcondition is obtaining administrator privileges on the target host.

[0038] Table 3 Action Space Table

[0039] S4. Using a partial order planning reasoning engine based on the STRIPS language, the attack objective in the target space is reasoned step by step through the state space and action space in a recursive manner. Actions that can achieve the attack objective and the order constraints between updating actions are added to construct a complete attack plan that can achieve the attack objective.

[0040] Furthermore, after defining the target space, state space, and action space, the partial order planning inference engine based on the STRIPS language designed in this invention recursively infers the attack objective in the target space, adds actions capable of achieving the attack objective, and updates the order constraints between actions to avoid potential conflicts. By dynamically adjusting the order of actions, it ensures that causal relationships are not disrupted, thereby constructing a complete attack plan capable of achieving the attack objective. The specific working process is as follows: Figure 2 As shown: S4.1 Load multiple sub-targets of any attack objective in the target space into the target list. Goallist In the middle, and initialize an empty current attack plan. Plan A set of attack plans that is empty. Plans ; S4.1 Determine the target list Goallist Is it empty? If so, end the construction of the current attack plan. Plan ; S4.2, Otherwise from the target list Goallist Select an unfinished sub-goal and traverse the action space. A Is there any action? a i If the unfinished sub-goal can be achieved, then the action will be performed. a i Add preconditions to the current attack plan Plan In the middle, update actions a i Sequence constraints (such as) a 1→ a 2→...→ a i ), and according to the action a i The sequence constraint will precondition the action (such as...) a 1. a 2. ...) Add to the target list GoallistIf the current sub-target is selected, it is selected; otherwise, the current sub-target is skipped and the next sub-target is evaluated. To achieve the preset attack objective, the multiple matched attack actions are usually accompanied by more preconditions. Some of these conditions are in the state space, while others require other attack actions to satisfy. Therefore, these preconditions that require other attack actions to satisfy are also added as sub-targets to the target list to ensure the completeness of the constructed attack plan.

[0041] S4.3, Traverse the current attack plan Plan Consider all possible sequence constraints of actions and determine whether any pose a threat to the current action. a i Causal chain (e.g.) a x → a y If a combination of ) exists, then choose the combination of non-threatening order constraints (e.g.) a j → a x or a y → a j Ensure that the existing attack plan is not disrupted; otherwise, update the current attack plan. Plan Continue to evaluate the target list Goallist The complete attack plan is obtained until the target list is empty. Here, the sequence constraint combination refers to the enumeration and filtering of all possible sequential relationships between pairs of actions in the current attack plan (e.g., action A must be executed before action B); the current causal chain is the current action. a i The logical execution path, consisting of the constraints and their dependencies, is used to verify whether the addition of constraints disrupts the feasibility of the action sequence.

[0042] S5. Construct an attack graph based on a complete attack plan that can achieve the attack objective; the attack graph contains AND nodes and OR nodes; where an AND node is an action node that can trigger an attack behavior only when multiple parent nodes are satisfied simultaneously; an OR node is an action node that can trigger an attack behavior only when any parent node is satisfied.

[0043] Based on the partial order programming inference engine described above, in topological structures such as... Figure 3 An attack graph is constructed in the network range shown below. The service configuration and vulnerability information of this network range are shown in Tables 4 and 5.

[0044] Table 4 Service Configuration Table

[0045] Table 5 Vulnerability Information Table

[0046] The attack graph constructed after inference using a partial order programming inference engine based on the STRIPS language is as follows: Figure 4 As shown, blue nodes represent the initial state, red nodes are action nodes, and green nodes represent the updated state nodes, i.e., the list of sub-targets. It is important to note that... Figure 4 This is for illustrative purposes only and its content does not affect the understanding of the technical solution. To facilitate analysis by security personnel and simplify the representation of the attack graph, only all action nodes are retained. The simplified attack graph is as follows: Figure 5 As shown. Compared to the XSB inference engine used in MulVAL, the partial order planning inference engine based on the STRIPS language proposed in this invention achieves efficient decision-making on the order of actions by explicitly identifying and handling potential conflicts. In the inference process of MulVAL, the order relationship between multiple parent nodes is often not explicitly specified, leading to uncertainty in the inference path. This invention, through dynamic constraint management and conflict resolution, can effectively determine the priority order between nodes, thereby overcoming the challenge caused by the undefined order of multiple parent nodes and significantly improving the determinism and planning efficiency in the attack graph inference process. Figure 6 As shown, lateral movement of a node (node ​​5) requires two preconditions: obtaining administrator credentials for the system domain account (node ​​3) and disabling the target host's firewall through a remote code execution vulnerability (node ​​4), thereby further exploiting the EternalBlue vulnerability to achieve remote lateral movement. However, the exploitation of the CVE-2018-0886 remote code execution vulnerability (node ​​4) requires administrator privileges. Based on the black path in the graph, nodes 2 to 3 and 4 constitute two different paths, and their execution order is unclear. According to the algorithm proposed in this paper, when traversing to node 4, "requires administrator privileges" will be added as a new sub-target to the target list, thus constraining path selection in the subsequent attack order decision-making process. Therefore, a new constraint edge will appear, pointing from node 2 to node 4. In summary, the partial order planning inference engine based on the STRIPS language proposed in this invention improves the efficiency and accuracy of attack graph inference by precisely controlling the order decision-making and constraint management of attack steps, providing effective technical support for automated red team testing.

[0047] S6. Combine the DREAD threat measurement model and the CVSS vulnerability assessment system to construct an atomic attack behavior assessment model, including technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators.

[0048] Traditional single-point threat assessments typically use the CVSS vulnerability scoring system for modeling. However, in complex internal network environments, these methods lack personalization and practicality, making it difficult to accurately reflect the actual exploitation difficulty of vulnerabilities. Therefore, this application designs a risk assessment model that better reflects real-world penetration testing scenarios. Combining the DREAD threat measurement model and the CVSS vulnerability assessment system, a comprehensive vulnerability assessment framework—the atomic attack behavior assessment model—is constructed. This model includes four main indicators: technical feasibility, vulnerability harmfulness, vulnerability impact, and network depth. The first three indicators are based on the CVSS scoring system and are used to quantify the exploitation difficulty and impact of vulnerabilities. Specifically, the technical feasibility indicator is assessed based on access requirements, including high, medium, and low scores. The vulnerability harmfulness indicator is assessed from three aspects: vulnerability confidentiality, vulnerability integrity, and vulnerability availability, each including high, medium, and low scores. The vulnerability impact indicator is assessed using the vulnerability impact score (CVSS.impactScore) of the CVSS vulnerability assessment system.

[0049] The final network depth metric measures the number of proxy layers required for an attacker to reach the target host during penetration testing. A deeper proxy layer indicates a more complex network environment and greater attack difficulty. Experiments show that proxy depth significantly increases communication latency, leading to network instability and impacting vulnerability exploitation effectiveness. For example, in a three-layer proxy environment, the single-round communication time for logging into the MySQL database exceeds 2 seconds, making it difficult to complete a large number of credential stuffing-like login requests in a short time, severely affecting the efficiency of vulnerability exploitation. Therefore, this application introduces proxy depth as a key evaluation metric to comprehensively quantify the actual impact of the network environment on vulnerability exploitation. The expression for the impact of proxy depth is: T level = e (-0.5⋅(level- 1)) ,in, level This refers to the proxy depth. Assume a network environment where host3 is the entry point, connected to the internet and also connected to host4's internal network server. The attacker exists on the internet, so the network proxy depth for the attacker reaching host3 is 1. To further attack host4 on the internal network, the attacker needs to set up a proxy on host3 to forward host4's traffic to the attacker. Therefore, when the attacker attacks host4, its proxy depth is 2.

[0050] Therefore, the atomic attack behavior evaluation model can be expressed as: T impact = 10×( α × T L + β× T p + γ × T CIA + δ × T level ),in, T L Due to the vulnerability, T p As a technical feasibility indicator, T level This is a measure of network depth. T CIA The severity of the vulnerability is indicated as follows: T CIA = [1 - (1 - T C ) × (1 - T I ) × (1 - T A )], T C For the sake of vulnerability confidentiality, T I For vulnerability integrity, T A To assess vulnerability availability.

[0051] S7. Use the atomic attack behavior assessment model to assess the threat of each attack path in the attack graph, and use an improved depth-first search-based attack path filtering algorithm to filter the attack graph after threat assessment to obtain the optimal attack path.

[0052] Furthermore, an atomic attack behavior assessment model is first used to assess the threat of each attack path in the attack graph, specifically: To calculate the risk value of an attack path, it is necessary to consider the individual risks of all nodes and the cumulative risk propagation between nodes. Therefore, the risk value of a single node is first calculated using the atomic attack behavior evaluation model constructed above. Then, based on the node type, the risk values ​​of nodes in the attack path are updated by substituting them into the following two risk propagation formulas. Since the attack graph is defined as containing two types of nodes: one type is AND nodes, which require multiple parent nodes to simultaneously satisfy a condition to trigger the next attack action, the risk value of AND nodes in the attack path is updated as follows: , in, p ( and i ) is the first in the updated attack path i Each node represents a risk value related to the node. Parents ( andi ) is the first in the attack path i Each node is a set of parent nodes of the node. p ( P j )for Parents ( and i ) j The risk value of each parent node.

[0053] Another type of node is the OR node, which means that the next attack action can be carried out when the condition of any parent node is met. For OR nodes in the attack path, their risk value is updated as follows: , in, p ( or i ) is the first in the updated attack path i Each node represents a risk value for another node. Parents ( or i ) is the first in the attack path i Each node is a set of parent nodes of another node. p ( P j )for Parents ( or i ) j The risk value of each parent node.

[0054] After the update, the risk values ​​of nodes in each attack path are accumulated to obtain the threat value of each attack path.

[0055] Furthermore, after a comprehensive risk assessment of the attack graph, this invention proposes a path analysis method based on a recursive algorithm, aiming to comprehensively evaluate all potential attack paths in the complete attack graph. Unlike traditional recursive search methods based on node trees, the attack graph contains numerous AND and OR nodes, which significantly influence the path structure. In path partitioning, for OR nodes, only the path of any one parent node needs to be considered as a potential threat path. In contrast, AND nodes cause parallel branches to emerge between multiple parent nodes, with each path accumulating conditions at its respective branch points. These branching and merging phenomena make the attack path structure non-linear, and correct path identification depends on the complex logical relationships between nodes. Traditional recursive search methods often suffer from missed detections or misjudgments when handling these path branches and merges. To address this challenge, this paper proposes an improved recursive algorithm aimed at accurately identifying and separating potential attack paths. This algorithm systematically traverses the nodes and edges in the attack graph, capturing branching and merging phenomena in the paths, ensuring that all potential paths are fully considered. Specifically, as... Figure 7 As shown, the improved path selection algorithm based on depth-first search mainly consists of three steps: S7.2.1 First, ignoring the influence of nodes, the depth-first search (DFS) method is used to initially divide the attack paths in the attack graph to obtain the set of all attack paths.

[0056] More specifically, the initial division steps are as follows: Randomly select a target node in the attack graph as the current node. node Start path search, starting with the current node. node Add to an initially empty record path path In the middle, and initialize an empty set of attack paths. Paths ; Determine the current node node Does a parent node exist? If not, record the path. path Add to attack path set Paths The path will be recorded. path Initialize; if a parent node exists, then set the parent node as the current node. node Add to the record path and continue searching until the current node. node If there is no parent node, the path will be recorded. path Add to attack path set Paths The path will be recorded. path initialization; Randomly select another target node in the attack graph as the current node and repeat the above steps to search for paths until all target nodes in the attack graph have been searched, thus obtaining a set of all attack paths. Paths .

[0057] S7.2.2 Then, for all attack path sets Paths The attack paths are organized by grouping them according to their start and target nodes. Each group contains a set of attack paths with the same start and target nodes, resulting in all attack path groups. group _ paths .

[0058] S7.2.3 Finally, based on capturing path branches, a path merging algorithm with recursive thinking is introduced. Based on the logical constraints of nodes, all attack path groups are deduplicated and merged. By merging the parallel paths caused by nodes, all possible attack paths are finally calculated to obtain the optimal attack path.

[0059] More specifically, the steps for deduplication and merging are as follows: Determine if the number of paths in each attack path group is 1. If the number of paths is not 1, check if the nodes in each attack path group are AND nodes. If they are AND nodes, merge their parent nodes until the number of paths in each attack path group is 1. Organize all attack path groups with a number of paths of 1, and the deduplicated and merged attack path is the optimal attack path.

[0060] Using the above algorithm, we can Figure 5 The attack graph is divided into four valid and feasible attack paths, as shown in Table 6 below. The evaluation metric is the threat value of each attack path.

[0061] Table 6 Attack Path Filtering Table

[0062] As shown in Table 6, paths 1 and 2 increase attack complexity due to the need to traverse deeper network proxy layers; while paths 2 and 4 have shorter attack steps compared to paths 1 and 3. Based on the evaluation scheme proposed in this invention, the path threat ranking is: path 4 > path 2 > path 3 > path 1. This indicates that, considering both network depth and attack difficulty, path 4 is more threatening because it not only has a shorter attack path but also traverses fewer network proxy layers, effectively revealing its higher threat level.

[0063] S8. Perform automated penetration testing based on the optimal attack path to verify the network security of the target system.

[0064] Finally, the optimal attack path is used as input for automated penetration testing, automatically executing each attack step within the path to verify the vulnerability and security of the target system. Employing an attack graph-based path reasoning algorithm, it dynamically identifies and executes key nodes and paths in the attack graph, while continuously updating the malicious payload and deploying malicious scripts through a feedback mechanism, thus ensuring the accuracy and adaptability of the attack path. Ultimately, by progressively executing the attack path, not only are security weaknesses in the target network verified, but the attack path can also be adjusted and optimized based on the actual execution results, improving the effectiveness and efficiency of penetration testing.

[0065] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0066] Based on the same idea as the automated red team penetration testing method based on partial order programming in the above embodiments, this invention also provides an automated red team penetration testing system based on partial order programming. This system can be used to execute the aforementioned automated red team penetration testing method based on partial order programming. For ease of explanation, the structural diagram of the embodiment of the automated red team penetration testing system based on partial order programming only shows the parts related to the embodiments of this invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0067] like Figure 8 As shown, another embodiment of the present invention provides an automated red team penetration testing system based on partial order programming, including an information acquisition module, an action extraction module, a plan construction module, a space definition module, an attack graph construction module, an evaluation construction module, an evaluation and screening module, and a penetration testing module; The information collection module is used to extract the status information of the target system using log collection tools and vulnerability scanning tools to obtain a status set; the status set includes network connection, sensitive data, system information, service information and configuration information, etc. The action extraction module is used to construct action rules and extract action sets based on the descriptions of tactics and references in the vulnerability report; the action set includes action name, action conditions, and impact, etc. The space definition module is used to define the target space, state space, and action space of the attack graph. The target space is preset with an attack objective, which includes multiple sub-targets. The state space is constructed based on a set of states, and the action space is constructed based on a set of actions. The plan building module uses a partial order planning reasoning engine based on the STRIPS language to recursively reason about the attack objectives in the target space based on the state space and action space, and adds actions that can achieve the high attack objectives and the order constraints between updating actions to build a complete attack plan that can achieve the attack objectives. The attack graph construction module is used to construct an attack graph based on a complete attack plan that can achieve the attack objective. The attack graph contains AND nodes and OR nodes. Among them, an AND node is an action node that requires multiple parent nodes to satisfy a condition to trigger an action representing an attack behavior; an OR node is an action node that requires any parent node to satisfy a condition to trigger an action representing an attack behavior. The assessment building module is used to combine the DREAD threat measurement model and the CVSS vulnerability assessment system to build an atomic attack behavior assessment model, including technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators. The evaluation and filtering module is used to evaluate the threat of each attack path in the attack graph using the atomic attack behavior evaluation model, and to filter the attack graph after threat evaluation using an improved depth-first search-based attack path filtering algorithm to obtain the optimal attack path. The penetration testing module is used to perform automated penetration testing based on the optimal attack path to verify the network security of the target system.

[0068] It should be noted that the automated red team penetration testing system based on partial order programming of the present invention corresponds one-to-one with the automated red team penetration testing method based on partial order programming of the present invention. The technical features and beneficial effects described in the embodiments of the automated red team penetration testing method based on partial order programming described above are applicable to the embodiments of the automated red team penetration testing system based on partial order programming. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0069] Furthermore, in the above embodiments of the automated red team penetration testing system based on partial order programming, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or software implementation convenience. That is, the internal structure of the automated red team penetration testing system based on partial order programming is divided into different program modules to complete all or part of the functions described above.

[0070] like Figure 9 As shown, in one embodiment, an electronic device is provided for implementing an automated red team penetration testing method based on partial order programming. The electronic device may include a first processor, a first memory, and a bus, and may also include a computer program stored in the first memory and executable on the first processor, such as an automated red team penetration testing program based on partial order programming.

[0071] The first memory includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the first memory can be an external storage device of the electronic device, such as a plug-in portable hard drive, Smart Media Card (SMC), Secure Digital (SD) card, Flash Card, etc. Furthermore, the first memory can include both internal and external storage units of the electronic device. The first memory can be used not only to store application software and various types of data installed on the electronic device, such as the code of an automated red team penetration testing program based on partial order programming, but also to temporarily store data that has been output or will be output.

[0072] In some embodiments, the first processor may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory (e.g., automated red team penetration testing programs) and calls data stored in the first memory to perform various functions of the electronic device and process data.

[0073] Figure 9 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 9 The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0074] The automated red team penetration testing program stored in the first memory of the electronic device is a combination of multiple instructions. When run in the first processor, it can achieve the following: Log collection tools and vulnerability scanning tools are used to extract the state information of the target system to obtain a state set, including network connection, sensitive data, system information, service information and configuration information, etc. Based on the descriptions of tactics and techniques and references in the vulnerability report, action rules are constructed and action sets are extracted, including action names, action conditions and effects, etc. Define the target space, state space, and action space of the attack graph; the target space is pre-defined with an attack objective, which includes multiple sub-targets; the state space is constructed based on a set of states, and the action space is constructed based on a set of actions; Using a partial order planning reasoning engine based on the STRIPS language, the attack objective in the target space is reasoned step by step in a recursive manner based on the state space and action space. Actions that can achieve the attack objective and the order constraints between updating actions are added to construct a complete attack plan that can achieve the attack objective. An attack graph is constructed based on a complete attack plan that can achieve the attack objective. The attack graph contains AND nodes and OR nodes. An AND node is an action node that requires multiple parent nodes to satisfy a condition to trigger an action representing an attack. An OR node is an action node that requires any parent node to satisfy a condition to trigger an action representing an attack. An atomic attack behavior assessment model is constructed by combining the DREAD threat measurement model and the CVSS vulnerability assessment system. The atomic attack behavior assessment model includes technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators. The atomic attack behavior assessment model is used to assess the threat of each attack path in the attack graph, and an improved attack path filtering algorithm based on depth-first search is used to filter the attack graph after threat assessment to obtain the optimal attack path. Automated penetration testing is used to verify the cybersecurity of the target system based on the optimal attack path.

[0075] Furthermore, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0076] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0077] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0078] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. An automated red team penetration testing method based on partial order programming, characterized in that, The method includes the following steps: Log collection tools and vulnerability scanning tools are used to extract the state information of the target system to obtain a state set; the state set includes network connection, sensitive data, system information, service information and configuration information; Based on the descriptions of tactics and techniques and references in the vulnerability report, action rules are constructed and action sets are extracted; the action set includes action name, action condition and impact; Define the target space, state space, and action space of the attack graph; the target space is preset with an attack objective; the attack objective includes multiple sub-targets; the state space is constructed based on a set of states, and the action space is constructed based on a set of actions; Using a partial order planning reasoning engine based on the STRIPS language, the attack objective in the target space is reasoned step by step in a recursive manner based on the state space and action space. Actions that can achieve the attack objective and the order constraints between updating actions are added to construct a complete attack plan that can achieve the attack objective. An attack graph is constructed based on a complete attack plan that can achieve the attack objective. The attack graph includes AND nodes and OR nodes. An AND node is an action node that requires multiple parent nodes to satisfy a condition simultaneously to trigger an attack behavior. An OR node is an action node that requires any parent node to satisfy a condition to trigger an attack behavior. An atomic attack behavior assessment model is constructed by combining the DREAD threat measurement model and the CVSS vulnerability assessment system. The atomic attack behavior assessment model includes technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators. The atomic attack behavior assessment model is used to assess the threat of each attack path in the attack graph, and an improved attack path filtering algorithm based on depth-first search is used to filter the attack graph after threat assessment to obtain the optimal attack path. Automated penetration testing is used to verify the cybersecurity of the target system based on the optimal attack path.

2. The automated red team penetration testing method based on partial order programming according to claim 1, characterized in that, The working process of the partial order programming inference engine based on the STRIPS language is as follows: Load multiple sub-targets of any attack objective in the target space into the target list, and initialize an empty current attack plan and an empty attack plan set; Check if the target list is empty; if so, end the construction of the current attack plan. Otherwise, select an incomplete sub-target from the target list, traverse the action space to see if there is an action that can achieve the incomplete sub-target, and if it can be achieved, add the preconditions of the action to the current attack plan, update the order constraints of the action, and add the preconditions of the action to the target list according to the order constraints of the action. Otherwise, skip the current sub-target and proceed to the next sub-target for evaluation; Iterate through all possible sequential constraint combinations of actions in the current attack plan, and determine whether there is a combination that threatens the causal chain of the current action. If it exists, select the sequential constraint combination that does not pose a threat; otherwise, update the current attack plan and continue to judge the target list until the target list is empty to obtain the complete attack plan with the attack objective. The sequential constraint combination refers to the sequential relationship constraint between any two actions in the current attack plan; the causal chain is the logical execution path formed by the current action and its dependencies.

3. The automated red team penetration testing method based on partial order programming according to claim 1, characterized in that, The technical feasibility index is evaluated based on access requirements, including three evaluation scores: high, medium, and low. The vulnerability harmfulness index is evaluated from three aspects: vulnerability confidentiality, vulnerability integrity, and vulnerability availability, with each aspect including three evaluation scores: high, medium, and low. The vulnerability impact index is evaluated using a vulnerability impact score; The network depth metric incorporates proxy depth for evaluation, and is calculated as follows: T level = e (-0.5⋅(level - 1)) ,in, level Proxy depth is used to measure the number of proxy layers an attacker needs to reach the target host during a penetration test. The atomic attack behavior evaluation model is expressed as follows: T impact = 10×( α × T L + β × T p + γ × T CIA + δ × T level ), in, T L Due to the vulnerability, T p As a technical feasibility indicator, T level This is a measure of network depth. T CIA The severity of the vulnerability is indicated as follows: T CIA = [1 - (1 - T C ) × (1 - T I ) × (1 - T A )], T C For the sake of vulnerability confidentiality, T I For vulnerability integrity, T A To assess vulnerability availability.

4. The automated red team penetration testing method based on partial order programming according to claim 1, characterized in that, The use of the atomic attack behavior assessment model to assess the threat of each attack path in the attack graph is specifically as follows: The risk value of each node in each attack path in the attack graph is calculated using an atomic attack behavior model. Update the risk value of nodes in the attack path according to node type, where: For nodes in the attack path, their risk values ​​are updated as follows: ， in, p ( and i ) is the first in the updated attack path i Each node represents a risk value related to the node. Parents ( and i ) is the first in the attack path i Each node is a set of parent nodes of the node. p ( P j )for Parents ( and i ) j Risk value of each parent node; For any node in the attack path, its risk value is updated as follows: ， in, p ( or i ) is the first in the updated attack path i Each node represents a risk value for another node. Parents ( or i ) is the first in the attack path i Each node is a set of parent nodes of another node. p ( P j )for Parents ( or i ) j Risk value of each parent node; After the update, the risk values ​​of nodes in each attack path are accumulated to obtain the threat value of each attack path.

5. The automated red team penetration testing method based on partial order programming according to claim 1, characterized in that, The improved depth-first search-based path filtering algorithm, which employs attack enhancements, filters the attack graph after threat assessment to obtain the optimal attack path. Specifically: A depth-first search method is used to initially divide the attack paths in the attack graph, resulting in a set of all attack paths. Organize all attack path sets and group all paths with the same starting node and target node into one group to obtain all attack path groups; Based on the logical constraints of the nodes, all attack path groups are deduplicated and merged to select the optimal attack path.

6. The automated red team penetration testing method based on partial order programming according to claim 5, characterized in that, The initial division of attack paths in the attack graph using a depth-first search method is as follows: Randomly select a target node in the attack graph as the current node to start the path search, add the current node to the initially empty record path, and initialize an empty attack path set; Determine if the current node has a parent node. If not, add the recorded path to the attack path set and initialize the recorded path. If the parent node exists, add the parent node as the current node to the recorded path and continue searching until the current node has no parent node. Then, add the recorded path to the attack path set and initialize the recorded path. Randomly select a target node in the attack graph as the current node and repeat the path search until all target nodes in the attack graph have been searched, thus obtaining a set of all attack paths.

7. The automated red team penetration testing method based on partial order programming according to claim 5, characterized in that, The process of deduplicating and merging all attack path groups based on logical constraints with nodes specifically involves: Determine if the number of paths in each attack path group is 1. If the number of paths is not 1, then check if the node in each attack path group is an AND node. If it is an AND node, then merge its parent node until the number of paths in each attack path group is 1. Organize all attack path groups with a path count of 1, and the deduplicated and merged attack path is the optimal attack path.

8. An automated red team penetration testing system based on partial order programming, characterized in that, The automated red team penetration testing method based on partial order programming as described in any one of claims 1-7 includes an information acquisition module, an action extraction module, a space definition module, a plan construction module, an attack graph construction module, an evaluation construction module, an evaluation and screening module, and a penetration testing module. The information collection module is used to extract the status information of the target system using log collection tools and vulnerability scanning tools to obtain a status set; the status set includes network connection, sensitive data, system information, service information and configuration information; The action extraction module is used to construct action rules and extract action sets based on the descriptions of tactics and references in the vulnerability report; the action set includes action name, action conditions and impact; The space definition module is used to define the target space, state space, and action space of the attack graph; the target space has a preset attack objective; the attack objective includes multiple sub-targets; the state space is constructed based on a set of states, and the action space is constructed based on a set of actions; The plan is constructed by using a partial order planning reasoning engine based on the STRIPS language to recursively reason the attack objectives in the target space based on the state space and action space, and adding actions that can achieve the attack objectives and order constraints between update actions to construct a complete attack plan that can achieve the attack objectives. The attack graph construction module is used to construct an attack graph based on a complete attack plan that can achieve the attack objective; the attack graph includes AND nodes and OR nodes; the AND node is an action node that can trigger an attack behavior only when multiple parent nodes are satisfied simultaneously; the OR node is an action node that can trigger an attack behavior only when any parent node is satisfied. The assessment module is used to construct an atomic attack behavior assessment model by combining the DREAD threat measurement model and the CVSS vulnerability assessment system; the atomic attack behavior assessment model includes technical feasibility indicators, vulnerability harmfulness indicators, vulnerability impact indicators, and network depth indicators; The evaluation and filtering module is used to evaluate the threat of each attack path in the attack graph using the atomic attack behavior evaluation model, and to filter the attack graph after threat evaluation using an improved depth-first search-based attack path filtering algorithm to obtain the optimal attack path. The penetration testing module is used to perform automated penetration testing based on the optimal attack path to verify the network security of the target system.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor to enable the at least one processor to perform the automated red team penetration testing method based on partial order programming as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the automated red team penetration testing method based on partial order programming as described in any one of claims 1-7.

Images