A network penetration data generation method, device, electronic equipment and program product

Abstract

The application relates to the technical field of network penetration testing, and discloses a network penetration data generation method and device, an electronic device and a computer program product. The method sets a target range task intelligent agent, a penetration attack intelligent agent and a virtual target range intelligent agent. The target range task intelligent agent is responsible for generating a target range task of network penetration. The penetration attack intelligent agent generates a penetration operation instruction based on the target range task, and sends the penetration operation instruction to the virtual target range intelligent agent. The virtual target range intelligent agent constructs a virtual target range environment based on the target range task, executes the penetration operation instruction in the virtual target range environment to obtain a penetration operation result, and returns the penetration operation result to the penetration attack intelligent agent. The penetration attack intelligent agent gradually advances an attack link according to the penetration operation result until the penetration attack process ends, and generates corresponding penetration data. The method can generate a sufficient amount of penetration data, thereby meeting the training requirements of a network penetration large model.

Description

Technical Field

[0001] This application relates to the field of network penetration testing technology, and in particular to a method, apparatus, electronic device, and computer program product for generating network penetration data. Background Technology

[0002] With the increasing complexity and intelligence of network attack and defense, automated network penetration testing based on large models has gradually become a research hotspot. To improve the ability of large network penetration models to perform penetration tasks, a large amount of high-quality penetration data is needed as a training dataset for optimizing the models. Currently, penetration data is mainly collected using real-world test environments such as attack and defense drills and Capture The Flag (CTF) platforms, or partially generated through manual annotation and scripted rules. However, due to the limited number of real-world test environments and the relatively small scale of penetration data generated through manual annotation and scripted rules, it is difficult to obtain a sufficient amount of penetration data to meet the training requirements of large network penetration models. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method, apparatus, electronic device, and computer program product for generating network penetration data, which can generate a sufficient amount of penetration data to meet the training requirements of large-scale network penetration models.

[0004] The first aspect of this application provides a method for generating network penetration data, including:

[0005] Generate network penetration target range tasks through target range task intelligent agents;

[0006] The penetration attack agent generates penetration operation instructions based on the target range task and sends the penetration operation instructions to the virtual target range agent.

[0007] The virtual range agent constructs a virtual range environment based on the range task, executes penetration operation instructions in the virtual range environment to obtain penetration operation results, and returns the penetration operation results to the penetration attack agent.

[0008] By using a penetration attack agent, the attack chain is progressively advanced based on the results of the penetration operation until the penetration attack process ends, generating corresponding penetration data.

[0009] The technical solution of this application embodiment sets up a target range task agent, a penetration attack agent, and a virtual target range agent. The target range task agent is responsible for generating network penetration target range tasks. The penetration attack agent generates penetration operation instructions based on the target range tasks and sends these instructions to the virtual target range agent. The virtual target range agent constructs a virtual target range environment based on the target range tasks, executes the penetration operation instructions in the virtual target range environment to obtain penetration operation results, and returns the results to the penetration attack agent. The penetration attack agent then progressively advances the attack chain based on the penetration operation results until the penetration attack process ends, generating corresponding penetration data. This process continuously generates target range tasks through the target range task agent, constructs a virtual target range environment based on the target range tasks through the virtual target range agent, and generates corresponding penetration data through the interaction between the penetration attack agent and the virtual target range agent in the virtual target range environment. The collaboration of these three agents eliminates the dependence on a real target range, continuously generating a sufficient amount of penetration data to meet the training requirements of large-scale network penetration models.

[0010] In one implementation of this application, the range task includes task description information and interaction rules; a virtual range environment is constructed based on the range task through a virtual range agent, including:

[0011] Based on the task description information and interaction rules, construct target range task prompts;

[0012] A virtual target range environment is constructed using a virtual target range agent based on target range task prompts.

[0013] In one implementation of this application, the task description information includes attack target information, vulnerability type information, and service configuration information; a virtual range environment is constructed based on the range task prompts using a virtual range agent, including:

[0014] The virtual range agent parses the target information, vulnerability type information, service configuration information, and interaction rules of the target range task. Based on the target information, vulnerability type information, service configuration information, and interaction rules, the agent determines the target, vulnerability type, service configuration, and task scenario of the target range task to construct a virtual range environment.

[0015] In one implementation of this application, the method further includes:

[0016] Determine the results of multiple penetration attacks by the penetration attack agent targeting the range mission;

[0017] Based on the results of multiple penetration attacks, the task generation strategy of the target range task agent is adjusted to ensure that the difficulty of the target range tasks generated by the target range task agent is adapted to the penetration capability of the penetration attack agent.

[0018] In one implementation of this application, the task generation strategy of the target range task agent is adjusted based on the results of multiple penetration attacks, including:

[0019] Based on the results of multiple penetration attacks, determine the number of successful penetration attacks and the number of failed penetration attacks;

[0020] A reward function is constructed based on the number of successful and failed penetration attacks; the smaller the difference between the number of successful and failed penetration attacks, the larger the value of the reward function.

[0021] Based on the reward function, a reinforcement learning method is used to adjust the task generation strategy of the target range task agent.

[0022] In one implementation of this application, the penetration data includes successful penetration paths and failed penetration paths; after generating the corresponding penetration data, the method further includes:

[0023] Using successful penetration paths as positive reward samples and failed penetration paths as negative reward samples, a reinforcement learning method is used to adjust the penetration path generation strategy of the penetration attack agent.

[0024] In one implementation of this application, the target range mission agent, the penetration attack agent, and the virtual target range agent are distinguished by preset role prompts.

[0025] A second aspect of this application provides a network penetration data generation apparatus, comprising:

[0026] The target range mission generation module is used to generate network penetration target range missions through the target range mission agent;

[0027] The penetration operation instruction generation module is used to generate penetration operation instructions based on the target range task through the penetration attack agent, and send the penetration operation instructions to the virtual target range agent.

[0028] The penetration operation instruction execution module is used to construct a virtual target range environment based on the target range task through a virtual target range agent, execute penetration operation instructions in the virtual target range environment to obtain penetration operation results, and return the penetration operation results to the penetration attack agent.

[0029] The penetration data generation module is used to generate corresponding penetration data by progressively advancing the attack chain based on the penetration operation results through the penetration attack agent until the penetration attack process ends.

[0030] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network penetration data generation method provided in the first aspect of this application.

[0031] A fourth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the network penetration data generation method provided in the first aspect of this application.

[0032] A fifth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network penetration data generation method provided in the first aspect of this application.

[0033] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0034] Figure 1 This is a flowchart of a network penetration data generation method provided in an embodiment of this application;

[0035] Figure 2 This is a schematic diagram illustrating the operational principle of generating a target range task according to an embodiment of this application;

[0036] Figure 3 This is a schematic diagram illustrating the operational principle of generating penetration data according to an embodiment of this application;

[0037] Figure 4 This is a schematic diagram illustrating the overall operational principle of the network penetration data generation method provided in this application embodiment;

[0038] Figure 5 This is a schematic diagram of the structure of a network penetration data generation device provided in an embodiment of this application;

[0039] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application can also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail. Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only for distinguishing descriptions and should not be construed as indicating or implying relative importance.

[0041] Network penetration testing is a systematic attack technique that uses technical means to break through network defense systems. It encompasses two attack dimensions: technical penetration and information penetration. As an important method for network security assessment, network penetration testing verifies system weaknesses by simulating malicious attack behaviors, covering standardized steps such as information gathering, vulnerability analysis, and privilege escalation. With the development of artificial intelligence technology, large-scale network penetration models have been widely used in automated network penetration testing. However, large-scale network penetration models require a large amount of high-quality penetration data for training, while the number of existing real-world test ranges is limited, making it difficult to provide sufficient penetration data and thus failing to meet the training requirements of large-scale network penetration models.

[0042] To address the aforementioned technical problems, this application proposes a method, apparatus, electronic device, and computer program product for generating network penetration data. By utilizing the collaboration of three intelligent agents, it can eliminate dependence on real-world target environments and continuously generate a sufficient amount of penetration data, thereby meeting the training requirements of large-scale network penetration models. For more specific technical implementation details of this application's embodiments, please refer to the various method embodiments described below.

[0043] It should be understood that the implementing entity of the various method embodiments proposed in this application can be various types of electronic devices, such as mobile phones, tablets, desktop computers, wearable devices, medical devices, augmented reality (AR) / virtual reality (VR) devices, laptops, ultra-mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), large-screen TVs, etc. The embodiments of this application do not impose any restrictions on the specific type of electronic device.

[0044] Please see Figure 1 This application illustrates a method for generating network penetration data according to an embodiment of the present application, comprising:

[0045] 101. Generate network penetration target range tasks through target range task agents;

[0046] The technical solution of this application embodiment pre-sets three independent intelligent agents in the network penetration large-scale model training system. An intelligent agent refers to a computer program with autonomy, learning ability, and reasoning ability; it is an intelligent entity capable of perceiving environmental information, making decisions, and executing actions. These three independent intelligent agents are a target range task intelligent agent, a penetration attack intelligent agent, and a virtual target range intelligent agent. The target range task intelligent agent is responsible for generating target range tasks of appropriate difficulty based on the penetration attack intelligent agent's penetration capability level. Its core logic relies on the large-scale model's task generation capability and can be continuously optimized through training. The penetration attack intelligent agent is responsible for generating penetration operation instructions for a given target range task and gradually advancing the attack chain based on the penetration operation results fed back by the virtual target range intelligent agent to obtain corresponding penetration data. The virtual target range intelligent agent is responsible for constructing and simulating the target range environment, receiving and executing the penetration operation instructions from the penetration attack intelligent agent, and feeding back the corresponding penetration operation results.

[0047] In practice, both target range agents and penetration attack agents can use trainable open-source large models as a foundation, enabling them to improve their capabilities and adaptability through iterative optimization. Virtual target range agents, on the other hand, can use closed-source large models with superior performance to the former two, thus ensuring the complexity of the target range environment and the reliability of feedback, enabling them to accurately characterize the service operation status, vulnerability features, and interaction logic of complex network systems.

[0048] In one implementation of this application, the target range mission agent, the penetration attack agent, and the virtual target range agent are distinguished by preset role prompts.

[0049] To ensure clear and unambiguous functional identities among the three agents during system interactions, the target range agent, the penetration attack agent, and the virtual target range agent can be distinguished using pre-defined role prompts. For example, the target range agent can be assigned the role of "Target Range Question Setter," with the prompt "Your role is the Target Range Question Setter..." added to the input prompt. Similarly, the penetration attack agent can be assigned the role of "Penetration Attacker," and the virtual target range agent can be assigned the role of "Virtual Target Range Simulator." By assigning distinct role prompts to each agent, their roles and responsibilities are clearly defined during collaborative interactions, ensuring the accuracy of the results.

[0050] The target range task agent can generate network penetration target range tasks, and the description of each target range task can be broken down into multiple parts to ensure the completeness and operability of the task description. Specifically, the description of each target range task can be broken down into attack target information, vulnerability type information, and service configuration information. Attack target information defines the target system environment of the penetration task, typically including the runtime background of web applications, databases, and related supporting services in the virtual target range. This information provides basic runtime environment information for the attack target, allowing the penetration attack agent to carry out penetration attack behavior within a clear target context. Vulnerability type information specifies the types of vulnerabilities that may exist in the target range to simulate real network attack scenarios. Specific vulnerability types can include, but are not limited to, SQL injection, cross-site scripting (XSS), command injection, file inclusion, and cross-site request forgery (CSRF). Through diverse vulnerability type design, the penetration attack agent can learn to cover more attack paths and exploitation methods. Service configuration information is used to set the underlying service operation details of the target environment, including port opening status, service version information, permission configuration, and default account and password information. This information can provide the penetration attack agent with a service state that is close to that of a real network system, ensuring the authenticity and operability of the penetration testing process.

[0051] In practice, preset prompts can be input into the target range task agent. Guided by these prompts, the agent can automatically generate and output corresponding target range tasks based on its built-in task generation logic. As an example, the content of a prompt input into the target range task agent is as follows:

[0052] You are a virtual penetration testing environment creator. Your task is to generate a complete virtual penetration testing environment task description for use by a penetration attacker model for attack and defense training. Please strictly adhere to the following output structure and do not add any extra explanations. Output Requirements: Attack target information, operating system (specify version, simulated environment is sufficient), service (e.g., web service, FTP, SSH, etc., version number must be specified), database (if it exists, specify type, version, and port), web application or other entry point information (including IP and port); vulnerability type information, specify the vulnerable interface or service entry point (e.g., URL, port number, service configuration), vulnerability description (briefly explain the cause of the vulnerability), vulnerability exploitation target (clearly state the information or breakthrough point that the attacker can obtain); service configuration information, default username / password (if relevant), pre-configured database and table structure (if a database is involved), sample data (e.g., username, password hash, etc.). Constraints: The output must be specific and actionable, ensuring that the attacker can perform penetration attempts based on the description. The vulnerabilities included in the output should be common vulnerabilities in reality (e.g., SQL injection, weak passwords, file upload vulnerabilities, command injection, deserialization vulnerabilities, etc.). Avoid generating irrelevant explanatory text; keep the output concise and clear; and ensure that each generation contains only one vulnerability scenario.

[0053] After inputting the above-mentioned prompts into the target range task agent, the task description information for a target range task involving an "SQL injection vulnerability" generated by the target range task agent is as follows:

[0054] The target environment includes a web service with an SQL injection vulnerability, and the attacker's goal is to obtain sensitive data through this vulnerability.

[0055] [Attack Target Information]

[0056] Operating System: Ubuntu 20.04 (Emulated)

[0057] - Services: Apache 2.4, PHP 7.4

[0058] - Database: MySQL 5.7, listening port 3306

[0059] - Web application: running on 10.0.0.5:8080

[0060] [Vulnerability Type Information]

[0061] - Login interface: `http: / / 10.0.0.5:8080 / login.php`

[0062] - Vulnerability Description: This interface does not effectively filter the input parameter `username`, and contains a classic **Boolean-based blind SQL injection vulnerability**.

[0063] - Exploitation Target: Attackers can use injection statements to obtain the user table `users` in the database, which stores the `username` and `password_hash` fields.

[0064] [Service Configuration Information]

[0065] - MySQL default user: `root`, password: `root123`

[0066] - Pre-built database: `ctf_demo`

[0067] -Table structure:

[0068] Table name: `users`

[0069] -Fields: `id (int)`, `username (varchar)`, `password_hash (varchar)`

[0070] Example data:

[0071] - (1, 'admin', '5f4dcc3b5aa765d61d8327deb882cf99')

[0072] - (2, 'guest', '084e0343a0486ff05530df6c705c8bb4')

[0073] Based on the generated mission description information of the target range task, the target range task agent can further establish interaction rules, thereby forming a complete target range task prompt, which includes both the mission description information and the interaction rules. Subsequently, inputting the target range task prompt into the virtual target range agent can guide its interactive operations.

[0074] As an example, a description of an interaction rule established by the target range mission agent is as follows:

[0075] Please set up an interactive Linux penetration testing environment based on the environment configuration, and return the corresponding execution results according to the input commands.

[0076] [Interaction Rules]

[0077] - When the attacker enters Linux commands, please return the simulated system terminal results;

[0078] - When an attacker accesses a web URL or sends an SQL injection statement, please return the corresponding web response or database feedback;

[0079] -If the attacker's input successfully triggers the vulnerability, please gradually disclose the corresponding data content.

[0080] By inputting target range task prompts containing the aforementioned task description information and interaction rules, the virtual target range agent can automatically construct a virtual target range environment with a web login page, SQL injection vulnerability, and database interaction based on specified configurations, and provide feedback on the interaction requests of the penetration attack agent.

[0081] As an example, Figure 2 This is a schematic diagram illustrating the operational principle of generating a target range task according to an embodiment of this application. (Refer to...) Figure 2 The task description of the target range question generated by the target range question setter (i.e., the target range task agent) includes three parts: attack target, vulnerability type and service configuration. Combining the task description with the established interaction rules can form a complete target range task prompt, which can be used to guide the interactive operation of the virtual target range agent.

[0082] 102. Through the penetration attack agent, generate penetration operation instructions based on the target range task, and send the penetration operation instructions to the virtual target range agent;

[0083] After receiving a target range task generated by the target range task agent, the penetration attack agent generates and executes penetration operation instructions step by step within the virtual target range environment constructed by the virtual target range agent, attempting to complete the attack chain. The penetration attack agent sends the generated penetration operation instructions to the virtual target range agent, which executes the instructions in the virtual target range environment and provides real-time feedback on the penetration operation results. Based on the penetration operation results, the penetration attack agent obtains the corresponding attack results or error feedback, thereby guiding its next steps.

[0084] The penetration attack process of a penetration attack agent first requires parsing the attack target. By parsing the target mission generated by the target mission agent, information about the attack target can be obtained, establishing target awareness for subsequent penetration attack operations. After identifying the attack target, corresponding prompts are input to the penetration attack agent. Based on the target parsing results and the interaction interface provided by the virtual target mission agent, the penetration attack agent will gradually generate specific penetration operation instructions.

[0085] For the above example of a target range task involving an "SQL injection vulnerability," the prompt words entered into the penetration testing agent are as follows:

[0086] You are a penetration attacker, and the current target environment is as follows:

[0087] - Web login page: http: / / 192.168.1.10:8080 / login.php

[0088] - No further information was provided; you will need to discover the system architecture and vulnerabilities step by step through probing and attacks.

[0089] This prompt typically only contains entry information such as IP address, requiring the penetration testing agent to gradually discover vulnerabilities and exploit them to complete the attack. This is closer to a real network penetration scenario.

[0090] Specifically, the penetration attack agent generates penetration operation instructions, including but not limited to: port scanning instructions, vulnerability detection instructions, and exploit code execution instructions. Among them, port scanning instructions are used to scan open ports and service information of the target system; vulnerability detection instructions are used to identify potential vulnerabilities in the target system, such as SQL injection, XSS, or command injection; exploit code execution instructions are used to construct and submit exploit payloads to trigger vulnerabilities, thereby achieving information acquisition, privilege escalation, or control operations.

[0091] For the above example of a target range task involving an "SQL injection vulnerability," the penetration testing agent generates the following penetration operation instructions:

[0092] The command `nmap -p 8080,3306 192.168.1.10` is used to scan web service and database ports to confirm whether the services are running.

[0093] curl -X POST http: / / 192.168.1.10:8080 / login.php \

[0094] -d "username=' OR '1'='1&password=anypassword"

[0095] The above instructions are used to bypass login authentication, trigger an SQL injection vulnerability, and allow the virtual target agent to return the contents of the users table in the database.

[0096] 103. Through a virtual range agent, a virtual range environment is constructed based on the range task. Penetration operation instructions are executed in the virtual range environment to obtain the penetration operation results, and the penetration operation results are returned to the penetration attack agent.

[0097] After receiving a target range task generated by the target range task agent, the virtual target range agent parses the target range task, automatically simulates and constructs the corresponding virtual target range environment, such as ports, services, and vulnerability points, and provides an interactive interface to interact with the penetration attack agent.

[0098] In one implementation of this application, the range task includes task description information and interaction rules; a virtual range environment is constructed based on the range task through a virtual range agent, including:

[0099] (1) Construct target range task prompts based on task description information and interaction rules;

[0100] (2) A virtual target range environment is constructed based on target range task prompts by using a virtual target range agent.

[0101] Referring to the preceding descriptions, the range task generated by the range task agent can include task description information and interaction rules. Based on the task description information and interaction rules, a complete range task prompt can be constructed, which can be used to guide the virtual range agent in constructing and obtaining the corresponding virtual range environment. By parsing the range task prompt, the virtual range agent can clearly identify the environmental scenario required for the range task and simulate the required virtual range environment accordingly.

[0102] In one implementation of this application, the task description information includes attack target information, vulnerability type information, and service configuration information; a virtual range environment is constructed based on the range task prompts using a virtual range agent, including:

[0103] The virtual range agent parses the target information, vulnerability type information, service configuration information, and interaction rules of the target range task. Based on the target information, vulnerability type information, service configuration information, and interaction rules, the agent determines the target, vulnerability type, service configuration, and task scenario of the target range task to construct a virtual range environment.

[0104] Referring to the previous description, the task description information can include three parts: attack target information, vulnerability type information, and service configuration information. By parsing and understanding the task prompts in the virtual range, the agent can clearly define the attack target information, vulnerability type information, service configuration information, and interaction rules of the task. Based on this, the agent can determine the attack target, vulnerability type, service configuration, and task scenario of the task, and finally construct the required virtual range environment.

[0105] After receiving penetration operation commands from the attack agent via an interactive interface, the virtual range agent executes these commands within the constructed virtual range environment, obtains the corresponding penetration operation results, and returns these results to the attack agent. Specifically, the virtual range agent can simulate a Linux shell or web service runtime environment to execute and respond to the attack agent's penetration operation commands. During the execution of the penetration operation commands, the virtual range agent generates corresponding penetration operation results based on the vulnerability characteristics and service configuration defined in the range task. These results can include successful penetration feedback (e.g., returning database query results, generating a usable web shell), failed penetration feedback (e.g., authentication failure, path not found), and error messages (e.g., incorrect command format, service not found). The virtual range agent returns the generated penetration operation results to the attack agent in real time, enabling the attack agent to continuously adjust its attack strategy based on the feedback, thereby completing the exploration and learning of the attack chain and improving the attack agent's adaptability and reasoning ability in real penetration processes.

[0106] Regarding the above example of a target range task involving an "SQL injection vulnerability," the following are examples of two types of penetration test results generated by the virtual target range agent:

[0107] Example 1: SQL injection successful

[0108] [Virtual Range Agent Feedback] Login successful, identity authentication bypassed.

[0109] Database query results:

[0110] users table:

[0111] +----+----------+-------------------------------+

[0112] | id | username | password_hash|

[0113] +----+----------+-------------------------------+

[0114] | 1| admin| 21232f297a57a5a743894a0e4a801fc3 |

[0115] | 2| user1| 5f4dcc3b5aa765d61d8327deb882cf99 |

[0116] | 3| test| 098f6bcd4621d373cade4e832627b4f6 |

[0117] +----+----------+-------------------------------+

[0118] Example 2: SQL injection failed

[0119] Virtual range agent returns (outputs):

[0120] [Virtual Range Agent Feedback] Login failed, username or password incorrect.

[0121] The database returned no data.

[0122] The examples 1 and 2 above represent different scenarios of successful and failed penetration feedback, respectively. They conform to the interaction mechanism of virtual range agents and can be used as an environment for training and testing penetration attack agents.

[0123] 104. Through the penetration attack agent, the attack chain is gradually advanced according to the penetration operation results until the penetration attack process ends, and the corresponding penetration data is generated.

[0124] After receiving the penetration operation results returned by the virtual target range agent, the penetration attack agent will progressively advance the attack chain according to the results until the penetration attack process ends, thereby generating corresponding penetration data. Specifically, the penetration attack agent determines whether the penetration operation is successful or unsuccessful based on the penetration operation results fed back by the virtual target range agent, and adjusts its attack strategy accordingly, continuing to generate new penetration operation instructions and receiving new penetration operation results based on the new instructions, thus progressively advancing the attack chain. For example, in the above-mentioned target range task example of "SQL injection vulnerability", the penetration attack agent executes an SQL injection instruction. If the virtual target range agent returns an SQL password form, it means the injection is successful; otherwise, if the virtual target range agent returns a failure to read or another form, it means the SQL injection has failed. The penetration attack agent adjusts the SQL injection instruction accordingly, and the specific adjustment method is determined by the penetration attack agent itself. The penetration attack agent repeats the above-mentioned cyclical interaction with the virtual target range agent until it successfully triggers or exploits the vulnerability to obtain the task target information, or when the set maximum time limit is reached, the penetration attack process is considered to have ended. Through the above penetration attack process, the penetration attack agent can continuously learn and optimize its attack strategy in a virtual test range environment, thereby gradually adapting to and improving its capabilities in complex penetration scenarios.

[0125] The various penetration attack paths generated during the aforementioned penetration attack process can be collected as high-quality penetration data for training a large-scale network penetration model. The collaborative interaction of the three agents does not rely on real-world test range scenarios, significantly reducing data collection costs and addressing issues in existing technologies such as difficulty in data acquisition, limited data scale, and over-reliance on real-world test range environments. Furthermore, the test range task agent can continuously generate new test range tasks, ensuring the diversity of training data.

[0126] As an example, Figure 3 This is a schematic diagram illustrating the operational principle of generating penetration data according to an embodiment of this application. (Refer to...) Figure 3 The virtual target range simulator (i.e., the virtual target range agent) constructs a virtual target range environment after receiving the target range task prompt. In the virtual target range environment, it executes the penetration operation instructions sent by the penetration attacker (i.e., the penetration attack agent) and returns the virtual penetration operation results to the penetration attacker. The penetration attacker adjusts the attack strategy based on the penetration operation results and sends new penetration operation instructions to the virtual target range simulator. This process is repeated to gradually advance the attack chain until the penetration attack process ends. The generated penetration attack paths are recorded and can be used as penetration data for training large-scale network penetration models.

[0127] In traditional large-scale network penetration testing model training methods, target range tasks rely on manually generated questions or fixed real-world target ranges. The difficulty of the training data is uncontrollable and cannot be dynamically adjusted according to the model's current capabilities, leading to insufficient learning effectiveness and a lack of continuous improvement. For example, if the target range tasks are too simple, the model's learning improvement is limited; if the target range tasks are too complex, the model struggles to generate effective feedback, resulting in learning stagnation. To address this issue, the technical solution of this application dynamically adjusts the target range task generation strategy of the penetration attack agent based on its current capability state. This allows the target range task agent to generate target range tasks with a difficulty slightly higher than the current capability boundary of the penetration attack agent. This ensures that the target range tasks are challenging yet remain within the range that the penetration attack agent can gradually complete through learning and reasoning, thus contributing to the improvement of the penetration attack agent's capabilities. The specific technical implementation details are described below.

[0128] In one implementation, the method proposed in this application embodiment further includes:

[0129] (1) Determine the results of multiple penetration attacks by the penetration attack agent against the target range mission;

[0130] (2) Based on the results of multiple penetration attacks, the task generation strategy of the target range task agent is adjusted so that the difficulty of the target range task generated by the target range task agent is adapted to the penetration capability of the penetration attack agent.

[0131] In the technical solution of this application embodiment, the penetration attack agent performs multiple penetration attack processes for each target range task, thus obtaining multiple penetration attack results, each of which is either a successful or unsuccessful penetration attack. Based on the above multiple penetration attack results, the performance of the penetration attack agent on the target range task can be evaluated to determine the penetration attack success rate, thereby judging the suitability of the difficulty of the target range task and the training effect of the penetration attack agent. Accordingly, the task generation strategy of the target range task agent can be adjusted so that the difficulty of the target range task subsequently generated by the target range task agent is adapted to the current penetration capability of the penetration attack agent. For example, if the number of successful penetration attacks far exceeds the number of failed attacks in multiple penetration attack results, it indicates that the difficulty of the target range task is too low. In this case, the difficulty of subsequent target range tasks generated by the target range task agent can be increased. If the number of successful penetration attacks far exceeds the number of failed attacks in multiple penetration attack results, it indicates that the difficulty of the target range task is too high. In this case, the difficulty of subsequent target range tasks generated by the target range task agent can be decreased. If the number of successful penetration attacks is close to the number of failed attacks in multiple penetration attack results, it indicates that the difficulty of the target range task is appropriate. In this case, there is no need to adjust the task generation strategy of the target range task agent.

[0132] In one implementation of this application, the task generation strategy of the target range task agent is adjusted based on the results of multiple penetration attacks, including:

[0133] (1) Based on the results of multiple penetration attacks, determine the number of successful penetration attacks and the number of failed penetration attacks;

[0134] (2) Construct a reward function based on the number of successful penetration attacks and the number of failed penetration attacks; where the smaller the difference between the number of successful penetration attacks and the number of failed penetration attacks, the larger the value of the reward function.

[0135] (3) Based on the reward function, the task generation strategy of the target range task agent is adjusted by using reinforcement learning method.

[0136] Based on the results of the multiple penetration attacks, the number of successful and unsuccessful penetration attacks by the penetration attack agent in the target range task can be determined, and reward signals can be provided to the target range task agent's task generation strategy accordingly. Specifically, when the number of successful and unsuccessful penetration attacks is close, it indicates that the difficulty of the target range task is reasonable, prompting the penetration attack agent to learn without being too easy or too difficult. In this case, a higher reward signal is given to the target range task agent to strengthen its current task generation strategy. When the number of successful and unsuccessful penetration attacks differs significantly, it indicates that the difficulty of the target range task is too easy or too difficult, failing to effectively improve the penetration attack agent's penetration capability. In this case, a lower reward signal is given to the target range task agent to adjust its current task generation strategy. In practice, a reward function can be constructed based on the number of successful and unsuccessful penetration attacks. This reward function guides the target range task agent to adjust its task generation strategy, making the generated target range tasks closer to the penetration attack agent's current capability boundary in terms of difficulty, thereby continuously improving the challenge of the target range tasks and the agent's training effect.

[0137] When designing the reward function, the smaller the difference between the number of successful and failed penetration attacks, the larger the value of the reward function should be. Assuming 10 penetration attacks are performed for each target range mission, the constructed reward function would... As shown below:

[0138]

[0139] in, This represents the number of successful penetration attacks. It can be seen that the reward function is at its maximum value when the number of successful penetration attacks is 5 (at which point the number of successful penetration attacks is the same as the number of failed penetration attacks); and at its minimum value when the number of successful penetration attacks is 0 or 10 (at which point the difference between the number of successful penetration attacks and the number of failed penetration attacks is the largest).

[0140] Based on the above reward function, reinforcement learning is used to optimize the training of the target range task agent and adjust its task generation strategy so that the difficulty of the target range task generated in the next round can more accurately approach the capability boundary of the penetration attack agent, thereby improving the challenge and quality of the target range task. Specifically, the target range task agent trains its model using the Group Relative Policy Optimization (GRPO) reinforcement learning algorithm based on the provided reward function. The training process includes: the target range task agent generates a batch of target range tasks according to the current task generation strategy. Each target range task includes descriptive information such as the attack target, vulnerability type, and service configuration. The generated target range tasks are output as prompts to guide the virtual target range agent in constructing the virtual target range environment. The penetration attack agent receives the task prompts and performs penetration operations through the virtual target range agent. The system records the penetration attack results for each target range task, including the number of successful penetration attacks, the number of failed penetration attacks, and error messages. Based on the performance of the penetration attack agent on each target range task, a reward signal is calculated. The target range task agent inputs the generated target range tasks and their corresponding reward signals into the GRPO model. The GRPO model calculates the gradient of each task generation strategy based on the reward signals and updates the task generation model parameters, making the model more inclined to generate target range tasks that yield high reward values.

[0141] After multiple rounds of training, the task generation model of the range task agent can generate continuous, dynamic, and high-quality range tasks that adapt to the capability level of the penetration attack agent. The optimized task generation strategy can be used for the next round of training of the range task agent or directly deployed for the training of the penetration attack agent.

[0142] By utilizing the penetration data generated through the collaborative interaction of three agents, a high-quality training dataset can be constructed. The penetration attack agent can then be optimized and trained on this dataset, evolving into a more powerful network penetration model. The specific training method for the penetration attack agent is explained below.

[0143] In one implementation of this application, the penetration data includes successful penetration paths and failed penetration paths; after generating the corresponding penetration data, the method further includes:

[0144] Using successful penetration paths as positive reward samples and failed penetration paths as negative reward samples, a reinforcement learning method is used to adjust the penetration path generation strategy of the penetration attack agent.

[0145] The aforementioned penetration data includes penetration attack paths generated by the penetration attack agent during multiple mission attempts, encompassing both successful and failed penetration paths. Specifically, the operational chain generated by the penetration attack agent during the attack chain includes steps such as port scanning, vulnerability detection, and exploit code execution. If the vulnerability is successfully triggered or exploited, the corresponding operational chain is recorded as a successful penetration path. A successful penetration path includes each penetration operation instruction and its corresponding feedback information, forming a complete operation sequence, which serves as the core data of the training dataset. If the vulnerability is not successfully triggered or the mission times out, the corresponding operational chain is recorded as a failed penetration path, which is also included in the training dataset. Successful and failed penetration paths from multiple rounds of target range missions are collected to construct a high-quality training dataset. The penetration attack agent is then trained on this training dataset for optimization, using successful penetration paths as positive reward samples and failed penetration paths as negative reward samples. The GRPO reinforcement learning method is used to adjust the penetration path generation strategy of the penetration attack agent. After multiple rounds of iterative training, the penetration attack agent tends to generate operational chains with a higher probability of successful penetration, ultimately increasing the probability of generating successful penetration paths while decreasing the probability of generating failed penetration paths. With this configuration, the penetration attack agent can automatically select and generate more efficient and successful penetration operation links in different task scenarios, thereby improving penetration capabilities.

[0146] The training processes of the target range task agent and the penetration attack agent have been described above. These two agents exhibit multi-round game-like interaction: the system achieves joint improvement in the capabilities of both agents through multiple rounds of iterative training. The target range task agent generates a batch of target range tasks based on the current task generation strategy. The penetration attack agent executes these tasks in the virtual target range environment, generating penetration operation commands and receiving feedback. Reward signals are calculated based on the task completion status of the penetration attack agent. The target range task agent adjusts its task generation strategy based on the reward signals, while the penetration attack agent trains its own penetration path generation strategy based on successful penetration paths. This process is repeated, with multiple rounds of game-like interaction enabling the target range task agent to continuously optimize task difficulty, and the penetration attack agent to continuously improve its penetration capabilities. A dynamic game relationship is formed between the target range task agent and the penetration attack agent. The difficulty of the target range tasks generated by the target range task agent dynamically increases as the penetration attack agent's penetration capabilities improve, resulting in a continuously progressive training process. As the number of iterations increases, the training dataset size continuously expands, and the generalization ability and upper limit performance of the two agents in different scenarios gradually increase.

[0147] As an example, Figure 4 This is a schematic diagram illustrating the overall operational principle of the network penetration data generation method provided in this application embodiment. (Refer to...) Figure 4 The target range creator (i.e., the target range task agent) generates target range tasks and inputs the corresponding target range task prompts into the virtual target range simulator (i.e., the virtual target range agent). Upon receiving the target range task prompts, the virtual target range simulator constructs a virtual target range environment, executes penetration operation instructions sent by the penetration attacker (i.e., the penetration attack agent) within the virtual target range environment, and returns the penetration operation results to the penetration attacker. Based on the penetration operation results, the penetration attacker progressively advances the attack chain until the penetration attack process ends, recording the generated penetration attack paths, including successful penetration paths and failed penetration paths. Successful penetration paths are used as positive reward samples, and failed penetration paths are used as negative reward samples. The study employs reinforcement learning to train the attacker, adjusting their penetration path generation strategy to encourage them to generate operational links with higher success rates, thereby enhancing their penetration capabilities. The success rate of penetration attacks is evaluated based on the results of multiple attacks in the target range tasks, and reward signals for these tasks are set accordingly. Reinforcement learning is then used to optimize the training of the target range task creator, adjusting their task generation strategy so that the difficulty of the next round of generated tasks more accurately approximates the attacker's capability boundaries. It can be seen that a dynamic game relationship is formed between the target range task creator and the attacker; with each iteration, the capabilities of both agents are enhanced.

[0148] The technical solution of this application embodiment sets up a target range task agent, a penetration attack agent, and a virtual target range agent. The target range task agent is responsible for generating network penetration target range tasks. The penetration attack agent generates penetration operation instructions based on the target range tasks and sends these instructions to the virtual target range agent. The virtual target range agent constructs a virtual target range environment based on the target range tasks, executes the penetration operation instructions in the virtual target range environment to obtain penetration operation results, and returns the results to the penetration attack agent. Finally, the penetration attack agent progressively advances the attack chain according to the penetration operation results until the penetration attack process ends, generating corresponding penetration data. This process continuously generates target range tasks through the target range task agent, constructs a virtual target range environment based on the target range tasks through the virtual target range agent, and generates corresponding penetration data through the interaction between the penetration attack agent and the virtual target range agent in the virtual target range environment. The collaboration of these three agents eliminates the dependence on a real target range, continuously generating a sufficient amount of penetration data to meet the training requirements of large-scale network penetration models.

[0149] In summary, the embodiments of this application utilize the collaborative interaction of three intelligent agents to generate penetration data, without relying on real-world target range scenarios, thus significantly reducing data collection costs. The use of the target range task agent to continuously generate new target range tasks ensures the quantity and diversity of training data. Through dynamic game-theoretic training between the target range task agent and the penetration attack agent, the difficulty of the target range tasks generated by the target range task agent dynamically increases as the penetration attack agent's penetration capabilities improve, resulting in a continuously progressive training process. The generalization ability and upper limit performance of both the target range task agent and the penetration attack agent gradually increase.

[0150] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0151] The above mainly describes a method for generating network penetration data. The following will describe a device for generating network penetration data.

[0152] Please see Figure 5 This application illustrates a network penetration data generation apparatus according to an embodiment of the present application, comprising:

[0153] The target range task generation module 501 is used to generate network penetration target range tasks through the target range task intelligent agent.

[0154] The penetration operation instruction generation module 502 is used to generate penetration operation instructions based on the target range task through the penetration attack agent, and send the penetration operation instructions to the virtual target range agent.

[0155] The penetration operation instruction execution module 503 is used to construct a virtual target range environment based on the target range task through a virtual target range agent, execute penetration operation instructions in the virtual target range environment to obtain penetration operation results, and return the penetration operation results to the penetration attack agent.

[0156] The penetration data generation module 504 is used to generate corresponding penetration data by gradually advancing the attack chain according to the penetration operation results through the penetration attack agent until the penetration attack process ends.

[0157] In one implementation of this application, the target range task includes task description information and interaction rules; the penetration operation instruction execution module includes:

[0158] The task prompt word construction unit is used to construct target range task prompt words based on task description information and interaction rules;

[0159] The virtual target range environment construction unit is used to construct a virtual target range environment based on target range task prompts by using a virtual target range agent.

[0160] In one implementation of this application, the task description information includes attack target information, vulnerability type information, and service configuration information; the virtual range environment construction unit includes:

[0161] The virtual range environment construction subunit is used to parse the target information, vulnerability type information, service configuration information and interaction rules of the target range intelligent agent, and to determine the target, vulnerability type, service configuration and task scenario of the target range task based on the target information, vulnerability type information, service configuration information and interaction rules, so as to construct the virtual range environment.

[0162] In one implementation of this application, the network penetration data generation apparatus further includes:

[0163] The penetration result determination module is used to determine the results of multiple penetration attacks by the penetration attack agent against the target range task.

[0164] The task generation strategy adjustment module is used to adjust the task generation strategy of the target range task agent based on the results of multiple penetration attacks, so that the difficulty of the target range tasks generated by the target range task agent is adapted to the penetration capability of the penetration attack agent.

[0165] In one implementation of this application, the task generation strategy adjustment module includes:

[0166] The penetration test count determination unit is used to determine the number of successful penetration tests and the number of failed penetration tests based on the results of multiple penetration tests.

[0167] The reward function construction unit is used to construct a reward function based on the number of successful penetration attacks and the number of failed penetration attacks; the smaller the difference between the number of successful penetration attacks and the number of failed penetration attacks, the larger the value of the reward function.

[0168] The task generation strategy adjustment unit is used to adjust the task generation strategy of the target range task agent based on the reward function and using reinforcement learning methods.

[0169] In one implementation of this application, the penetration data includes successful penetration paths and failed penetration paths; the network penetration data generation device further includes:

[0170] The penetration path generation strategy adjustment module is used to adjust the penetration path generation strategy of the penetration attack agent by using successful penetration paths as positive reward samples and failed penetration paths as negative reward samples, and employing reinforcement learning methods.

[0171] In one implementation of this application, the target range mission agent, the penetration attack agent, and the virtual target range agent are distinguished by preset role prompts.

[0172] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network penetration data generation method described in any of the above embodiments.

[0173] This application also provides a computer program product that, when run on an electronic device, causes the electronic device to execute the network penetration data generation method as described in any of the above embodiments.

[0174] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of this application. Figure 6 As shown, the electronic device 6 of this embodiment includes: a processor 60, a memory 61, and a computer program 62 stored in the memory 61 and executable on the processor 60. When the processor 60 executes the computer program 62, it implements the steps in the embodiments of the various network penetration data generation methods described above, for example... Figure 1 Steps 101-104 are shown. Alternatively, when the processor 60 executes the computer program 62, it implements the functions of each module / unit in the above-described device embodiments, for example, implementing... Figure 5 The functions of modules 501-504 of the device shown.

[0175] The computer program 62 can be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to complete this application. The one or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program 62 in the electronic device 6.

[0176] The processor 60 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0177] The memory 61 can be an internal storage unit of the electronic device 6, such as a hard drive or memory. The memory 61 can also be an external storage device of the electronic device 6, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory 61 can include both internal and external storage units of the electronic device 6. The memory 61 is used to store the computer program and other programs and data required by the electronic device. The memory 61 can also be used to temporarily store data that has been output or will be output.

[0178] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0179] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0180] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0181] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0182] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between devices or units through some interfaces, and may be electrical, mechanical, or other forms.

[0183] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0184] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0185] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0186] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A network penetration data generation method, characterized by, The method comprises the following steps: generating a target task for network penetration by a target task intelligent agent; generating penetration operation instructions based on the target task by a penetration attack intelligent agent, and sending the penetration operation instructions to a virtual target intelligent agent; constructing a virtual target environment based on the target task by the virtual target intelligent agent, executing the penetration operation instructions in the virtual target environment to obtain penetration operation results, and returning the penetration operation results to the penetration attack intelligent agent; gradually advancing a chain of attacks until the penetration attack process ends according to the penetration operation results by the penetration attack intelligent agent, and generating corresponding penetration data; determining multiple penetration attack results of the penetration attack intelligent agent for the target task; determining the number of successful penetration attacks and the number of failed penetration attacks according to the multiple penetration attack results; constructing a reward function according to the number of successful penetration attacks and the number of failed penetration attacks; wherein the smaller the difference between the number of successful penetration attacks and the number of failed penetration attacks, the larger the value of the reward function; adjusting the task generation strategy of the target task intelligent agent by using a reinforcement learning method based on the reward function, so that the difficulty of the target task generated by the target task intelligent agent is adapted to the penetration ability of the penetration attack intelligent agent.

2. The method of claim 1, wherein, The target task comprises task description information and interaction rules; the virtual target environment is constructed by the virtual target intelligent agent based on the target task, which comprises the following steps: constructing a target task prompt word according to the task description information and the interaction rules; constructing the virtual target environment based on the target task prompt word by the virtual target intelligent agent.

3. The method of claim 2, wherein, The task description information comprises attack target information, vulnerability type information and service configuration information; the virtual target environment is constructed by the virtual target intelligent agent based on the target task prompt word, which comprises the following steps: the attack target information, the vulnerability type information, the service configuration information and the interaction rules are obtained by analyzing the target task prompt word by the virtual target intelligent agent, and the attack target, the vulnerability type, the service configuration and the task scene of the target task are determined according to the attack target information, the vulnerability type information, the service configuration information and the interaction rules, so as to construct the virtual target environment.

4. The method of claim 1, wherein, The penetration data comprises a penetration success path and a penetration failure path; After the corresponding penetration data is generated, the method further comprises the following steps: adjusting the penetration path generation strategy of the penetration attack intelligent agent by using a reinforcement learning method with the penetration success path as a positive reward sample and the penetration failure path as a negative reward sample.

5. The method according to any one of claims 1 to 4, characterized in that, The target task intelligent agent, the penetration attack intelligent agent and the virtual target intelligent agent are distinguished by a preset role prompt word.

6. A network penetration data generating apparatus characterized by comprising: The method comprises the following steps: a target task generation module is configured to generate a target task for network penetration by a target task intelligent agent; The penetration operation instruction generation module is configured to generate penetration operation instructions based on the target task by the penetration attack agent, and send the penetration operation instructions to the virtual target agent. The penetration operation instruction execution module is configured to construct a virtual target environment based on the target task by the virtual target agent, execute the penetration operation instructions in the virtual target environment to obtain penetration operation results, and return the penetration operation results to the penetration attack agent. The penetration data generation module is configured to generate corresponding penetration data by the penetration attack agent according to the penetration operation results until the penetration attack process ends. The penetration result determination module is configured to determine multiple penetration attack results of the penetration attack agent for the target task. The penetration number determination unit is configured to determine the number of successful penetration attacks and the number of failed penetration attacks according to the multiple penetration attack results. The reward function construction unit is configured to construct a reward function according to the number of successful penetration attacks and the number of failed penetration attacks, wherein the smaller the difference between the number of successful penetration attacks and the number of failed penetration attacks, the larger the value of the reward function. The task generation strategy adjustment unit is configured to adjust the task generation strategy of the target task agent by using a reinforcement learning method based on the reward function, so that the difficulty of the target task generated by the target task agent is adapted to the penetration ability of the penetration attack agent.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the network penetration data generation method of any one of claims 1 to 5.

8. A computer program product, characterised in that, When the computer program product runs on the electronic device, the electronic device executes the network penetration data generation method of any one of claims 1 to 5.

Images