Full-automatic penetration testing method based on large language model

Abstract

The invention discloses a full-automatic penetration testing method based on a large language model, and relates to the field of network security. The method comprises the following six core steps: 1) constructing a host asset model through multi-source data acquisition, integrating Shodan, Fofa and eagle map platform data, and performing LLM verification; 2) calling an NVD database to identify vulnerabilities, and secondarily verifying CVE validity by using LLM; 3) dynamically disassembling the penetration task based on a collaborative penetration decision tree (SPDT), and fusing ATTamp; guiding task planning by a CK technology and tactics map; (4) a multi-agent engine is adopted to execute a command, three interaction modes of Browser-use / CLI / GUI are supported, a Kali virtual machine is connected through an SSH to execute command line operation, and a graphical tool is driven based on a multi-mode model; according to the method, the problem that the automation degree of traditional penetration testing is low is solved, and the full-process automation of the penetration testing is achieved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, specifically to a fully automated penetration testing method based on LLM. Background Technology

[0002] With the advancement of technology, computer networks are developing rapidly at an unprecedented pace. While enjoying the convenience brought by the Internet of Things, people also face the risk of cyberattacks. Especially in the current era of continuous digitalization, the attack surface of networks is expanding dramatically, and vulnerability exploitation has become the main means for intruders to break through defenses. The continuously surging number of vulnerabilities, the huge time lag between vulnerability discovery and patch release, and the automation, stealth, and intelligence of vulnerability exploitation scripts aided by artificial intelligence all make the network defense situation against vulnerabilities increasingly severe. However, penetration testing, as the main means in the existing defense system, has many shortcomings. Traditional manual penetration testing, due to the scarcity of experts, long cycles, and high costs, can no longer meet the needs of large-scale, continuous security assessments, nor can it adapt to the rapidly evolving attack and defense requirements. Existing automated tools are limited by fixed rules, high false positive rates, and the need for manual parameter tuning, making it difficult to achieve a closed-loop automation of the entire process of "information collection—vulnerability identification—task planning—command execution—result verification" in complex network environments. Therefore, we urgently need an intelligent penetration testing system that can reduce reliance on experts, adapt to complex network environments, and automate the entire process to significantly improve vulnerability detection efficiency and accuracy, and effectively respond to intelligent vulnerability exploitation attacks.

[0003] This invention proposes a fully automated penetration testing method based on LLM (Limited Least Mechanism), aiming to provide an integrated service for information gathering, vulnerability identification, task planning, and command execution, achieving a high-precision, high-efficiency, and self-optimizing fully automated penetration testing process. Specifically, it includes: automatically perceiving the vulnerability of the target system through multi-data source information extraction and integration and LLM verification; constructing a Collaborative Penetration Decision Tree (SPDT) by integrating ATT&CK (Attack, Trial, and Critical) technical and tactical maps with LLM, effectively breaking down penetration tasks; building a multimodal fully automated command execution engine through the fusion and collaboration of multiple agents, achieving fully automated vulnerability exploitation; introducing intelligent reflection technology to automatically analyze the execution logs and feedback of penetration results, continuously updating and optimizing the penetration knowledge base; and automatically and modularly generating penetration test reports, clearly displaying the penetration path, risk assessment, and remediation suggestions. Summary of the Invention

[0004] In view of this, this invention proposes a fully automated penetration testing method based on LLM, which solves the problems mentioned in the background art of existing penetration testing techniques being highly dependent on experts, difficult to adapt to real-world scenarios, and unable to achieve full automation.

[0005] A fully automated penetration testing method based on LLM includes the following steps: Preliminary step: Penetration knowledge graph construction; Step 1: Construct a host asset model using multi-source data acquisition and aggregation technology; Step 2: Use multi-dimensional intelligence aggregation and analysis technology to intelligently identify exploitable vulnerability types; Step 3: Decompose penetration subtasks based on SPDT; Step 4: Execute fully automated penetration testing commands based on multiple proxies; Step 5: Modular penetration test report generation and assembly; Step 6: Use Zhiyuan Reflection Technology to improve and optimize the penetration knowledge graph.

[0006] Preferably, in the preliminary steps, the process of constructing the penetration knowledge graph includes: Tactics, techniques, sub-techniques, mitigation methods, and tools from the ATT&CK official website are crawled and mapped to a graph; The components, versions, CVE vulnerability numbers, and descriptions stored on the official CVE website are crawled and mapped to the graph.

[0007] Preferably, in step 1, the process of constructing the host asset model using multi-source data acquisition and aggregation technology includes: After entering the target IP address, perform an IP validity check. After the verification is passed, the open APIs of Shodan, Fofa, and Hunter are called to collect the Autonomous System Number, Country Code, Open Port Number, Protocol Type, Protocol Fingerprint, Subdomain Information, Product Name, Product Version, Product Issuing Company, and Protocol Risk Marker of the target IP. If conflicting information is detected from various platforms, a timestamp-based priority strategy is used to deduplicate the data, retaining the latest result as the initial version of the host asset model. If it is detected that IP-related information has not been included by any platform, initialize the empty host asset model; The supplementary collection commands are executed using the multi-agent-based fully automated penetration command execution technique described in step 4. By integrating the existing host asset model with the results of supplementary collection commands using LLM, the final host asset model is obtained.

[0008] Preferably, in step 2, the process of intelligently identifying exploitable vulnerability types using multi-dimensional intelligence aggregation and analysis technology includes: Parse the component and version information in the host asset model obtained in step 1, call the NVD official API to query the associated CVE number and description, and store it in the host asset model containing CVE information; LLM is used for secondary analysis and verification. An existing host asset model containing CVE information is input, and the LLM filters out the erroneous parts of the query. The output is saved as the final host asset model containing CVE information.

[0009] Preferably, in step 3, the process of splitting penetration subtasks based on SPDT includes: Create an SPDT root node containing the exploitable vulnerabilities and the final objective to be achieved. Node attributes include node number, task description, and completion status. Successful penetration cases of relevant vulnerabilities are retrieved from the penetration knowledge graph using the memory retrieval logic of the Zhiyuan reflection technology described in step 6, and used as enhanced input for LLM; By integrating the cases and root node objectives extracted from the penetration knowledge graph, the next task node is dynamically generated using LLM. The node attributes include parent node number, ATT&CK tactics, ATT&CK techniques, ATT&CK sub-techniques, task description, and completion status. Recursively traverse the existing SPDT and connect this node to the output parent node; When the breadth of child nodes of a node in SPDT exceeds a preset threshold or the number of decision loops exceeds the limit, the penetration path is determined to be unreachable, the root node is marked as "failed" and the process is terminated. If not, proceed to step 4. After execution, update the current node's completion status to "succeed" or "failed" based on the result. Determine whether the penetration objective described in the root node has been completed. If completed, update the completion status of the root node to "succeed" and terminate the process. If not completed, return to the "Dynamically generate the next task node using LLM" step and repeat the above process.

[0010] Preferably, in step 4, the fully automated penetration testing command execution process based on multiple agents includes: LLM is used to transform structured commands. The attributes of structured commands include the tool usage scenario, tool name, and specific command. In this step, the specific task, the list of available tools and their scenarios are input, and LLM generates multi-step structured commands. This section presupposes three tool usage scenarios: Browser-use, CLI (command line tool), and GUI (graphical interface tool). In the Browser-use scenario, there is only one tool, Browser-use-Agent. Commands are input in natural language, and Browser-use-Agent is scheduled to perform fully automatic command execution. When Browser-use-Agent executes a task, it first creates an agent. This component serves as the core control unit of the Browser-use-agent module, responsible for coordinating the scheduling and task flow of various functional modules. After receiving the penetration task specified by the user, the agent transmits its input to the LLM, which combines the current environment state and context information to generate the next operation instruction. Subsequently, the agent calls the behavior executor, which automatically drives the browser to complete the specific operation according to the instructions output by the model. In the CLI scenario, a pre-prepared Kali virtual machine is integrated with 63 tools related to the penetration mission, an LLM generation tool and corresponding command-line commands. SSH is used to connect to the Kali attack virtual machine to execute commands. In the GUI scenario, the tools include four types: Burp Suite, Ant Sword, Edge browser, and Firefox browser. The LLM generation tool and the corresponding natural language description commands are used to call the GUI-Agent to execute commands. When the GUI-Agent executes commands, the system interacts with the multimodal large model based on screenshots. The large model outputs predefined operation types, including nine types: left-click, left-double-click, right-click, drag and rotate, hotkey, keyboard input, scrolling, waiting, and completion. The predefined operation types are represented by vector coordinates and operation command key-value pairs, in the format {operation_type:str, start_box:[x1, y1], end_box[x1, y1], key:str, content:str, direction:str}, where operation_type represents the operation type, start_box represents the starting position, end_box represents the ending position, key represents keyboard input, content represents text content, and direction represents the operation direction. This module uses the pyautogui component to precisely execute graphical interface interactions after the large model is output.

[0011] Preferably, in step 5, the modular penetration test report generation and assembly process includes: Generate a PDF penetration test report cover based on IP address and date; Based on the host asset model containing CVE vulnerability information, a host basic information section is generated using a large language model; Based on the SPDT generated in step 3 and the specific implementation process recorded in step 4 during the penetration process, LLM is used to generate structured chapters of the specific vulnerability penetration process report. Based on the host asset model containing CVE vulnerability information, use LLM to generate other exploitable penetration path sections in .md format; Real-time acquisition of CVSS and business impact, combined with a host asset model containing CVE vulnerability information, and LLM is used to generate a summary table of vulnerability counts and risk levels. The process for real-time acquisition of CVSS and business impact and calculation of risk levels is as follows: Using the product name in the host asset model and the version field as the query key, the NVD official API is called in real time to return the corresponding CVSS base score and vector string. Based on the associated domain names, port product levels, protocol risk indicators, and Web service indicators in the host asset model, the Business Impact Factor (BIF) is calculated in real time according to preset weights. Its mathematical expression is as follows:

[0012] Among them, d is the weight value of the top-level domain mapping, l max The maximum value among all product levels corresponding to the port; r is 1 if there is a protocol risk flag and 0 otherwise; w is 1 if there is a Web service flag and 0 otherwise; w1, w2, w3, and w4 are preset weights that sum to 1. The CVSS base score is multiplied by the BIF to obtain a continuous risk score of 0-10, and then mapped to three levels of low risk, medium risk, and high risk according to the thresholds of 0.0-0.3, 0.3-0.7, and 0.7-1.0. The above chapters are converted into structured text, with each chapter in the form of "title + body text" and containing subheadings. The text is then rendered into PDF using a template engine to form the final penetration test report.

[0013] Preferably, in step 6, the process of using Zhiyuan reflection technology to improve and optimize the penetration knowledge graph includes: Memory storage logic: The generated structured penetration test report is split into vulnerability exploitation step blocks using a dual regular expression matching algorithm, and the reusable vulnerability exploitation steps that have been successfully penetrated are extracted to form intelligent nodes. After being connected to the corresponding vulnerabilities in the penetration knowledge graph, the penetration knowledge graph is updated in a timely manner. The details of the double regular expression matching algorithm are as follows: First-level matching: re.compile(r'####.*?--', re.DOTALL) locates paragraph boundaries for vulnerability exploitation; Second-level matching: re.compile(r'\*\*Detailed steps\*\*:\\n(.*?)(?=\\n#####|\\n\*\*Summary\*\*|\\Z)', re.DOTALL) breaks through the newline character restriction and fully captures multi-line operation sequences; Memory retrieval logic: Locate all Zhiyuan nodes in the penetration knowledge graph associated with the corresponding vulnerability node, extract their specific content, and concatenate them into a long text, which is then returned to the system to assist in the penetration decision-making process for the vulnerability.

[0014] The beneficial effects of this invention are: 1) By using collaborative penetration decision trees, the accuracy and reliability of penetration decision generation for large models are significantly improved. 2) Achieve full automation of the penetration testing process, saving labor costs.

[0015] 3) The system's knowledge is constantly updated, allowing it to adapt to ever-changing real-world scenarios. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of a fully automated penetration testing process based on LLM according to an embodiment of the present invention. Detailed Implementation

[0017] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. The following embodiments or drawings are used in the present invention, but are not intended to limit the scope of the present invention.

[0018] See Figure 1 , Figure 1 A flowchart provided for an embodiment of this application includes: Step 1: Construct a host asset model using multi-source data acquisition and aggregation technology; Step 2: Use multi-dimensional intelligence aggregation and analysis technology to intelligently identify exploitable vulnerability types; Step 3: Decompose penetration subtasks based on SPDT; Step 4: Execute fully automated penetration testing commands based on multiple proxies; Step 5: Modular penetration test report generation and assembly; Step 6: Use Zhiyuan Reflection Technology to improve and optimize the penetration knowledge graph.

[0019] For step 1, which uses multi-source data acquisition and aggregation technology to build the host asset model, the specific steps include: Step 1a: In an embodiment of the present invention, enter the IP address of the target machine with Redis vulnerability and Apache service in the configuration page of the comprehensive penetration test, verify the validity of the IP address, and return if an invalid IP address is entered.

[0020] Step 1b: Call the Fofa host asset aggregation interface and map the corresponding fields to the host asset model.

[0021] Step 1c: Integrate data from Hunter and Shodan platforms. If the corresponding field in the host asset model is empty or the update time of the existing model is earlier than the update time of the newly added data, then update the corresponding field value.

[0022] Step 1d: If the target is not included in Fofa, Hunter, or Shodan, initialize an empty standardized host asset model.

[0023] Step 1e: Based on the existing host asset model, call the command execution module described in Step 4 to execute the information collection command, and then call the LLM integration to return the results, generating a non-empty standardized host asset model JSON file, including the autonomous system number, country code, open port number, protocol type, protocol fingerprint, subdomain information, product name, product version, product issuing company, and protocol risk marker of the host corresponding to the IP.

[0024] Specifically, the steps for intelligently identifying exploitable vulnerability types using multi-dimensional intelligence aggregation and analysis technology in step 2 include: Step 2a: For the input JSON format component scan report, first parse the components and their version information in the report one by one, as well as the preliminary list of associated CVEs.

[0025] Step 2b: For each specific version of each component and each associated CVE number, the system automatically calls the NVD official API to obtain vulnerability details, extract the official description and precise information on the range of affected versions.

[0026] Step 2c: Based on the context information related to the current component version obtained from NVD and the structured verification questions generated by the system, use LLM for in-depth analysis and reasoning to determine whether the current component version is indeed affected by the CVE vulnerability.

[0027] Step 2d: Based on the LLM's judgment, if it is clearly indicated that there is no actual vulnerability association between a specific component version and a certain CVE number, then the erroneous CVE entry will be removed from the component record in the original JSON data.

[0028] Step 2e: Output a refined JSON file that has been verified and associated with the version and CVE; For example, the CVE associated with the Redis 4.0.8 product on this target machine is CVE-2015-10775.

[0029] Specifically, step 3, which uses SPDT-based penetration subtask decomposition, includes the following steps: Step 3a: The system first constructs an initial penetration target based on the host asset model containing CVE information. Then, SPDT enters a cyclical processing flow of node generation, decision update, command conversion and execution, execution result parsing, and status update. For example, the initial penetration goal for this target machine is to obtain a root-privileged shell.

[0030] Step 3b: During the node generation phase, LLM will generate new node information based on host information, vulnerability information, and Zhiyuan reflection content, combined with the guidance of the ATT&CK tactics and techniques map. This includes node number, parent node number, ATT&CK tactics, ATT&CK techniques, ATT&CK sub-techniques, task description, and completion status. For example, the first new node generated by this penetration test is numbered 1.1, and the task description is to write a webshell using a Redis unauthorized access vulnerability.

[0031] Step 3c: In the SPDT decision update phase, the generated nodes are standardized and converted into JSON structure decision units, and dynamically inserted into the corresponding decision branches of SPDT; then wait for step 4 to perform command conversion and execution.

[0032] Step 3d: After execution is completed, the execution result parsing stage begins. The system calls LLM to perform semantic parsing on the execution result.

[0033] Step 3e: Enter the SPDT state update phase, which specifically includes setting the node's Completion_degree state flag to "done" and updating the Result field content based on the output of the execution result parsing phase.

[0034] Step 3f: The system selects whether to activate the feedback mechanism based on the result of the LLM judgment. If yes, it returns to the node generation stage. For example, after the command is converted and executed at node 1.1, the result is a successful write of a Webshell. At this point, LLM determines that the next subtask needs to be performed, generating a new node, numbered 1.2, with the task description of establishing a persistent connection through AntSword. After this subtask is completed and root privileges of the target machine are obtained, LLM determines that the feedback mechanism does not need to be activated based on the result, and this task ends.

[0035] Specifically, step 4, which uses multi-agent-based fully automated penetration testing command execution, includes the following steps: Step 4a: This system takes the current focus node of the penetration decision tree as the input of the smallest task unit, and converts the natural language command into a structured triple (type, tool, command) and executes it in the corresponding environment; the Type field represents the tool's running environment, which is divided into three categories: Browser-use, GUI (graphical interface) and CLI (command line interface). For example, taking node number 1.1, whose task description is to write a webshell using a Redis unauthorized access vulnerability, as the smallest task unit input, the resulting triplet is {"type": "command-line tools", "too1":"redis-cli", "command": "redis-cli -h 192.168.231.129< <EOF\n config set dir / var / www / htm\n config set dbfilename 33.php\n set x \"\r\n\r\n<?php @eval($_POST ['cc']) ;?> \r\n\r\n"\n save\n EOF"} indicates that the corresponding command should be executed using the redis-cli tool in the command-line interface.

[0036] Step 4b: For the Browser-use environment, when executing a task, an Agent is first created. This component serves as the core control unit of the Browser-use-agent module, responsible for coordinating the scheduling and task flow of various functional modules. After receiving the penetration task specified by the user, the Agent transmits its input to the LLM, which combines the current environment state and context information to generate the next operation instruction. Subsequently, the Agent calls the behavior executor to automatically drive the browser to complete the specific operation according to the instructions output by the model.

[0037] Step 4c: In a CLI environment, the system calls an SSH connection to remotely manipulate a pre-configured attack virtual machine. By controlling the CLI execution engine of the virtual machine, the system runs the complete instructions described in the command field within a securely isolated container.

[0038] Step 4d: For the GUI environment, the system interacts with the multimodal large model based on screenshots. After the large model is output, this module uses the pyautogui component to precisely execute the graphical interface interaction.

[0039] Specifically, the steps for generating and assembling the modular penetration test report in step 5 include: Step 5a: Before generating the report, we designed report templates for different input information. The IP asset scanning and vulnerability matching results include IP information, port information, component information, and existing vulnerability numbers; the IP vulnerability exploitation process and results include the type of vulnerability exploited, the exploitation process, and remediation suggestions; other IP vulnerability exploitation paths include other paths to be verified besides this penetration test and remediation suggestions; the IP vulnerability statistics list includes CVE number, CVE name, and risk level.

[0040] Step 5b: During the report generation process, invoke LLM and pass the report template file and JSON data about the penetration test process generated after the system completes the penetration test to LLM. The prompt message clearly requires LLM to act as a professional penetration tester and generate a penetration test report according to the template we provide, based on the input JSON data and vulnerability risk assessment method.

[0041] Step 5c: Save it as an .md file, then use Python's md2pdf library to convert the .md file into a .pdf file according to the pre-set CSS file, and save both formats for later use. Finally, combine the various parts of the report to form a complete report and save it to the appropriate path.

[0042] Specifically, the steps for refining and optimizing the penetration knowledge graph using Zhiyuan reflection technology in step 6 include: This process is divided into memory storage logic and memory retrieval logic. The specific steps of memory storage are as follows: Step 6a: The memory storage logic identifies the detailed steps of each vulnerability exploitation from the Markdown-formatted penetration test report, abstracts them into Zhiyuan node Cases, stores them in the graph database, and connects them with the corresponding vulnerability nodes. To successfully transform the completed penetration test data into knowledge graph nodes that can be used by the system, two regular expression matching methods are used. The first uses `re.compile(r"####.*?(?=---)", re.DOTALL)`, leveraging the characteristic that vulnerability exploitation paragraphs begin with a fourth-level heading "####" and end with a horizontal separator "---" to match the exploitation process paragraphs for each vulnerability. The second uses `re.compile(r"\*\*Detailed Steps\*\*:\n(.*?)(?=\n#####|\n\*\*Summary\*\*|\Z)", The re.DOTTALL regular expression leverages the characteristic that the detailed steps section begins with the bolded word "Detailed Steps" and ends with a fifth-level heading "#####" or the bolded word "Summary" or the end of the text to match each part in the process paragraph.

[0043] Step 6b: The memory retrieval logic first locates the input vulnerability in the graph, then extracts the intelligent nodes labeled "Case", and finally connects them into a long text, which is returned to the system for reference in the penetration decision-making process.

[0044] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technologies.

[0045] Any modifications, equivalent substitutions, or improvements made within the spirit and principles of this invention shall be included within the scope of protection of this invention.

Claims

1. A fully automated penetration testing method based on a large language model, characterized in that, It also includes the following steps: Preliminary step: Penetration knowledge graph construction; Step 1. Construct a host asset model using multi-source data acquisition and aggregation technology; Step 2. Use multi-dimensional intelligence aggregation and analysis technology to intelligently identify exploitable vulnerability types; Step 3. Decompose penetration subtasks based on the collaborative penetration decision tree; Step 4. Execute fully automated penetration testing commands based on multiple proxies; Step 5. Modular penetration test report generation and assembly; Step 6. Use Zhiyuan Reflection Technology to improve and optimize the penetration knowledge graph.

2. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, The preliminary steps also include: Tactics, techniques, sub-techniques, mitigation methods, and tools from the ATT&CK official website are crawled and mapped to a graph; The components, versions, CVE vulnerability numbers, and descriptions stored on the official CVE website are crawled and mapped to the graph.

3. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 1 further includes: After entering the target IP address, perform an IP validity check. After the verification is passed, the open APIs of Shodan, Fofa, and Hunter are called to collect the Autonomous System Number, Country Code, Open Port Number, Protocol Type, Protocol Fingerprint, Subdomain Information, Product Name, Product Version, Product Issuing Company, and Protocol Risk Marker of the target IP. If conflicting information is detected from various platforms, a timestamp-based priority strategy is used to deduplicate the data, retaining the latest result as the initial version of the host asset model. If it is detected that IP-related information has not been included by any platform, initialize the empty host asset model; Based on the existing host asset model, supplementary collection commands are executed using the multi-agent-based fully automated penetration command execution technology described in step 4. By integrating the existing host asset model with the results obtained from supplementary collection commands using a large language model, the final host asset model is obtained.

4. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 2 also includes: Parse the component and version information of the host asset model, call the NVD official API to query the associated CVE number and description, and store it into the host asset model containing CVE information; Secondary analysis and verification are performed using a large language model. The existing host asset model containing CVE information is input, and the erroneous parts of the query are filtered out by the large language model. The output is saved as the final host asset model containing CVE information.

5. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 3 also includes: Create a root node for the collaborative penetration decision tree. Its content includes the vulnerabilities that can be exploited and the final goal that needs to be achieved. The node attributes include node number, task description, and completion status. Successful penetration cases related to vulnerabilities are retrieved from the penetration knowledge graph using the memory retrieval logic of the Zhiyuan reflection technology described in step 6, and used as enhanced input for the large language model; By integrating the cases and root node goals extracted from the knowledge graph, the next task node is dynamically generated using a large language model. The node attributes include parent node number, ATT&CK tactics, ATT&CK techniques, ATT&CK sub-techniques, task description, and completion status. Recursively traverse the existing collaborative penetration decision tree and connect this node to the output parent node; When the breadth of child nodes of a node in the collaborative penetration decision tree exceeds a preset threshold or the number of decision loops exceeds the limit, the penetration path is determined to be unreachable, the root node is marked as "failed" and the process is terminated. If not, proceed to step 4. After execution, update the current node's completion status to "succeed" or "failed" based on the result. Determine whether the penetration objective described in the root node has been completed. If completed, update the completion status of the root node to "succeed" and terminate the process. If not completed, return to the "Dynamically generate the next task node using a large language model" step and repeat the above process.

6. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 4 also includes: The large language model is used to transform structured commands. The attributes of the structured commands include the tool usage scenario, tool name, and specific command. In this step, the specific task, the list of available tools and their scenarios are input, and the large language model generates multi-step structured commands. This section presupposes three tool usage scenarios: Browser-use, CLI, and GUI; In the Browser-use scenario, there is only one tool, Browser-use-Agent. Commands are input in natural language, and Browser-use-Agent is scheduled to perform fully automatic command execution. When Browser-use-Agent executes a task, it first creates an Agent, which serves as the core control unit of the Browser-use-agent module and is responsible for coordinating the scheduling and task flow of various functional modules. After receiving the penetration task specified by the user, the Agent transmits its input to the large language model, which combines the current environment state and context information to generate the next operation instruction. Subsequently, the Agent calls the behavior executor to automatically drive the browser to complete the specific operation according to the instructions output by the model. In the CLI scenario, a pre-prepared Kali virtual machine is integrated with 63 tools related to the penetration mission, a large language model generation tool and corresponding command-line commands. SSH is used to connect to the Kali attack virtual machine to execute commands. In the GUI scenario, the tools include four types: Burp Suite, AntSword, Edge browser, and Firefox browser. The large language model generation tool and the corresponding natural language description commands call the GUI-Agent to execute the commands. When the GUI-Agent executes commands, the system interacts with the multimodal large model based on screenshots. The large model outputs predefined operation types, including nine types: left-click, left-double-click, right-click, drag and rotate, hotkey, keyboard input, scrolling, waiting, and completion. The predefined operation types are represented by vector coordinates and operation command key-value pairs, in the format {operation_type:str, start_box:[x1, y1], end_box[x1, y1], key:str, content:str, direction:str}, where operation_type represents the operation type, start_box represents the starting position, end_box represents the ending position, key represents keyboard input, content represents text content, and direction represents the operation direction. This module uses the pyautogui component to precisely execute graphical interface interactions after the large model is output.

7. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 5 further includes: Generate a PDF penetration test report cover based on IP address and date; Based on the host asset model containing CVE vulnerability information, a host basic information section is generated using a large language model; Based on the collaborative penetration decision tree generated in step 3 and the specific implementation process recorded in step 4, a structured chapter on the specific process of each vulnerability penetration is generated using a large language model. Based on the host asset model containing CVE vulnerability information, other exploitable penetration path sections are generated using a large language model; Real-time acquisition of CVSS and business impact, combined with a host asset model containing CVE vulnerability information, and the generation of a summary table of vulnerability count and risk level using a large language model. The process for real-time acquisition of CVSS and business impact and calculation of risk level is as follows: Using the product name in the host asset model and the version field as the query key, the NVD official API is called in real time to return the corresponding CVSS base score and vector string. Based on the associated domain names, port product levels, protocol risk indicators, and Web service indicators in the host asset model, the Business Impact Factor (BIF) is calculated in real time according to preset weights. Its mathematical expression is as follows: Among them, d is the weight value of the top-level domain mapping, l max The maximum value among all product levels corresponding to the port; r is 1 if there is a protocol risk flag and 0 otherwise; w is 1 if there is a Web service flag and 0 otherwise; w1, w2, w3, and w4 are preset weights that sum to 1. The CVSS base score is multiplied by the BIF to obtain a continuous risk score of 0-10, and then mapped to three levels of low risk, medium risk, and high risk according to the thresholds of 0.0-0.3, 0.3-0.7, and 0.7-1.

0. The above chapters are converted into structured text, with each chapter in the form of "title + body text" and containing subheadings. The text is then rendered into PDF using a template engine to form the final penetration test report.

8. The fully automated penetration testing method based on a large language model according to claim 1, characterized in that, Step 6 also includes: Memory storage logic: The generated structured penetration test report is split into vulnerability exploitation step blocks using a dual regular expression matching algorithm, and the reusable vulnerability exploitation steps that have been successfully penetrated are extracted to form intelligent nodes. After being connected to the corresponding vulnerabilities in the penetration knowledge graph, the penetration knowledge graph is updated in a timely manner. The details of the double regular expression matching algorithm are as follows: First-level matching: Locating and exploiting paragraph boundaries; Second-level matching: Breaks through newline character restrictions and fully captures multi-line operation sequences; Memory retrieval logic: Locate all Zhiyuan nodes in the penetration knowledge graph associated with the corresponding vulnerability node, extract their specific content, and concatenate them into a long text, which is then returned to the system to assist in the penetration decision-making process for the vulnerability.

Images