Network security penetration test path intelligent planning method and system

Abstract

This invention provides an intelligent path planning method and system for network security penetration testing, relating to the field of network security technology. The method includes constructing a multi-attribute attack graph by acquiring secure content through automated protocols, establishing a path planning objective function, employing a heuristic search strategy to layer-by-layer expand the attack graph, performing Monte Carlo simulation to obtain a reliable path benefit profile, iteratively updating the candidate path set, and finally outputting the penetration testing path with the optimal overall benefit. This invention can effectively avoid blind path expansion and improve penetration testing efficiency and success rate.

Description

Technical Field

[0001] This invention relates to network security technology, and more particularly to a method and system for intelligent planning of network security penetration testing paths. Background Technology

[0002] As cybersecurity threats become increasingly complex, penetration testing, as a proactive defense mechanism, plays a crucial role in assessing the security of network systems. Penetration testing simulates attacker behavior, identifying system vulnerabilities and weaknesses to validate the effectiveness of existing security measures. Traditional penetration testing relies on the expertise and experience of testers, typically involving manual identification of weaknesses in the target system and designing attack paths for testing. In recent years, the development of the Security Content Automation Protocol (SCAP) has provided the technological foundation for automated penetration testing, enabling a more standardized and systematic testing process.

[0003] In the field of cybersecurity penetration testing, path planning refers to determining the optimal attack path from an initial state to a target state in a complex network environment. Traditional path planning methods are mainly based on attack graph models. By analyzing network topology, vulnerability information, and attacker capabilities, a directed graph representing the attack path is constructed, and graph search algorithms are used to find feasible paths. Currently, multi-attribute attack graphs, as an extension of attack graphs, provide more dimensions of information for path evaluation by adding attributes such as success probability and time consumption.

[0004] Existing technologies lack effective mechanisms for extracting and verifying access control policies and exploitable channel meta-attributes when constructing attack graphs, resulting in attack graphs containing inaccurate or outdated information, which affects the reliability and effectiveness of subsequent path planning.

[0005] Traditional path planning methods often employ simple graph traversal algorithms, failing to fully consider policy constraints and connectivity limitations in complex network environments. This results in attack paths that are difficult to execute in real-world environments, or ignores the selection of more covert and efficient attack paths.

[0006] Existing methods typically rely on a single metric or static analysis when evaluating attack paths, which cannot accurately reflect the actual effects and risks of attacks in dynamic environments. In particular, they lack a comprehensive consideration of the probability of attack success, time consumption, and the likelihood of triggering alerts, making it difficult to provide penetration testers with a true and reliable assessment of the benefits of attack paths. Summary of the Invention

[0007] This invention provides a method and system for intelligent planning of network security penetration testing paths, which can solve the problems in the prior art.

[0008] A first aspect of this invention provides an intelligent path planning method for network security penetration testing, comprising:

[0009] Obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of exploitable channels based on the security content automation protocol, perform joint verification of consistency timestamps on the extraction results, and construct a multi-attribute attack graph based on the meta-attributes of the exploitable channels using the data that passes the verification.

[0010] A path planning objective function is established based on the multi-attribute attack graph, the access control policy and connectivity restrictions are used as constraints, and the path planning objective function is mapped to path feasibility constraints.

[0011] Based on the path feasibility constraints, the multi-attribute attack graph is expanded in layers using a heuristic search strategy. Branches that do not meet the strategy constraints are pruned to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints.

[0012] Monte Carlo simulation is performed on the candidate path set. Sampling is carried out based on the success probability and time consumption of the corresponding attack action. The sampling results are accumulated in combination with alarm time-domain joint penalty, and the statistical distribution is summarized into a path credibility benefit profile.

[0013] The candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output.

[0014] Based on the multi-attribute attack graph, a path planning objective function is established, and the access control policy and connectivity restrictions are used as constraints. The path planning objective function is mapped to path feasibility constraints, including:

[0015] In a multi-attribute attack graph, set the order product expectation binding metric value related to the attack action, and perform sequential accumulation and expectation processing based on the order product expectation binding metric value to form a binding target metric set; when constructing the path planning objective function, synchronously refer to the transition constraint set to internally constrain the action executability and state transition, and obtain the metric binding result for constraint mapping;

[0016] Access control policies and connectivity restrictions are extracted from the unified data description to generate a set of decidable conditions. Based on the set of decidable conditions, a decision rule is given for each network access control decision condition. The decision rule is mapped to the node state and edge feasibility state of the multi-attribute attack graph to form a constraint relationship. A synchronization relationship with the unified data description is established based on the results of timestamp verification and consistency verification. The constraint relationship and the synchronization relationship are updated consistently to obtain a set of constraint relationships for path constraints. The metric binding result is integrated with the set of constraint relationships for constraint mapping to generate path feasibility constraints.

[0017] In a multi-attribute attack graph, sequential product expectation binding metrics related to the attack action are set. Based on these sequential product expectation binding metrics, sequential accumulation and expectation processing are performed to form a bound target metric set, including:

[0018] The expected value of the sequence product corresponding to the attack action is bound to the metric value in the state transition order. The transition intrinsic constraints of the attack action are synchronously recorded on the edges and nodes of the multi-attribute attack graph. The set of condition states corresponding to the transition intrinsic constraints is indexed according to the order of the transitions to form an initial metric binding list.

[0019] Based on the initial metric binding list, the attack actions are sequentially accumulated, and the set of preconditions and trigger conditions bound to the attack actions are called for executability verification; when the verification passes and the end of the path is reached, the sequential accumulation result covering the entire path is output;

[0020] Based on the sequential cumulative results, expectation processing is performed, the transfer inherent constraints are continuously referenced, and the executability of each position in the sequential cumulative results is confirmed. When the executability of any position changes due to the change of the condition state set, the change is synchronously written back to the record entry corresponding to the sequential cumulative results and the initial metric binding list, until all affected positions are consistently updated to form the bound target metric set.

[0021] Based on the path feasibility constraints, a heuristic search strategy is used to perform layered expansion of the multi-attribute attack graph, pruning branches that do not meet the strategy constraints to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints, including:

[0022] Based on path feasibility constraints, a layered expansion order is established from the initial state of the multi-attribute attack graph, generating a queue to be expanded corresponding to each layer, and the policy constraints and executability judgment conditions corresponding to the items to be expanded are recorded as a hierarchical constraint list.

[0023] Calculate the heuristic evaluation order based on the hierarchical constraint list to form a heuristic sequence, and establish a correspondence between the heuristic sequence and the hierarchical constraint list; perform hierarchical expansion based on the correspondence, refer to the corresponding hierarchical constraint list for performance verification, prune branches that fail the verification, and write the pruning reason, pruning position and the referenced hierarchical constraint into the pruning record;

[0024] Depth suppression is performed based on the pruning record and the hierarchical constraint list. Branches that trigger the depth threshold are pruned so that subsequent hierarchical expansion continues only on the valid branches that are not suppressed, thereby suppressing the blind expansion of excessively deep branches. When any branch meets the determination condition of the path feasibility constraint, the state transition sequence of the branch is registered as a candidate path, and the condition is written into the candidate path record.

[0025] Based on the pruning records, the candidate path records are checked for consistency, and registration items that have lost their executability due to upper-level pruning are deleted. The remaining registration items are corrected in order and deduplicated, and a set of candidate paths that meet the policy constraints is output.

[0026] Monte Carlo simulations were performed on the candidate path set. Sampling was conducted based on the success probability and time consumption of the corresponding attack actions. The sampling results were accumulated by combining the alarm time-domain joint penalty, and the statistical distribution was summarized into a path credibility benefit profile, including:

[0027] For candidate paths, extract success probability and time consumption labels corresponding to the attack actions according to their state transition order, and establish a time-domain constraint list.

[0028] Monte Carlo simulation is performed on the candidate path based on the success probability label and the time consumption label. In each simulation, the attack action is sampled for success and failure according to the state transition order to form a simulation timeline. While accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. The penalty is synchronously deducted from the accumulated path gains in the simulation timeline to obtain the simulation result record.

[0029] Based on the simulation results, the candidate paths are statistically summarized to form a statistical distribution. The frequency of occurrence and penalty intensity of each segment are accumulated under the correspondence with the statistical distribution to generate an intermediate profile description.

[0030] Based on the intermediate profile description, scale alignment and temporal mapping are performed to map the penalized path gains and time consumption to a unified temporal benchmark. During the mapping process, weight correction is performed according to the alarm weight in the temporal domain. The statistical distribution after completing the temporal mapping and weight correction is summarized into a path credibility gain profile.

[0031] While accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. This penalty is then deducted synchronously from the accumulated path gains in the simulation time axis. The simulation results record includes:

[0032] While accumulating path benefits, interruption information is recorded, and the time position corresponding to the accumulation process is used as a unified time reference. A fixed reference relationship is established between the interruption information and the unified time reference.

[0033] The time-domain constraint list is invoked on the unified time base, and the time interval corresponding to the alarm trigger time domain is located according to the unified time base. According to the conventions in the time-domain constraint list regarding the start and end time domains, alarm trigger time domains, and alarm weight time domains, the joint penalty of the alarm time domain corresponding to the alarm trigger time domain is calculated.

[0034] The alarm time-domain joint penalty is applied to the accumulated path gains in the simulation time axis, and the accumulated value at each time position is deducted in real time using the same time step and time position as the accumulated path gains.

[0035] Based on the cumulative result after real-time deduction and the interruption information, corresponding simulation result information is generated, and the simulation result information is written into the result record in a form consistent with the unified time base and object identifier.

[0036] The candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output, including:

[0037] Based on the path credible benefit profile, a profile reference list is established for each candidate path according to the object identifier, and the comprehensive benefit index is calculated for each candidate path according to the statistical distribution in the path credible benefit profile under a unified time domain benchmark. The comprehensive benefit index is jointly judged with the executability status of the candidate path to form an iterative evaluation record.

[0038] Based on the iterative evaluation record, candidate paths are systematically screened. For candidate paths whose comprehensive benefit index is lower than the preset benefit threshold or triggers a feasibility denial judgment, a replacement strategy is executed, and the replaced paths are written into the replacement record.

[0039] The candidate path set is iteratively updated based on the replacement record. When a path triggers a change in the feasibility boundary after the update, the path feasibility constraint is immediately invoked to review it. The comprehensive benefit index is finally sorted based on the updated candidate path set, and the path with the best comprehensive benefit in the path credibility benefit profile is selected from the candidate paths that meet the path feasibility constraint as the optimal path.

[0040] A second aspect of this invention provides a network security penetration testing path intelligent planning system, comprising:

[0041] The first unit is used to obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of available channels based on the security content automation protocol, perform joint verification of consistency timestamps on the extraction results, and construct a multi-attribute attack graph based on the meta-attributes of the available channels using the data that passes the verification.

[0042] The second unit is used to establish a path planning objective function based on the multi-attribute attack graph, and to map the access control policy and connectivity restriction as constraints, and the path planning objective function as path feasibility constraints.

[0043] The third unit is used to perform hierarchical expansion of the multi-attribute attack graph using a heuristic search strategy based on the path feasibility constraints, pruning branches that do not meet the strategy constraints to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints.

[0044] The fourth unit is used to perform Monte Carlo simulation on the candidate path set, sample according to the success probability and time consumption of the corresponding attack action, accumulate the sampling results in combination with alarm time-domain joint penalty, and summarize the statistical distribution into a path credibility benefit profile.

[0045] The fifth unit is used to iteratively update the candidate path set based on the path credibility benefit profile, and after the iteration is completed, output the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile.

[0046] A third aspect of the present invention provides an electronic device, comprising:

[0047] processor;

[0048] Memory used to store processor-executable instructions;

[0049] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0050] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0051] The beneficial effects of this application are as follows:

[0052] This invention enables intelligent planning of network security penetration testing paths. By extracting access control policies and exploitable channels through automated security content protocols, it constructs a multi-attribute attack graph, providing a scientific basis for penetration testing path planning and significantly improving the efficiency and accuracy of penetration testing.

[0053] This invention employs a heuristic search strategy to perform layered expansion of the multi-attribute attack graph and prunes branches that do not meet the strategy constraints, effectively suppressing the blind expansion of excessively deep branches, avoiding the combinatorial explosion problem in the path search process, and improving the computational efficiency and feasibility of the algorithm.

[0054] This invention evaluates the candidate path set through Monte Carlo simulation and path credibility benefit profiling, comprehensively considering factors such as the probability of successful breach, time consumption, and alarm penalties, and can output the penetration testing path with the optimal overall benefit, providing security testers with more scientific and efficient decision support. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the intelligent path planning method for network security penetration testing according to an embodiment of the present invention.

[0056] Figure 2 This is a flowchart illustrating the process of generating a path credibility benefit profile according to an embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0059] Figure 1 This is a flowchart illustrating the intelligent path planning method for network security penetration testing according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0060] Obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of exploitable channels based on the security content automation protocol, perform joint verification of consistency timestamps on the extraction results, and construct a multi-attribute attack graph based on the meta-attributes of the exploitable channels using the data that passes the verification.

[0061] A path planning objective function is established based on the multi-attribute attack graph, the access control policy and connectivity restrictions are used as constraints, and the path planning objective function is mapped to path feasibility constraints.

[0062] Based on the path feasibility constraints, the multi-attribute attack graph is expanded in layers using a heuristic search strategy. Branches that do not meet the strategy constraints are pruned to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints.

[0063] Monte Carlo simulation is performed on the candidate path set. Sampling is carried out based on the success probability and time consumption of the corresponding attack action. The sampling results are accumulated in combination with alarm time-domain joint penalty, and the statistical distribution is summarized into a path credibility benefit profile.

[0064] The candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output.

[0065] In one optional implementation, a path planning objective function is established based on the multi-attribute attack graph, and the access control policy and connectivity restrictions are used as constraints. Mapping the path planning objective function to path feasibility constraints includes:

[0066] In a multi-attribute attack graph, set the order product expectation binding metric value related to the attack action, and perform sequential accumulation and expectation processing based on the order product expectation binding metric value to form a binding target metric set; when constructing the path planning objective function, synchronously refer to the transition constraint set to internally constrain the action executability and state transition, and obtain the metric binding result for constraint mapping;

[0067] Access control policies and connectivity restrictions are extracted from the unified data description to generate a set of decidable conditions. Based on the set of decidable conditions, a decision rule is given for each network access control decision condition. The decision rule is mapped to the node state and edge feasibility state of the multi-attribute attack graph to form a constraint relationship. A synchronization relationship with the unified data description is established based on the results of timestamp verification and consistency verification. The constraint relationship and the synchronization relationship are updated consistently to obtain a set of constraint relationships for path constraints. The metric binding result is integrated with the set of constraint relationships for constraint mapping to generate path feasibility constraints.

[0068] The objective function for path planning based on a multi-attribute attack graph employs a multi-dimensional optimization modeling approach. The objective function focuses on maximizing the overall benefit of the attack path, considering factors such as attack success rate, resource consumption cost, execution time efficiency, and stealth assurance. Attack success rate is estimated using historical statistical data and environmental characteristics. Resource consumption cost is quantified by calculating the overhead of resources, network bandwidth, and storage space. Execution time efficiency is assessed by evaluating the time consumed from initiation to achieving the objective.

[0069] The expected value of the order product is used to assign multi-dimensional evaluation metrics to each attack action. The metrics are in vector form and include dimensions such as attack power, execution complexity, and risk exposure. Attack power reflects the degree of impact on the target, execution complexity assesses the technical difficulty and implementation requirements, and risk exposure measures the stealth and probability of detection.

[0070] Sequential cumulative processing calculates the cumulative benefit of the attack path using a dynamic programming algorithm, propagating the cumulative value step-by-step along the directed edge direction, starting from the source node of the attack graph. The cumulative value of each node is calculated based on the cumulative value of its predecessor node and the contribution of the attack action metric of the connecting edge. Interactions between attack actions are considered, including cooperative enhancement effects and mutual inhibition effects.

[0071] The expectation processing performs probability-weighted adjustments on the cumulative results to handle uncertainties in the execution process. It calculates the expected value based on the success probability distribution of the attack action and the conditional probability dependency. The success probability distribution reflects the change in execution success rate under different conditions, while the conditional probability dependency describes the correlation between the success rate and the degree to which preconditions are met.

[0072] The set of transition constraints ensures the legitimacy and executability of the attack path. These constraints include state transition conditions, resource availability constraints, and time window limits. State transition conditions define the preconditions for transitioning from the source state to the target state; resource availability constraints limit the types and quantities of resources that can be used; and time window limits specify the effective execution time range for the attack action.

[0073] The metric binding results generate integrated sequential cumulative results, expected processing results, and transition constraint verification results, employing a multi-level data structure that includes attack path identifiers, node edge metric information, specific metric parameters, and constraints. Metric parameters include numerical and categorical parameters, and constraints are represented in predicate logic form.

[0074] Access control policy extraction identifies permission management rules from a unified data description, including role-based, attribute-based, and rule-based access control models. Role-based access control extracts the role hierarchy, permission inheritance relationships, and access control matrix, while attribute-based access control parses attribute definitions, policy rules, and decision algorithms.

[0075] Connectivity constraint extraction identifies network topology and communication constraints. Network topology includes node connectivity, link capacity limits, and routing policy configurations, while communication constraints include firewall rules, network isolation policies, and flow control policies. Topology information is obtained through network scanning and routing table analysis, while constraint information is obtained through configuration file parsing and policy extraction.

[0076] The decidable condition set generation process transforms the extracted strategies and constraints into Boolean decidable forms. It employs rule decomposition and condition standardization methods to break down complex strategy rules into logical combinations of basic decision conditions. Each basic decision condition is presented as a triple, containing the decision object, decision operation, and decision threshold.

[0077] Each decision rule defines verification logic for each basic decision condition, including data acquisition methods, condition evaluation algorithms, and result judgment criteria. Data acquisition defines the methods for obtaining decision information, condition evaluation implements the logic for calculating the decision conditions, and result judgment defines the criteria for whether the conditions are met or not.

[0078] The judgment rules are mapped to the node states and edge feasibility states of the attack graph to establish the relationship between the rules and the graph elements. A combination of semantic matching and structural correspondence is adopted. Semantic matching establishes semantic associations through keyword recognition and concept mapping, while structural correspondence establishes topological correspondences through graph structure analysis and path recognition.

[0079] Timestamp verification ensures the timeliness and consistency of mapping relationships. Expired mapping relationships are identified by comparing rule update times, graph structure modification times, and mapping establishment times. A high-precision timestamp format is used, and verification methods such as periodic checks, change event-driven verification, and manual triggering are supported.

[0080] Consistency verification verifies the logical correctness and semantic rationality of mapping relationships, including rule coverage checks, mapping conflict detection, and constraint integrity verification. Rule coverage checks prevent rule omissions, mapping conflict detection identifies contradictory mapping relationships, and constraint integrity verification checks whether the mapping relationship fully reflects the semantics of the original rules.

[0081] The constraint relationship set is constructed by integrating mapping and verification results to form a complete constraint system, represented by a graph structure. Nodes represent constraint objects, and edges represent constraint relationships, labeled with constraint type and strength. Constraint objects include graph elements of different granularities, such as attack graph nodes, edges, and path segments.

[0082] The integrated constraint mapping unifies the metric binding results with the constraint relation set, employing a multi-dimensional matching algorithm that considers matching criteria such as semantic similarity, structural compatibility, and constraint consistency. Semantic similarity is measured through concept distance and attribute matching, while structural compatibility checks the degree of matching between the metric structure and the constraint structure.

[0083] The path feasibility constraint generation process transforms the integrated mapping results into a constraint representation usable by the path planning algorithm. This includes steps such as constraint standardization, constraint parameter quantification, and constraint relationship simplification. Standardization unifies constraint formats from different sources; quantification converts qualitative constraints into quantitative parameters; and simplification reduces constraint complexity through logical equivalence transformations, redundancy elimination, and condition merging.

[0084] In one optional implementation, a sequence product expectation binding metric related to the attack action is set in the multi-attribute attack graph. The sequence product expectation binding metric is then sequentially accumulated and expected to form a bound target metric set, including:

[0085] The expected value of the sequence product corresponding to the attack action is bound to the metric value in the state transition order. The transition intrinsic constraints of the attack action are synchronously recorded on the edges and nodes of the multi-attribute attack graph. The set of condition states corresponding to the transition intrinsic constraints is indexed according to the order of the transitions to form an initial metric binding list.

[0086] Based on the initial metric binding list, the attack actions are sequentially accumulated, and the set of preconditions and trigger conditions bound to the attack actions are called for executability verification; when the verification passes and the end of the path is reached, the sequential accumulation result covering the entire path is output;

[0087] Based on the sequential cumulative results, expectation processing is performed, the transfer inherent constraints are continuously referenced, and the executability of each position in the sequential cumulative results is confirmed. When the executability of any position changes due to the change of the condition state set, the change is synchronously written back to the record entry corresponding to the sequential cumulative results and the initial metric binding list, until all affected positions are consistently updated to form the bound target metric set.

[0088] In a multi-attribute attack graph, the expected product binding metric is set using a state transition mapping mechanism. Each attack action corresponds to a metric vector, which includes parameters such as attack success probability, resource consumption, execution time, and stealth score. The metric is represented by a triple structure using weighted combinations of weight coefficients, containing an action identifier, a set of metric parameters, and binding constraints.

[0089] The state transition sequence binding uses a graph traversal algorithm to determine the execution sequence of attack actions. The multi-attribute attack graph adopts a directed acyclic graph structure, where nodes represent system states and edges represent attack actions. Traversal starts from the initial state and determines the transition sequence by topological sorting. Edges record transition constraint information, including prerequisite state requirements, resource consumption limits, and time window constraints. Constraints are defined using logical expressions, containing elements such as state variables, operators, and comparison values.

[0090] The condition state set index establishes a mapping relationship between state variables and attack actions. State variables include attributes such as system privilege level, network connectivity, and service availability. Each variable corresponds to an enumerated value range. The index assigns a unique identifier to each condition state and uses hierarchical encoding to reflect state dependencies, forming a condition state index table.

[0091] The initial metric binding list integrates metric settings, transition constraint records, and conditional state indexing results, employing a nested data structure. It includes attributes such as source action identifier, target state identifier, binding type, and binding strength. The binding type distinguishes between hard and soft constraints, while the binding strength indicates the importance of the constraint.

[0092] Sequential cumulative processing calculates the cumulative metric value step-by-step according to the state transition sequence, using a recursive approach. The current cumulative value equals the cumulative value at the previous position plus the metric contribution of the current action. It considers the mutual influence between actions, including the enhancement of synergistic effects and the attenuation of competitive effects. Synergistic effects are represented by a multiplication factor, while competitive effects are handled through a resource allocation algorithm.

[0093] The precondition set verifies the prerequisites for executing the attack, including permission requirements, network reachability, and target system status. Permission requirement checks compare current permissions with required permissions. Network reachability verification includes route reachability, port open status, and firewall policies. Target system status checks include service running status, patch availability, and security configuration.

[0094] The trigger condition set processing involves real-time monitoring of dynamic conditions, including dynamic factors such as time window conditions, system load conditions, and network traffic conditions. The time window specifies the effective execution time range, system load monitors resource usage, and network traffic analyzes communication modes.

[0095] The executability verification employs a multi-level verification strategy, including static verification and dynamic verification. Static verification checks fixed attributes such as permission requirements and system configuration, while dynamic verification monitors real-time changing conditions such as network status and system load. The verification result returns a Boolean value and a detailed verification report.

[0096] Path termination detection uses graph structure analysis to determine the termination conditions of the attack path. The termination node corresponds to the state of the attack target. The detection process verifies whether the current state meets the target definition conditions, including permission level check, data access verification, and service status confirmation.

[0097] The expectation-based processing applies a probability-weighted adjustment to the sequential cumulative results, taking into account the uncertainties in the execution of the attack actions, including random factors such as success probability, execution time variations, and resource consumption fluctuations. The success probability is estimated based on historical statistical data and environmental conditions, while execution time variations are described using a probability distribution model.

[0098] Transferring persistent references to intrinsic constraints ensures consistency of constraints in the expectation process. A dynamic binding mechanism is used to automatically update calculation results when constraints change. Constraint changes are monitored through an event-driven mechanism, and constraint consistency is maintained through version control.

[0099] Location executability verification verifies the validity of each location in the attack path, including state reachability verification, action executability checks, and constraint satisfaction assessment. State reachability is calculated using a graph search algorithm, action executability checks technical feasibility and resource availability, and constraint satisfaction assessment checks each constraint.

[0100] The condition state set change detection employs a state monitoring and comparison mechanism. The monitoring system tracks changes in state variables, including configuration modifications, service state changes, and network topology adjustments. State comparison identifies changes through snapshot comparison, triggering an executability reassessment.

[0101] Synchronous write-back ensures that the impact of changes is consistently updated in relevant records, and transactional processing guarantees atomic updates. This includes change impact analysis, affected record identification, and update operation execution. Impact analysis determines the scope of the changes' impact on the attack path, and record identification uses a dependency graph to determine the items that need to be updated.

[0102] Consistent update completion confirmation is achieved through a global state check, verifying whether the update operation at the affected locations was successful. This includes data integrity checks, constraint consistency verification, and referential integrity confirmation. Upon completion of confirmation, a bound set of target metrics is generated.

[0103] In one optional implementation, the multi-attribute attack graph is expanded hierarchically using a heuristic search strategy based on the path feasibility constraints. Branches that do not meet the strategy constraints are pruned to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints, including:

[0104] Based on path feasibility constraints, a layered expansion order is established from the initial state of the multi-attribute attack graph, generating a queue to be expanded corresponding to each layer, and the policy constraints and executability judgment conditions corresponding to the items to be expanded are recorded as a hierarchical constraint list.

[0105] Calculate the heuristic evaluation order based on the hierarchical constraint list to form a heuristic sequence, and establish a correspondence between the heuristic sequence and the hierarchical constraint list; perform hierarchical expansion based on the correspondence, refer to the corresponding hierarchical constraint list for performance verification, prune branches that fail the verification, and write the pruning reason, pruning position and the referenced hierarchical constraint into the pruning record;

[0106] Depth suppression is performed based on the pruning record and the hierarchical constraint list. Branches that trigger the depth threshold are pruned so that subsequent hierarchical expansion continues only on the valid branches that are not suppressed, thereby suppressing the blind expansion of excessively deep branches. When any branch meets the determination condition of the path feasibility constraint, the state transition sequence of the branch is registered as a candidate path, and the condition is written into the candidate path record.

[0107] Based on the pruning records, the candidate path records are checked for consistency, and registration items that have lost their executability due to upper-level pruning are deleted. The remaining registration items are corrected in order and deduplicated, and a set of candidate paths that meet the policy constraints is output.

[0108] The hierarchical expansion sequence is established based on the topological structure of the multi-attribute attack graph, which is represented as a directed graph where nodes represent attack states and edges represent state transitions. The hierarchical expansion begins with the initial state node, arranging the nodes in the graph according to the shortest path length from the initial state. The layering process uses a breadth-first search algorithm; layer zero contains the initial state node, layer one contains all adjacent nodes directly reachable from the initial state, and so on, forming a complete hierarchical structure.

[0109] The generation of the queue to be expanded involves creating an independent priority queue structure for each level to manage nodes to be processed. Each level's queue is initialized with all nodes in that level. Each node in the queue records attributes such as node identifier, predecessor node information, reachability status, and expansion priority. Predecessor node information is used to trace the complete attack path, and expansion priority is quantitatively evaluated based on the node's importance and feasibility.

[0110] The extraction of strategy constraints and executability criteria is based on the parsing of rule definitions for path feasibility restrictions. Strategy constraints include multiple dimensions of restrictions such as resource consumption limits, time window constraints, permission requirements, and technical dependencies. The hierarchical constraint list organizes the extracted constraints according to a hierarchical structure, using a nested dictionary structure for storage. Each level's constraint list inherits the general constraints of the higher level and adds specific constraints unique to that level.

[0111] The heuristic evaluation order is calculated based on the multi-dimensional attributes of nodes for quantitative ranking. Evaluation dimensions include key indicators such as attack value, execution difficulty, success probability, resource consumption, and time cost. The heuristic function uses a weighted summation method to merge the multi-dimensional evaluation results into a single evaluation score, with the weight coefficients dynamically adjusted according to the current attack target and environmental characteristics. The heuristic sequence formation sorts the calculated evaluation scores among nodes at each level, and the sorted results are stored in an ordered list format.

[0112] The correspondence is established through an index mapping mechanism between the heuristic sequence and the hierarchical constraint list. The mapping uses the node identifier as the key, associating each node in the sequence with its corresponding hierarchical constraint list. The mapping table supports fast lookups; when constraint checks are needed on a specific node, the corresponding constraint rules and checks can be directly obtained through the node identifier.

[0113] The hierarchical expansion process processes nodes at each level sequentially according to a heuristic sequence. The expansion operation starts from the current node, identifies all directly reachable successor nodes, and creates a corresponding state transition record for each successor node. A global set of visited nodes is maintained during the expansion process to avoid computational waste caused by repeatedly expanding the same node.

[0114] The performance verification process uses the corresponding hierarchical constraint list to perform compliance checks on the expanded branches. The verification process checks each branch to ensure it meets various constraints such as resource constraints, time constraints, and permission constraints. A short-circuit evaluation strategy is used; if any constraint is not met, subsequent checks are immediately stopped and the branch is marked as non-compliant. The branch pruning operation removes branches that fail verification. The pruning operation uses a cascading deletion mechanism; when a branch is pruned, all subsequent branches that precede that branch are automatically pruned.

[0115] The pruning record generates detailed information about each pruning operation, including the complete identifier of the pruned branch, the timestamp of the pruning, the constraints that triggered the pruning, and the specific reason for the pruning. The pruning location is precisely determined by the branch's coordinates and hierarchical position in the attack graph.

[0116] The depth suppression mechanism controls branch depth based on pruning records and a hierarchical constraint list. The depth threshold is dynamically set according to factors such as the size of the attack graph, computational resource limitations, and time constraints. When the expansion depth of a branch reaches or exceeds the set threshold, the depth suppression mechanism is triggered. The suppression process evaluates the value and cost of continuing to expand the branch, and performs forced pruning on branches with low value or excessive cost.

[0117] The identification of valid branches is dynamically maintained based on pruning records. The set of valid branches is initialized with all starting branches and is dynamically updated as pruning operations are performed. After each pruning operation, branch dependencies are rescanned to identify downstream branches that have become invalid due to upstream pruning. Valid branch maintenance uses a mark-and-sweep algorithm to periodically clean up invalid branch references.

[0118] Candidate path registration is triggered when a branch meets the path feasibility constraint criteria, which include reaching the target state, meeting the profit threshold, and complying with constraints. The extraction of the state transition sequence uses a backtracking algorithm to trace from the current branch node back to the starting node, constructing a complete attack path. The generation of candidate path records includes a complete description and evaluation information of the path; the record structure includes key components such as path identifier, node sequence, action sequence, and overall evaluation.

[0119] The consistency review process verifies the validity of candidate path records based on pruned records. The review checks whether all predecessor branches of each candidate path are still valid, identifying paths that have lost executability due to upper-level pruning. When a path contains pruned branches, it is marked as invalid and removed from the record. Order correction and deduplication processes sort and deduplicate the remaining valid candidate paths. Deduplication identifies functionally equivalent duplicate paths, and a path signature comparison algorithm is used to detect path similarity. The output of the candidate path set is the final organized and formatted set of paths after review, correction, and deduplication, providing sufficient decision-making basis for subsequent path selection and optimization.

[0120] In one optional implementation, Monte Carlo simulation is performed on the candidate path set. Sampling is performed based on the success probability and time consumption of the corresponding attack actions, and the sampling results are accumulated in conjunction with the alarm time-domain joint penalty. The statistical distribution is then summarized into a path credibility benefit profile, including:

[0121] For candidate paths, extract success probability and time consumption labels corresponding to the attack actions according to their state transition order, and establish a time-domain constraint list.

[0122] Monte Carlo simulation is performed on the candidate path based on the success probability label and the time consumption label. In each simulation, the attack action is sampled for success and failure according to the state transition order to form a simulation timeline. While accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. The penalty is synchronously deducted from the accumulated path gains in the simulation timeline to obtain the simulation result record.

[0123] Based on the simulation results, the candidate paths are statistically summarized to form a statistical distribution. The frequency of occurrence and penalty intensity of each segment are accumulated under the correspondence with the statistical distribution to generate an intermediate profile description.

[0124] Based on the intermediate profile description, scale alignment and temporal mapping are performed to map the penalized path gains and time consumption to a unified temporal benchmark. During the mapping process, weight correction is performed according to the alarm weight in the temporal domain. The statistical distribution after completing the temporal mapping and weight correction is summarized into a path credibility gain profile.

[0125] like Figure 2 As shown, the method includes:

[0126] The extraction of state transition order for candidate paths is based on a traversal analysis of the directed graph structure of the path execution flow. Each candidate path contains multiple state nodes, which are connected by transition edges to form an execution sequence. The extraction of the state transition order employs a depth-first search algorithm, traversing the path from its initial state according to the priority of the transition edges to generate a complete state access sequence. During the traversal, the access order, predecessor state, successor state, and other topological relationship information of each state node are recorded. The correspondence between attack actions and state transitions is established through an action mapping table. The mapping table uses state transition edges as indices and records information such as the specific attack action type, action parameters, and execution conditions corresponding to each transition.

[0127] Success probability annotations are extracted based on a comprehensive evaluation of historical execution data and an expert knowledge base. Historical execution data provides statistical information on the actual success rate of attack actions under different environmental conditions, while the expert knowledge base contains domain experts' empirical judgments on the success probabilities of various attack actions. Probability annotations employ Bayesian inference, using historical statistical data as prior probabilities and updating posterior probabilities by combining them with current environmental characteristics. Time consumption annotations are established based on the time characteristic analysis and performance modeling of action execution, statistically analyzing the time consumption distribution of attack actions under different execution conditions, including statistics such as minimum execution time, maximum execution time, and average execution time. Time consumption annotations are described using a parametric distribution model, supporting multiple distribution types such as normal, exponential, and gamma distributions.

[0128] The temporal constraint list is established based on a comprehensive configuration of the time characteristics of the attack actions and business constraints. Temporal constraints include restrictions across multiple dimensions, such as execution time windows, timeout thresholds, concurrency limits, and priority scheduling. The execution time window defines the allowed execution time range for the attack action, taking into account time-related constraints such as peak business periods, maintenance periods, and security policies. The constraint list is organized in a hierarchical structure, supporting constraint configurations at different granularities, including global constraints, path-level constraints, and action-level constraints.

[0129] The Monte Carlo simulation is executed by running multiple simulations of candidate paths using a random sampling method. Each simulation run creates an independent execution environment, including components such as a virtual resource pool, a simulated clock, and a state tracker. In each simulation run, the attack actions are executed sequentially according to the state transition order, and success or failure is determined by sampling for each action. The sampling process uses a pseudo-random number generator to generate random numbers based on the success probability of each action. The execution result of the action is determined by comparing the random numbers with a probability threshold. The simulation timeline is constructed based on the time consumption of each action execution, and the execution time of each attack action is obtained by randomly sampling the time consumption data.

[0130] The cumulative calculation of path benefits is updated in real time based on the action execution results and the benefit model. The benefit model defines the benefit contribution generated after the successful execution of different attack actions. The accumulation process adopts an incremental calculation method; whenever an attack action is successfully completed, its benefit contribution is added to the current cumulative benefit. The interruption information recording mechanism captures various anomalies and interruption events that occur during the simulation. The recorded content includes detailed information such as the precise time and location of the interruption, the attack action in which the interruption occurred, the interruption cause classification, and the interruption severity. The calculation process of alarm temporal joint penalty integrates the penalty rules and weight configuration in the temporal constraint list. The penalty calculation considers multiple factors such as the time sensitivity of the interruption, the scope of impact, and the difficulty of recovery.

[0131] The synchronous deduction operation adjusts the accumulated path gains in real time on the simulation timeline. The deduction process employs a time alignment mechanism to ensure that penalty deductions are executed at the correct time. The deduction algorithm supports different methods such as one-time deduction, phased deduction, and decaying deduction. The simulation result record summarizes the complete execution information of a single simulation run. The record structure includes key components such as path identifier, simulation parameters, execution trajectory, gain changes, interruption events, and final results.

[0132] Statistical aggregation and processing are performed based on the results of multiple simulation runs. The aggregation process employs a hierarchical statistical method, performing statistical calculations at the action, path, and global levels. The statistical distribution is generated using methods such as histograms and kernel density estimation to convert discrete simulation results into continuous probability distribution functions. Segmentation and frequency statistics are performed using adaptive binning based on the numerical range of the simulation results. The number of simulation results included in each interval is counted, and the frequency and relative frequency of occurrence are calculated. The generation of intermediate profiles transforms the statistical distribution results into a structured descriptive format, encompassing multiple aspects such as distribution type identification, parameter estimation, feature description, and quality assessment.

[0133] Scale alignment addresses the differences in revenue and time dimensions among different candidate paths. Revenue scale alignment maps the revenue values ​​of different paths to a unified numerical range using standardization or normalization methods. Time scale alignment addresses the differences in execution time spans among different paths, employing time interpolation and resampling techniques to align time series to a unified time grid. Time domain mapping maps the penalized path revenue and time consumption to a unified time domain reference. The mapping process uses a time axis transformation algorithm to convert the local time coordinates of each path into globally unified time coordinates.

[0134] The weight correction process adjusts the mapping results based on the configuration information of the alarm weights in the time domain. Weight correction considers the differences in importance across different time periods, with higher weight coefficients for benefits and penalties in critical time periods. The correction algorithm uses a weighted average method, multiplying the original value by the weight coefficient of the corresponding time period to obtain the corrected value. The final aggregation of the path credibility benefit profile integrates the statistical distributions of the completed time-domain mapping and weight correction. The aggregation process uses a weighted fusion algorithm to combine the statistical distributions of multiple candidate paths according to their importance weights. The final profile is presented in the form of a multi-dimensional probability distribution, including multiple feature spaces such as benefit dimension, time dimension, and risk dimension.

[0135] In one optional implementation, while accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. This penalty is then synchronously deducted from the accumulated path gains in the simulation time axis to obtain simulation result records including:

[0136] While accumulating path benefits, interruption information is recorded, and the time position corresponding to the accumulation process is used as a unified time reference. A fixed reference relationship is established between the interruption information and the unified time reference.

[0137] The time-domain constraint list is invoked on the unified time base, and the time interval corresponding to the alarm trigger time domain is located according to the unified time base. According to the conventions in the time-domain constraint list regarding the start and end time domains, alarm trigger time domains, and alarm weight time domains, the joint penalty of the alarm time domain corresponding to the alarm trigger time domain is calculated.

[0138] The alarm time-domain joint penalty is applied to the accumulated path gains in the simulation time axis, and the accumulated value at each time position is deducted in real time using the same time step and time position as the accumulated path gains.

[0139] Based on the cumulative result after real-time deduction and the interruption information, corresponding simulation result information is generated, and the simulation result information is written into the result record in a form consistent with the unified time base and object identifier.

[0140] The cumulative path revenue uses an incremental calculation mechanism, acquiring the revenue contribution value at each time point during path execution. A sliding window algorithm divides the time interval into fixed-length segments, and a status monitoring module collects revenue data in real time. Revenue includes direct and indirect revenue, and a cumulative revenue array is maintained to record the total cumulative amount at each time point.

[0141] Interruption information is stored in a structured format, including fields such as interruption time, location coordinates, cause category, severity, and duration. The interruption location is determined using both the percentage of execution progress and absolute time coordinates. Cause categories are hierarchically coded, including categories such as insufficient resources, technical failures, external interference, and constraint conflicts. Severity is quantified using numerical ratings, and duration records the complete time span from occurrence to recovery.

[0142] The unified time base is standardized based on the time scale of accumulated revenue, and uses a high-precision timestamp format to support millisecond-level accuracy. It is divided into equal intervals according to a preset step size, starting from the beginning of path execution. Time zone information and daylight saving time parameters are included to ensure consistency, and a time synchronization mechanism and calibration with a standard server are used to eliminate clock drift.

[0143] Interrupt information and the time base are linked through an index mapping to establish a fixed reference relationship. Each interrupt record is associated with a time base position by a unique identifier and stored in the reference table as key-value pairs. A bidirectional index structure is used to support bidirectional lookups, and offsets are used to handle time misalignment.

[0144] The time-domain constraint list is accessed quickly based on the time base index. The list is organized in a tree structure and uses a binary search algorithm to locate constraint nodes. When dealing with overlapping time intervals, a constraint merging algorithm is used to generate comprehensive conditions.

[0145] Alarm triggering time-domain identification is based on the constraint list to determine triggering conditions, including threshold-based, trend-based, and anomaly-based triggers. Threshold-based triggers are determined by comparing monitoring data with preset thresholds; trend-based triggers analyze data change trends; and anomaly-based triggers are based on historical data to establish normal patterns and detect deviations. Multi-level filtering is used to avoid false triggers.

[0146] Alarm weights are calculated in the time domain based on quantified processing of weight configuration parameters, taking into account dimensions such as time urgency, business importance, and impact scope. Time urgency is determined by distance from critical nodes, business importance by the degree of operational criticality, and impact scope by the affected area. A weighted average method is used for dynamic adjustment.

[0147] The alarm time-domain joint penalty calculation comprehensively considers severity, duration, and weighting coefficients. A piecewise function model is used to classify penalty levels based on severity, duration is modeled using a time decay function, and weighting coefficients serve as adjustment parameters. The joint penalty value is obtained by multiplying the base penalty by the time factor and then by the weighting coefficients.

[0148] Real-time deduction operations are processed synchronously on the simulation timeline with consistent time steps, employing a time alignment mechanism to ensure precise matching between deduction time and alarm occurrence time. In-place modifications to the revenue accumulation array utilize atomic operations to ensure data consistency.

[0149] The cumulative value is deducted in real time using an incremental update strategy to optimize efficiency. The impact is propagated from the deduction position backward. Deduction records are saved in the form of operation logs, recording information such as time, location, amount, and reason to support retrospective auditing.

[0150] The simulation results are generated based on a comprehensive analysis of the cumulative results after deduction and interruption information, including performance metrics, anomaly statistics, revenue / loss analysis, and time efficiency evaluation. Performance metrics are calculated by comparing the difference in revenue before and after deduction, anomaly statistics are categorized by cause, frequency, and degree of impact, and loss analysis identifies the main sources of loss.

[0151] Time efficiency is evaluated by analyzing metrics such as execution time, waiting time, and interruption time, quantifying efficiency through the ratio of actual to ideal execution time. Result records are written in a standardized format to ensure readability, including metadata and data content. Transactional processing is employed, encompassing data validation, format conversion, storage execution, and index updates. Validation checks integrity and validity, conversion supports multi-storage backend adaptation, and pre-write logging ensures security.

[0152] The record storage employs a tiered architecture to optimize performance and cost, storing hot data on high-speed media, warm data on standard media, and cold data on archive media. Automatic migration is based on access frequency and data age, and includes data compression and deduplication to reduce storage footprint.

[0153] In one optional implementation, the candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output, including:

[0154] Based on the path credible benefit profile, a profile reference list is established for each candidate path according to the object identifier, and the comprehensive benefit index is calculated for each candidate path according to the statistical distribution in the path credible benefit profile under a unified time domain benchmark. The comprehensive benefit index is jointly judged with the executability status of the candidate path to form an iterative evaluation record.

[0155] Based on the iterative evaluation record, candidate paths are systematically screened. For candidate paths whose comprehensive benefit index is lower than the preset benefit threshold or triggers a feasibility denial judgment, a replacement strategy is executed, and the replaced paths are written into the replacement record.

[0156] The candidate path set is iteratively updated based on the replacement record. When a path triggers a change in the feasibility boundary after the update, the path feasibility constraint is immediately invoked to review it. The comprehensive benefit index is finally sorted based on the updated candidate path set, and the path with the best comprehensive benefit in the path credibility benefit profile is selected from the candidate paths that meet the path feasibility constraint as the optimal path.

[0157] The data structure for the path reliability and profitability profile stores historical execution data, risk assessment parameters, and profitability distribution characteristics in a multi-dimensional matrix. When building the profile reference list, the corresponding risk correction indicator records, including execution delay coefficients, cost volatility, failure probability, and resource utilization, are located using path identifiers. An index lookup mechanism is employed to quickly locate data based on path feature vectors. The profile reference list is organized using a nested dictionary structure, and data integrity checks are performed. Missing values ​​are filled with historical averages, and outliers are smoothed using statistical methods.

[0158] Establishing a unified time-domain benchmark requires standardizing the execution time dimension of candidate paths, mapping the execution time of all paths to a unified benchmark time scale, and determining the scale using the least common multiple principle. Short-cycle paths are simulated and their cumulative returns are calculated through repeated execution, while long-cycle paths have their expected returns calculated proportionally.

[0159] The comprehensive return index is calculated based on the statistical distribution characteristics in the path credible return profile. Each path corresponds to a return probability distribution, including parameters such as mean, variance, skewness, and kurtosis. A multi-factor adjustment model is used for risk adjustment, modifying the basic expected return value through factors such as delay coefficient, cost volatility, and failure probability to obtain the risk-adjusted net return value.

[0160] Executability assessment involves multi-dimensional evaluation. Resource availability checks obtain the status of resources such as CPU, memory, storage, and network through real-time monitoring, and compare resource requirements with available resources to determine executability. Technical feasibility assessment checks software version compatibility, API interface availability, etc. Time window matching analysis analyzes the compatibility between path execution time and business time constraints, ensuring that execution time is within the allowable range through time interval overlap detection.

[0161] The joint evaluation employs a multi-dimensional scoring mechanism to comprehensively assess revenue indicators and executability status. Weights are assigned to each dimension, and a weighted summation is used to calculate the total score. Paths exceeding a preset threshold are identified as feasible candidates. Iterative evaluation records are stored in a structured format, including fields such as basic path information, revenue evaluation, executability evaluation, and time information. Transactional operations ensure data consistency, optimistic locking handles concurrent access, and version control supports historical queries.

[0162] Ordered screening sorts and categorizes evaluation records using a multi-keyword sorting method. The primary keyword is the comprehensive benefit index, while secondary keywords include executability score and execution complexity. The preset benefit threshold is dynamically adjusted based on historical performance data, and the baseline is determined using a quantile method.

[0163] The feasibility rejection mechanism employs a multi-level check mechanism: the first level checks key constraints, the second level checks important constraints, and the third level checks general constraints. Rejection is triggered only if a problem is found during the first level check. The replacement strategy utilizes a diversified path regeneration mechanism, intelligently matching based on failure causes. The generation algorithm employs heuristic search, exploring new implementation paths while maintaining functional objectives. A multi-objective optimization strategy is adopted, considering maximizing benefits, minimizing risks, and minimizing resource consumption. A detailed logging mechanism is used for replacement records, including trigger time, original path information, and replacement reasons.

[0164] The candidate path set employs an incremental update mechanism, marking replaced paths as ineffective and adding new paths as active. A double-buffering mechanism improves update efficiency. Feasibility boundary change detection utilizes real-time monitoring and an event-driven mechanism, monitoring changes in resource usage, technical environment, and business requirements to trigger boundary change events. The review process re-executes the complete evaluation process and updates the path status.

[0165] The final ranking employs a multi-level strategy, consisting of three stages: preliminary ranking, fine-grained ranking, and stability adjustment. Path dependency analysis utilizes graph theory algorithms to model strongly connected components, critical paths, and bottleneck nodes, avoiding circular dependencies.

[0166] The optimal path selection comprehensively considers both single-path performance and overall coordination, employing a combination of greedy strategies and local search to maximize overall benefits while satisfying feasibility constraints. Performance prediction uses a machine learning model to estimate execution results, and actual performance data is fed back into the path profile to form a closed-loop mechanism for continuous optimization.

[0167] A second aspect of this invention provides a network security penetration testing path intelligent planning system, comprising:

[0168] The first unit is used to obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of available channels based on the security content automation protocol, perform joint verification of consistency timestamps on the extraction results, and construct a multi-attribute attack graph based on the meta-attributes of the available channels using the data that passes the verification.

[0169] The second unit is used to establish a path planning objective function based on the multi-attribute attack graph, and to map the access control policy and connectivity restriction as constraints, and the path planning objective function as path feasibility constraints.

[0170] The third unit is used to perform hierarchical expansion of the multi-attribute attack graph using a heuristic search strategy based on the path feasibility constraints, pruning branches that do not meet the strategy constraints to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints.

[0171] The fourth unit is used to perform Monte Carlo simulation on the candidate path set, sample according to the success probability and time consumption of the corresponding attack action, accumulate the sampling results in combination with alarm time-domain joint penalty, and summarize the statistical distribution into a path credibility benefit profile.

[0172] The fifth unit is used to iteratively update the candidate path set based on the path credibility benefit profile, and after the iteration is completed, output the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile.

[0173] A third aspect of the present invention provides an electronic device, comprising:

[0174] processor;

[0175] Memory used to store processor-executable instructions;

[0176] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0177] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0178] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intelligent path planning in network security penetration testing, characterized in that, include: Obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of available channels based on the security content automation protocol, and perform joint consistency timestamp verification on the extraction results. The timestamp verification ensures the timeliness and consistency of the mapping relationship. Expired mapping relationships are identified by comparing rule update time, graph structure modification time, and mapping establishment time. The consistency verification verifies the logical correctness and semantic rationality of the mapping relationship, including rule coverage check, mapping conflict detection, and constraint integrity verification. The data that passes the verification is used to construct a multi-attribute attack graph based on the meta-attributes of the available channels. A path planning objective function is established based on the multi-attribute attack graph, which is represented in the form of a directed graph. Nodes represent attack states, and edges represent state transition actions. In the multi-attribute attack graph, an expected product binding metric related to the attack actions is set. The metric is in vector form. The expected product binding metric is set as a multi-dimensional evaluation index for each attack action, which includes at least attack power, execution complexity, and risk exposure. The access control policy and connectivity restrictions are used as constraints, and the path planning objective function is mapped to path feasibility constraints. Based on the path feasibility constraints, a heuristic search strategy is used to perform layered expansion of the multi-attribute attack graph. The layered expansion order is established based on the hierarchical organization of the topology of the multi-attribute attack graph. The layered expansion starts from the initial state node, and the nodes in the graph are arranged in layers according to the shortest path length from the initial state. The layering process adopts a breadth-first traversal algorithm. The zeroth layer contains the initial state node, and the first layer contains all adjacent nodes that can be directly reached from the initial state, forming a complete hierarchical structure. Branches that do not meet the policy constraints are pruned to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the policy constraints. Among them, depth suppression is performed based on the pruning record and the hierarchical constraint list. Branches that trigger the depth threshold are pruned so that subsequent layered expansion continues only on the effective branches that have not been suppressed, thereby suppressing the blind expansion of excessively deep branches. Monte Carlo simulations were performed on the candidate path set. Sampling was conducted based on the success probability and time consumption of the corresponding attack actions. The sampling results were accumulated by combining the alarm time-domain joint penalty, and the statistical distribution was summarized into a path credibility benefit profile, including: For candidate paths, extract success probability and time consumption labels corresponding to the attack actions according to their state transition order, and establish a list of temporal constraints. Monte Carlo simulation is performed on the candidate path based on the success probability label and the time consumption label. In each simulation, the attack action is sampled for success and failure according to the state transition order to form a simulation timeline. While accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. The penalty is synchronously deducted from the accumulated path gains in the simulation timeline to obtain the simulation result record. Based on the simulation results, the candidate paths are statistically summarized to form a statistical distribution. The frequency of occurrence and penalty intensity of each segment are accumulated under the correspondence with the statistical distribution to generate an intermediate profile description. Based on the intermediate profile description, scale alignment and temporal mapping are performed to map the penalized path gains and time consumption to a unified temporal benchmark. During the mapping process, weight correction is performed according to the alarm weight temporal domain. The statistical distribution after the temporal mapping and weight correction is summarized into a path reliable gain profile. The candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output.

2. The method according to claim 1, characterized in that, Based on the multi-attribute attack graph, a path planning objective function is established, and the access control policy and connectivity restrictions are used as constraints. The path planning objective function is mapped to path feasibility constraints, including: In a multi-attribute attack graph, an expected value binding metric related to the attack action is set. This metric is configured as a multi-dimensional evaluation index assigned to each attack action. Based on this metric, sequential accumulation and expectation processing are performed. The sequential accumulation process calculates the cumulative benefit of the attack path using a dynamic programming algorithm, propagating the accumulated value step-by-step along directed edges from the source node of the attack graph. The expectation processing performs probability-weighted adjustments on the accumulated results to handle uncertainties in the execution process. Expected values ​​are calculated based on the success probability distribution and conditional probability dependencies of the attack action, forming a bound target metric set. When constructing the path planning objective function, a transition constraint set is synchronously referenced to inherently constrain the executability of the action and state transitions, resulting in a metric binding result used for constraint mapping. The transition constraint set references ensure the legality and executability of the attack path, and the constraints include state transition conditions, resource availability constraints, and time window limits. The metric binding result generates an integrated sequential accumulation result, expectation processing result, and transition constraint verification result, using a multi-level data structure that includes attack path identifiers, node edge metric information, specific metric parameters, and constraint conditions. Access control policies and connectivity restrictions are extracted from the unified data description to generate a set of decidable conditions. Based on the set of decidable conditions, a decision rule is given for each network access control decision condition. The decision rule is mapped to the node state and edge feasibility state of the multi-attribute attack graph to form a constraint relationship. A synchronization relationship with the unified data description is established based on the results of timestamp verification and consistency verification. The constraint relationship and the synchronization relationship are updated consistently to obtain a set of constraint relationships for path constraints. The metric binding result is integrated with the set of constraint relationships for constraint mapping to generate path feasibility constraints.

3. The method according to claim 2, characterized in that, In a multi-attribute attack graph, sequential product expectation binding metrics related to the attack action are set. Based on these sequential product expectation binding metrics, sequential accumulation and expectation processing are performed to form a bound target metric set, including: The expected value of the sequence product corresponding to the attack action is bound to the metric value in the state transition order. The transition intrinsic constraints of the attack action are synchronously recorded on the edges and nodes of the multi-attribute attack graph. The set of condition states corresponding to the transition intrinsic constraints is indexed according to the order of the transitions to form an initial metric binding list. Based on the initial metric binding list, the attack actions are sequentially accumulated, and the set of preconditions and trigger conditions bound to the attack actions are called for executability verification; when the verification passes and the end of the path is reached, the sequential accumulation result covering the entire path is output; Based on the sequential cumulative results, expectation processing is performed, the transfer inherent constraints are continuously referenced, and the executability of each position in the sequential cumulative results is confirmed. When the executability of any position changes due to the change of the condition state set, the change is synchronously written back to the record entry corresponding to the sequential cumulative results and the initial metric binding list, until all affected positions are consistently updated to form the bound target metric set.

4. The method according to claim 1, characterized in that, Based on the path feasibility constraints, a heuristic search strategy is used to perform layered expansion of the multi-attribute attack graph, pruning branches that do not meet the strategy constraints to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints, including: Based on path feasibility constraints, a layered expansion order is established from the initial state of the multi-attribute attack graph, generating a queue to be expanded corresponding to each layer, and the policy constraints and executability judgment conditions corresponding to the items to be expanded are recorded as a hierarchical constraint list. Calculate the heuristic evaluation order based on the hierarchical constraint list to form a heuristic sequence, and establish a correspondence between the heuristic sequence and the hierarchical constraint list; perform hierarchical expansion based on the correspondence, refer to the corresponding hierarchical constraint list for performance verification, prune branches that fail the verification, and write the pruning reason, pruning position and the referenced hierarchical constraint into the pruning record; Depth suppression is performed based on the pruning record and the hierarchical constraint list. Branches that trigger the depth threshold are pruned so that subsequent hierarchical expansion continues only on the valid branches that are not suppressed, thereby suppressing the blind expansion of excessively deep branches. When any branch meets the determination condition of the path feasibility constraint, the state transition sequence of the branch is registered as a candidate path, and the condition is written into the candidate path record. Based on the pruning records, the candidate path records are checked for consistency, and registration items that have lost their executability due to upper-level pruning are deleted. The remaining registration items are corrected in order and deduplicated, and a set of candidate paths that meet the policy constraints is output.

5. The method according to claim 1, characterized in that, While accumulating path gains, the interruption location and interruption reason are recorded. The time-domain constraint list is called to calculate the alarm time-domain joint penalty corresponding to the alarm trigger time domain. This penalty is then deducted synchronously from the accumulated path gains in the simulation time axis. The simulation results record includes: While accumulating path benefits, interruption information is recorded, and the time position corresponding to the accumulation process is used as a unified time reference. A fixed reference relationship is established between the interruption information and the unified time reference. The time-domain constraint list is invoked on the unified time base, and the time interval corresponding to the alarm trigger time domain is located according to the unified time base. According to the conventions in the time-domain constraint list regarding the start and end time domains, alarm trigger time domains, and alarm weight time domains, the joint penalty of the alarm time domain corresponding to the alarm trigger time domain is calculated. The alarm time-domain joint penalty is applied to the accumulated path gains in the simulation time axis, and the accumulated value at each time position is deducted in real time using the same time step and time position as the accumulated path gains. Based on the cumulative result after real-time deduction and the interruption information, corresponding simulation result information is generated, and the simulation result information is written into the result record in a form consistent with the unified time base and object identifier.

6. The method according to claim 1, characterized in that, The candidate path set is iteratively updated based on the path credibility benefit profile, and after the iteration is completed, the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile is output, including: Based on the path credible benefit profile, a profile reference list is established for each candidate path according to the object identifier, and the comprehensive benefit index is calculated for each candidate path according to the statistical distribution in the path credible benefit profile under a unified time domain benchmark. The comprehensive benefit index is jointly judged with the executability status of the candidate path to form an iterative evaluation record. Based on the iterative evaluation record, candidate paths are systematically screened. For candidate paths whose comprehensive benefit index is lower than the preset benefit threshold or triggers a feasibility denial judgment, a replacement strategy is executed, and the replaced paths are written into the replacement record. The candidate path set is iteratively updated based on the replacement record. When a path triggers a change in the feasibility boundary after the update, the path feasibility constraint is immediately invoked to review it. The comprehensive benefit index is finally sorted based on the updated candidate path set, and the path with the best comprehensive benefit in the path credibility benefit profile is selected from the candidate paths that meet the path feasibility constraint as the optimal path.

7. A network security penetration testing path intelligent planning system, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to obtain the security content automation protocol corresponding to the target network, extract access control policies and meta-attributes of available channels based on the security content automation protocol, perform joint verification of consistency timestamps on the extraction results, and construct a multi-attribute attack graph based on the meta-attributes of the available channels using the data that passes the verification. The second unit is used to establish a path planning objective function based on the multi-attribute attack graph, and to map the access control policy and connectivity restriction as constraints, and the path planning objective function as path feasibility constraints. The third unit is used to perform hierarchical expansion of the multi-attribute attack graph using a heuristic search strategy based on the path feasibility constraints, pruning branches that do not meet the strategy constraints to suppress the blind expansion of excessively deep branches and form a set of candidate paths that meet the strategy constraints. The fourth unit is used to perform Monte Carlo simulation on the candidate path set, sample according to the success probability and time consumption of the corresponding attack action, accumulate the sampling results in combination with alarm time-domain joint penalty, and summarize the statistical distribution into a path credibility benefit profile. The fifth unit is used to iteratively update the candidate path set based on the path credibility benefit profile, and after the iteration is completed, output the optimal path that satisfies the path feasibility constraints and has the best overall benefit in the path credibility benefit profile.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images