Penetration testing method and device, electronic equipment, storage medium and program product

Abstract

The invention provides a penetration test method and device, electronic equipment, a storage medium and a program product, relates to the technical field of computers, and is used for improving penetration test efficiency. The method comprises the steps of obtaining a network topological graph of a target system, and then generating an attack graph of the target system based on the network topological graph and vulnerability information of each node in the target system; the attack income of each attack path in the attack graph is calculated, and a target attack path with the maximum attack income is obtained; and performing penetration testing based on the target attack path.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to penetration testing methods, apparatus, electronic devices, storage media, and program products. Background Technology

[0002] With the continuous expansion of the internet and the rapid popularization of information technology, various software, web systems, and Internet of Things (IoT) systems are being used more and more widely in daily work and life. While the development of the internet brings convenience to work and life, it also provides opportunities for hackers. Hackers can exploit system vulnerabilities to infiltrate systems and destroy, steal, or sell data for personal gain.

[0003] Penetration testing is a technique used under authorized conditions to exploit vulnerabilities in a target system, simulating attacker behavior to conduct security tests and risk assessments. Penetration testing helps system administrators identify problems early, enabling them to take action, patch vulnerabilities, and mitigate potential security risks.

[0004] However, current penetration testing in the industry struggles to penetrate the final target host, resulting in low penetration testing efficiency. Summary of the Invention

[0005] This application provides a penetration testing method, apparatus, electronic device, storage medium, and program product to improve penetration testing efficiency.

[0006] Firstly, this application provides a penetration testing method, comprising: obtaining a network topology diagram of a target system; generating an attack graph of the target system based on the network topology diagram of the target system and vulnerability information of each node in the target system; wherein, the vulnerability information represents vulnerability information that allows an attacker to move from the current node to other nodes; the attack graph of the target system is used to reflect all attack paths that exist between the attacker and the initial node and the target node; calculating the attack benefit of each attack path in the attack graph of the target system to obtain the target attack path with the greatest attack benefit; the attack benefit of the attack path is used to reflect the impact on the target system when an attack is carried out based on the attack path; and performing penetration testing based on the target attack path.

[0007] The technical solution provided in this application offers at least the following benefits: It obtains a network topology diagram of the target system, clearly presenting the connection relationships and hierarchical structure of each node, helping testers quickly locate the position and dependencies of key nodes within the network. By integrating the logical connections of the network topology with the exploitability of vulnerabilities, abstract vulnerability information is transformed into a concrete attack path chain, clearly presenting all feasible paths from the entry point to the target and the dependent vulnerability conditions. The attack benefit of each attack path in the attack graph of the target system is calculated, obtaining the target attack path with the highest attack benefit. By quantitatively evaluating the impact of each path, the abstract attack effect is transformed into a comparable benefit value, providing an objective basis for path priority ranking and avoiding the limitations of relying on subjective experience to select test paths. Focusing on the path with the highest benefit ensures that penetration testing resources are prioritized for the routes that pose the most significant threat to the system, ensuring that test results point to the security flaws that pose the greatest threat to business operations, thus improving testing efficiency.

[0008] One possible implementation involves calculating the attack benefit of each attack path in the attack graph of the target system, including: determining the risk score of each node on each attack path, where a high risk score reflects the severity of the node's vulnerability; determining the importance score of each node on each attack path, where a high importance score reflects the importance of the node; and calculating the attack benefit of each attack path in the attack graph of the target system based on the risk score of each node on each attack path, the importance score of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path.

[0009] Another possible implementation involves a weighted summation based on the risk score of each node on each attack path, the weight coefficient of the risk score, the importance score of each node, and the weight coefficient of the importance score, to obtain a weighted summation result. Based on the weighted summation result, the number of times each node appears in all attack paths of the target system, and the length of each attack path, the attack benefit of each attack path in the attack graph of the target system is determined.

[0010] Another possible implementation is that the attack benefit of each attack path satisfies the following formula:

[0011] in, Indicates the attack benefit of the attack path, Indicates the first attack path Risk score of each node, The weighting coefficients representing the risk score Indicates the first attack path Importance score of each node, Weighting coefficients representing importance scores Indicates the first attack path The number of times each node appears in all attack paths of the target system. Indicates the length of the attack path.

[0012] Another possible approach is to conduct penetration testing based on the target attack path, which includes: developing a penetration attack strategy based on the target attack path; and conducting penetration testing based on the penetration attack strategy.

[0013] Another possible implementation is to input the vulnerability information of each node on the target attack path into the attack strategy generation model, and then use the attack strategy generation model to obtain the penetration attack strategy for each node based on the vulnerability information of each node.

[0014] Secondly, this application provides a penetration testing apparatus, comprising: an acquisition module, a processing module, and a testing module; the acquisition module is used to acquire a network topology diagram of a target system; the processing module is used to generate an attack graph of the target system based on the network topology diagram of the target system and vulnerability information of each node in the target system; the processing module is also used to calculate the attack benefit of each attack path in the attack graph of the target system to obtain the target attack path with the greatest attack benefit; and the testing module is used to perform penetration testing based on the target attack path.

[0015] One possible implementation involves a processing module specifically used to determine the risk score of nodes on each attack path, where the risk score reflects the severity of the node's vulnerability; determine the importance score of nodes on each attack path, where the importance score reflects the node's importance; and calculate the attack benefit of each attack path in the attack graph of the target system based on the risk score of each node on each attack path, the importance score of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path.

[0016] Another possible implementation involves a processing module that performs a weighted summation based on the risk score, weight coefficient of the risk score, importance score of each node, and weight coefficient of the importance score for each node on each attack path. Based on the weighted summation, the number of times each node appears in all attack paths of the target system, and the length of each attack path, the attack benefit of each attack path in the attack graph of the target system is determined.

[0017] Another possible implementation is that the attack benefit of each attack path satisfies the following formula:

[0018] in, Indicates the attack benefit of the attack path, Indicates the first attack path Risk score of each node, The weighting coefficients representing the risk score Indicates the first attack path Importance score of each node, Weighting coefficients representing importance scores Indicates the first attack path The number of times each node appears in all attack paths of the target system. Indicates the length of the attack path.

[0019] Another possible implementation is a testing module, which is specifically used to formulate penetration attack strategies based on the target attack path and to conduct penetration tests based on the penetration attack strategies.

[0020] Another possible implementation is a testing module, which is specifically used to input the vulnerability information of each node on the target attack path into the attack strategy generation model. Based on the vulnerability information of each node, the attack strategy generation model obtains the penetration attack strategy for each node.

[0021] Thirdly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement the method of the first aspect described above.

[0022] Fourthly, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the method described in the first aspect.

[0023] Fifthly, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, it causes the electronic device to implement the method described in the first aspect.

[0024] The beneficial effects of the second to fifth aspects mentioned above are described in the corresponding description of the first aspect and will not be repeated here. Attached Figure Description

[0025] Figure 1 A system architecture diagram of a penetration testing system provided in this application; Figure 2 A flowchart illustrating a penetration testing method provided in this application; Figure 3 A schematic diagram of a scanning information flow provided in this application; Figure 4 A schematic diagram of a penetration testing process is provided for this application; Figure 5 A flowchart illustrating another penetration testing method provided in this application; Figure 6 A schematic diagram of a penetration strategy generation process provided in this application; Figure 7 A schematic diagram of a penetration testing structure and process is provided for this application; Figure 8 A schematic diagram of the composition of a penetration testing device provided in this application; Figure 9 This is a schematic diagram of the composition of an electronic device provided in this application. Detailed Implementation

[0026] The penetration testing method provided in this application will now be described in detail with reference to the accompanying drawings.

[0027] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0028] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0029] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0030] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0031] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0032] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0033] With the continuous expansion of the internet and the rapid popularization of information technology, various software, web systems, and Internet of Things (IoT) systems are being used more and more widely in daily work and life. In order to facilitate office work and improve work efficiency, major enterprises and universities are also advocating paperless office practices, and all kinds of important data, information, and even confidential business documents are stored in the form of electronic information on specific devices.

[0034] While the development of the internet has brought convenience to work and life, it has also provided opportunities for hackers. Hackers exploit system vulnerabilities to infiltrate systems, destroy, steal, and sell data for personal gain. Frequent security incidents seriously affect social and even national security.

[0035] Penetration testing is a technique used under authorized conditions to exploit vulnerabilities in a target system, simulating attacker behavior to conduct security tests and risk assessments. Penetration testing helps system administrators identify problems early, enabling them to take action, patch vulnerabilities, and mitigate potential security risks.

[0036] Currently, penetration testing in the industry mainly relies on professional penetration testing engineers. Based on the actual network environment, they analyze the vulnerability information existing in the target system, formulate penetration testing strategies, and carry out penetration testing work through steps such as information collection, vulnerability detection, vulnerability exploitation, and internal network penetration.

[0037] Penetration testing engineers need a clear understanding of the target system's actual network environment and topology, as well as existing vulnerabilities and exploitation methods. Based on this, they then develop a penetration testing strategy. This process is labor-intensive, requires teamwork, and consumes significant time and financial resources. In practice, incomplete information often hinders penetration of the final target host, resulting in low penetration testing efficiency.

[0038] To address the aforementioned technical issues, this application provides a penetration testing method. The method's approach involves: acquiring a network topology diagram of the target system, which clearly presents the connections and hierarchical structure of each node, helping testers quickly locate the positions and dependencies of key nodes within the network. By integrating the logical connections of the network topology with the exploitability of vulnerabilities, abstract vulnerability information is transformed into a concrete attack path chain, clearly presenting all feasible paths from the entry point to the target and the dependent vulnerability conditions. The attack benefit of each attack path in the target system's attack graph is calculated, identifying the target attack path with the highest benefit. By quantitatively evaluating the impact of each path, the abstract attack effect is transformed into a comparable benefit value, providing an objective basis for path priority ranking and avoiding the limitations of relying on subjective experience to select test paths. Focusing on the path with the highest benefit ensures that penetration testing resources are prioritized for the routes that pose the most significant threat to the system, directing test results towards the security flaws that pose the greatest threat to business operations and improving testing efficiency.

[0039] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0040] The penetration testing method provided in this application can be applied to, for example... Figure 1 The penetration testing system shown is as follows. Figure 1 As shown, the penetration testing system 10 of this application includes: electronic device 11.

[0041] In some embodiments, the electronic device 11 can acquire a network topology map of the target system and generate an attack map of the target system based on the network topology map and vulnerability information of each node in the target system. The electronic device 11 can also calculate the attack benefit of each attack path in the attack map of the target system, obtain the target attack path with the greatest attack benefit, and finally perform penetration testing based on the target attack path.

[0042] In some embodiments, the electronic device 11 can perform asset scanning on the set of Internet Protocol (IP) addresses occupied by the target system through various methods, and then generate a network topology map of the target system based on the asset scanning results. For example, the electronic device 11 can use general network scanning tools or dedicated asset detection tools to identify live hosts, open ports and associated services in batches based on IP segments; it can also use the asset discovery module built into some network devices to automatically enumerate assets in the target network segment by configuring scanning policies; it can also use network protocol parsing, port communication and other technical principles to collect basic device information (such as IP and MAC addresses) and service characteristics within the IP range through customized scripts, and finally form a panoramic overview of network assets within the target IP segment.

[0043] In some embodiments, the electronic device 11 can perform comprehensive detection of the system configuration, running services, and application components of each node through a scanning strategy adapted to the characteristics of the assets. Based on the node information obtained during the asset scanning phase, the electronic device 11 invokes a vulnerability detection engine to launch targeted probes on different types of nodes (such as servers, terminal devices, network components, etc.), and identifies the vulnerability information existing in the nodes by comparing known vulnerability characteristics and verifying risk points. The vulnerability information of each node can be used to generate an attack graph.

[0044] In some embodiments, the electronic device 11 traverses all attack paths based on the attack graph. For each attack path, the electronic device 11 calculates and selects the path with the highest penetration testing benefit (i.e., the target attack path) according to a preset quantitative evaluation rule. For example, the attack graph can be a directed attack graph. Attack diagram. Afterwards, electronic device 11 will follow the node chain of this optimal path, performing targeted penetration tests on each node along the path.

[0045] In some embodiments, an attack graph is a structured visualization model constructed from nodes and directed edges. Nodes abstractly represent network assets (such as servers and terminals), security vulnerabilities (such as vulnerabilities and weak configurations), and attack actions or states (such as privilege acquisition and lateral movement). Directed edges reflect the causal relationships and execution order between elements. An attack graph can reflect the structured mapping relationship of "asset-vulnerability-attack action" in the network and the feasible penetration path of an attacker from the initial entry point to the final target.

[0046] The attack graph can be constructed by electronic device 11 or transmitted to electronic device 11 by other devices.

[0047] For example, electronic device 11 can construct an attack graph reflecting the probability of attack paths through a built-in or invoked attack graph generation engine. The attack graph uses nodes to represent key elements and directed edges to represent causal or execution relationships. The attack graph generation engine can associate the exploitation relationship between assets and security vulnerabilities according to preset rules.

[0048] Optionally, the electronic device 11 may also store asset data or security defect data to facilitate the retrieval, processing, and analysis of the original data.

[0049] In some embodiments, the electronic device 11 can be a server, such as a single server or a server cluster consisting of multiple servers. In some embodiments, the server cluster can also be a distributed cluster.

[0050] In some embodiments, the electronic device 11 can be a terminal device, such as a mobile phone, tablet computer, desktop computer, laptop computer, handheld computer, notebook computer, ultra-mobile personal computer (UMPC), netbook, cellular phone, personal digital assistant (PDA), augmented reality (AR) / virtual reality (VR) device, etc. This application embodiment does not impose any special limitations on the specific form of the terminal device.

[0051] In some embodiments, the penetration testing system 10 may further include a prompting device 12. The prompting device 12 establishes a communication connection with the electronic device 11.

[0052] For example, the connection method can be wireless, such as Bluetooth or Wi-Fi; or it can be wired, such as fiber optic, etc., without limitation. For example, electronic device 11 and notification device 12 can be connected to the Internet through a router, thereby realizing the communication connection between electronic device 11 and notification device 12.

[0053] The prompting device 12 is used to display the results. For example, the prompting device 12 can be a voice prompt device, in which case it presents the penetration test report and the security assessment results of the target system to the user by reading them aloud. Alternatively, the prompting device 12 can also be a display device, in which case it presents the penetration test report and the security assessment results of the target system to the user by displaying them on a screen in various ways (such as text, images, videos, etc.).

[0054] It should be noted that the system architecture described in the embodiments of this application is for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and does not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of system architecture, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0055] The following description, in conjunction with the accompanying drawings, introduces a penetration testing method provided in an embodiment of this application.

[0056] For example, the penetration testing method provided in this application can be used through... Figure 1 The penetration testing system shown is implemented, or, through... Figure 1 The electronic devices in the penetration testing system shown are implemented.

[0057] See Figure 2 This is a flowchart illustrating a penetration testing method provided in an embodiment of this application. Figure 2 As shown, the penetration testing method provided in this application includes the following steps S201~S204.

[0058] S201. Obtain the network topology diagram of the target system.

[0059] In some implementations, the target system refers to the network system targeted by penetration testing and other technical activities. It typically consists of hardware devices (such as servers, terminals, routers, switches, etc.), software components (such as operating systems, databases, applications, etc.), data resources, and the relationships between them. Its scope is defined by the test target and the authorization boundary.

[0060] In some implementations, a network topology diagram is a visual representation of the connection relationships, logical structure, or physical layout of various network elements (such as node devices, communication links, network partitions, etc.) in a target system. A network topology diagram clearly displays the hierarchical relationships between devices, data transmission paths, network boundaries, and area divisions (such as intranets, DMZ zones, subnets, etc.) in a graphical manner.

[0061] In some implementations, obtaining the network topology map of a target system can be achieved through a combination of proactive probing and information integration. This can be done by leveraging network management protocols such as SNMP and LLDP to proactively collect basic data such as device information, port connections, and routing relationships from network devices; alternatively, specialized network topology discovery tools can be used to automatically scan and traverse target network segments, integrating information such as device availability and communication links to generate graphical results; or existing data such as configuration documents and maintenance records provided by the target system can be combined, or supplemented and improved by manually analyzing device connections in small networks, ultimately forming a network topology map that clearly reflects the device distribution, hierarchical relationships, and data transmission paths within the target system.

[0062] For example, information gathering methods can be used to obtain the set of Internet Protocol addresses used by the target system. Then, an asset scan can be performed to obtain the set of all nodes in the target system. Using network probing technology, the node set is analyzed. For each node in the network, test its communication status with all other nodes. Generate a network topology diagram of the target system based on the communication status of each node with other nodes.

[0063] S202. Based on the network topology diagram of the target system and the vulnerability information of each node in the target system, generate an attack diagram of the target system.

[0064] Among them, vulnerability information indicates vulnerabilities that allow attackers to move from the current node to other nodes; the attack graph of the target system is used to reflect all attack paths that exist between the attacker and the target node.

[0065] In some implementations, vulnerability information is used to reflect security flaws in digital assets such as computer systems, network devices, and software applications. Vulnerability information typically includes basic attributes (such as a unique vulnerability identifier, discovery time, and affected software and hardware versions), technical characteristics (such as vulnerability triggering conditions, and involved code or configuration defects), risk level (such as the degree of harm quantified by CVSS scoring), and related attributes in certain scenarios.

[0066] For example, the associated attributes reveal that the security weaknesses of the current node can be used as a springboard or bridge to achieve access breakthroughs, privilege extensions, or control transfers to other nodes in the target system, enabling attackers to move from the current node to other nodes. For instance, a vulnerability in a node could allow an attacker to gain access to that node and then further exploit its internal network access permissions to infiltrate adjacent servers, or use the vulnerability to launch cross-network segment attacks on the backend database.

[0067] For example, for all those belonging to V Perform vulnerability scanning on each node to obtain a vulnerability information set (Vul) for each node. ,in This indicates that attackers can access nodes Transfer to node Vulnerability information.

[0068] In some implementations, an attack graph is a structured visualization model constructed from nodes and directed edges. Nodes abstractly represent the target system's asset units (such as servers and terminals), security vulnerabilities (such as defects that can be exploited across nodes), and attack states (such as privilege acquisition and lateral movement). Directed edges reflect the causal relationships and execution order between elements. An attack graph can systematically organize and present all potential penetration paths of an attacker from the initial access point to the final target node, revealing the vulnerability conditions and permission progression relationships that each path depends on, providing an intuitive and systematic analytical basis for subsequent path risk assessment and selection of high-priority test targets.

[0069] In some implementations, attack graphs for the target system can be generated based on network topology and vulnerability information. The network topology has a clear device distribution, hierarchical structure, and communication links, covering the physical and logical relationships between nodes. Vulnerability information includes node transfer information (such as the privilege transfer and network segment breach capabilities supported by the vulnerability). By linking isolated node vulnerability information with the network topology through structured rules, an attack graph can be constructed with nodes (representing assets, vulnerabilities, and attack status) and directed edges (representing penetration logic and relationships) at its core, systematically presenting the attacker's full penetration path and implementation conditions from the initial node to the target node.

[0070] For example, such as Figure 3 As shown, an asset scan is performed on the target system to obtain the node set. V Generate the network topology graph of the target system; then, analyze the node set. V Each node in the network is scanned for vulnerabilities, resulting in a vulnerability information set (Vul) and configuration information (running services, open ports, access control information, etc.) for all nodes. An attack graph can then be generated based on each node's configuration information, vulnerability information set, and network topology.

[0071] S203. Calculate the attack benefit of each attack path in the attack graph of the target system, and obtain the target attack path with the greatest attack benefit.

[0072] Among them, the attack benefit of the attack path is used to reflect the impact on the target system when an attack is carried out based on the attack path.

[0073] In some implementations, an attack path refers to a series of ordered and chained attack steps and node links constructed by an attacker (or security tester) to achieve a specific goal, utilizing vulnerability information existing in various nodes of the network. An attack path is a visualization and quantification of the vulnerability relationships between network assets.

[0074] In some implementations, attack gain is a quantitative or qualitative description of the potential harm of a particular attack path during penetration testing. It transforms the potential impact of an attack along that path on the target system into an assessable and comparable metric. From a security assessment perspective, attack gain comprehensively considers factors such as the importance of the assets involved in the path (e.g., their support for business operations, the confidentiality of the data they carry), the scope of impact after vulnerability exploitation (e.g., whether it leads to the paralysis of multiple nodes or the leakage of sensitive data), and the probability of the attack achieving its goal, forming a direct reflection of the path's risk level.

[0075] S204. Conduct penetration testing based on the target attack path.

[0076] In some implementations, penetration testing is a practical technical method that, under compliant and authorized conditions, simulates the thinking and techniques of malicious attackers to proactively assess the security of a target system (including network architecture, hardware and software devices, applications, data resources, etc.). The goal of penetration testing is not to destroy the system, but rather to discover security vulnerabilities, configuration flaws, and oversights in access control within the target system through probing and attack attempts. It verifies the feasibility of exploiting these vulnerabilities, assesses their actual impact on business operations, and ultimately provides the defender with a complete report including vulnerability details, attack paths, and remediation recommendations, thus assisting in system hardening and security capability enhancement.

[0077] In some embodiments, step S204 can be implemented as the following steps: S2041. Develop penetration attack strategies based on the target attack path.

[0078] In some implementations, a penetration strategy is a systematic action guide that guides security testers in planning and implementing penetration operations. It combines the characteristics of the target system (such as network topology, asset value, and vulnerability distribution), the testing scope, and their own resources to clarify the priority of penetration, the logic of path selection, the combination of technical means, and the risk control boundaries.

[0079] In some implementations, penetration testing strategies can be developed based on optimal path design with targeted technology adaptation solutions. This includes matching efficient exploitation tools to different vulnerability types along the path (e.g., preparing highly stable vulnerability verification tools for remote code execution vulnerabilities and configuring precise dictionaries for weak password nodes), while anticipating potential protection mechanisms along the path (e.g., application firewalls, internal network firewalls) and planning bypass strategies in advance (e.g., traffic encryption, protocol spoofing). Furthermore, a tiered execution plan is needed, breaking down the action phases according to the node sequence of the path and defining verification indicators for each phase (e.g., whether node permissions were successfully obtained, and whether target data can be accessed). Finally, alternative vulnerabilities or adjacent branch solutions should be prepared in advance to address potential vulnerability failures or node anomalies during path execution.

[0080] In some embodiments, vulnerability information of each node on the target attack path is input into the attack strategy generation model, and the attack strategy generation model obtains a penetration attack strategy for each node based on the vulnerability information of each node.

[0081] In some implementations, attack strategy generation models are a set of technical tools that use data and algorithms as their core to automatically or semi-automatically produce precise attack schemes. Inputting information such as the target system's network topology, asset value, vulnerability details, and attack constraints and objectives into the model, the model can use different technical paths to generate attack strategies. For example, it can learn the distribution of attack samples through frameworks such as encoders and decoders to generate diverse and generalizable adversarial attack schemes; it can also match scenario-specific attack techniques and tool combinations based on a knowledge base of real attack events (such as MITRE ATT&CK). Finally, the model outputs a structured strategy that includes specific attack steps, technical tools, and risk predictions.

[0082] For example, training an attack strategy generation model can collect two types of data: one is target system-related data, including numerous network topology diagrams under different scenarios, asset value annotations (such as node importance scores), vulnerability information, and protection rules; the other is attack knowledge data, covering historical attack event records (such as real penetration test reports and hacker attack cases), standardized attack knowledge bases (such as the MITRE ATT&CK framework), and manually annotated attack paths and strategy samples. Next, for model architecture adaptation and training, the processed attack sample data is input into the model, allowing the encoder to learn the correlation between attack scenarios and system characteristics, while the decoder learns to generate corresponding attack steps and tool combinations. During training, a loss function is designed, and optimization algorithms such as Adam and SGD are used to iteratively adjust the parameters. Finally, for model validation and fine-tuning, the effectiveness of the model's output strategy is verified using test data not used in training. If there is policy redundancy or errors, data from the corresponding scenarios is added, and the model is retrained until it can stably output a structured attack strategy containing steps, adapted tools, and risk predictions.

[0083] For example, based on the target attack path of the target system, the vulnerability information of the path nodes is input into the large language model, and the large language model can automatically generate exploit code for each node.

[0084] S2042. Conduct penetration testing based on penetration attack strategies.

[0085] In some implementations, penetration attack strategies can be categorized by attack phase and target. For example: boundary breaching, which targets assets exposed on the external network of the target system and uses methods such as web application attacks or weak authentication attacks to achieve initial access; lateral movement within the internal network, which, after breaching the boundary, seeks more controllable assets in the target's internal network to expand the attack scope; and privilege escalation, which, after obtaining low privileges, elevates them to system administrator or domain administrator privileges.

[0086] In some embodiments, step S2042 above can be implemented as follows: performing penetration attack tests on each node on the target attack path based on the attack steps and technical tools in the penetration attack strategy, and obtaining penetration test results.

[0087] For example, executing exploit code generated by a large language model can complete an attack on a node. The exploit code is executed sequentially from the starting node to the target node, ultimately outputting a penetration test report and a security assessment of the target system, thus completing the penetration test task.

[0088] like Figure 4 As shown, the optimal attack path (target attack path) is traversed first. The nodes on; next for For each node, a language model is used to generate exploit code for penetration testing; ultimately, a penetration test report and a security assessment result of the target system are generated.

[0089] In some embodiments, such as Figure 5 As shown, the above step S203 can be implemented as the following steps S501~S503.

[0090] S501. Determine the risk score of each node on each attack path.

[0091] The risk score reflects the severity of the node's vulnerability.

[0092] In some implementations, risk scoring is a quantitative or qualitative assessment metric for a single node on the attack path during penetration testing, based on the severity of the vulnerability it contains, and directly reflects the potential harm of the vulnerability at that node.

[0093] For example, the risk score can be determined by referring to objective technical standards (such as the CVSS4.0 vulnerability scoring system), and quantitatively scoring can be performed from dimensions such as attack complexity (e.g., whether high privileges are required or whether specific conditions are required), scope of impact (e.g., whether it only affects a single node or can spread to the internal network), and degree of harm (e.g., whether it leads to information leakage, permission tampering, or system paralysis).

[0094] For example, assume that the risk score ranges from 0 to 10, where 8.0-10.0 is high risk, 4.0-7.9 is medium risk, and 0.1-3.9 is low risk.

[0095] S502. Determine the importance score of the nodes on each attack path.

[0096] The importance score reflects the degree of importance of the node.

[0097] In some implementations, the importance score of a node is a quantitative or qualitative evaluation indicator for an individual node (such as a server, terminal, database, switch, etc.) on the attack path, based on its business value, functional positioning and supporting role in the attack chain in the target system. The higher the score, the more important the node is in the path or in the system as a whole.

[0098] For example, importance scores can be assigned by the target system administrator based on specific scoring rules, taking into account factors such as the asset's support for core business, the confidentiality of the data it carries, and its position in the network topology. The higher the score, the stronger the node's core importance to the system.

[0099] For example, the score range can be 0-10 points. If it is a server that directly carries critical business such as transactions and payments, the base score can be set to 7-9 points. If it is only an office auxiliary terminal or test environment equipment, the base score will be reduced to 2-4 points. Secondly, the confidentiality of the data carried is adjusted. For example, nodes that store sensitive data such as user privacy and trade secrets can add 1-3 points, while nodes that only store public information do not add points. Finally, the position in the network topology is adjusted. If it is a link hub node such as a DMZ jump server connecting the external network and the internal network, a core switch that manages multiple network segments, or a domain controller server, an additional 0.5-2 points can be added. If it is an edge node isolated outside the core network segment, no additional points are added.

[0100] S503. Based on the risk score of each node on each attack path, the importance score of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path, calculate the attack benefit of each attack path in the attack graph of the target system.

[0101] For example, for an attack graph AG, a depth-first search algorithm is used to find all attack paths from the start node to the target node. This forms the attack path set P.

[0102] In some embodiments, the attack benefit of each path can be calculated by weighted summation based on the risk score of each node on each attack path, the weight coefficient of the risk score, the importance score of each node, and the weight coefficient of the importance score, to obtain a weighted summation result; based on the weighted summation result, the number of times each node appears in all attack paths of the target system, and the length of each attack path, the attack benefit of each attack path in the attack graph of the target system is determined.

[0103] In some implementations, the weighting coefficients of the risk score and the importance score can be selected by the target system administrator based on the actual situation of the target system. The values ​​can range from 0 to 1, and the sum of the two is a fixed value, such as 1.

[0104] For example, the risk score reflects the severity of an attack on a node, and its weight depends on the test's focus on the attack. If the penetration test aims to verify the threat posed by easily exploitable high-risk vulnerabilities to the system, or if vulnerability protection is the current focus of the penetration test, then the weighting coefficient of the risk score can be increased.

[0105] For example, the importance score reflects the degree of importance of a node in a path or in the system as a whole, and its weight depends on the irreplaceability of the node and the value orientation of the test. If the target system is a scenario with extremely high priority for core business and data security, such as finance or healthcare, and the test objective is to identify attack paths that may lead to the interruption of core business or the leakage of sensitive data, then the weight coefficient of the importance score can be increased.

[0106] In some embodiments, the attack benefit of each attack path satisfies the following formula:

[0107] in, Indicates the attack benefit of the attack path, Indicates the first attack path Risk score of each node, The weighting coefficients representing the risk score Indicates the first attack path Importance score of each node, Weighting coefficients representing importance scores Indicates the first attack path The number of times each node appears in all attack paths of the target system. Indicates the length of the attack path.

[0108] like Figure 6 As shown in the embodiments of this application, the penetration test can be performed by the following three modules: First, the scanning module is responsible for scanning the asset information and vulnerability information of the target system and generating a network topology map; next, the attack strategy generation module generates an attack map based on the information provided by the scanning module, and determines the target attack path based on the asset information and vulnerability information; finally, the intelligent penetration test module generates corresponding vulnerability exploitation code based on the attack path and the vulnerabilities on the path, combined with the strategy generation model, performs intelligent penetration testing on the target system, and outputs a test report and the network security assessment results of the target system.

[0109] like Figure 7 As shown, the attack strategy generation module first uses MulVAL, combining the topology graph and scan results, to generate the attack graph AG; then, it uses a depth-first search algorithm on the attack graph AG to find the set of attack paths P; next, it calculates the attack path for each attack path. Attack benefit score Finally, a penetration attack strategy is formulated, and penetration testing is conducted on the target system based on this strategy.

[0110] As can be seen, the above mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, the embodiments of this application provide corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, in conjunction with the modules and algorithm steps of the various examples described in the embodiments disclosed herein, the embodiments of this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0111] This application embodiment can divide the penetration testing device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0112] In some embodiments, this application also provides a penetration testing apparatus. The penetration testing apparatus may include one or more functional modules for implementing the penetration testing methods described in the above embodiments.

[0113] For example, Figure 8 This is a schematic diagram illustrating the composition of a penetration testing apparatus provided in an embodiment of this application. Figure 8 As shown, the penetration testing device 800 includes: an acquisition module 801, a processing module 802, and a testing module 803. The acquisition module 801 is used to acquire the network topology diagram of the target system; the processing module 802 is used to generate an attack graph of the target system based on the network topology diagram and vulnerability information of each node in the target system; the processing module 802 is also used to calculate the attack benefit of each attack path in the attack graph of the target system, and obtain the target attack path with the maximum attack benefit; the testing module 803 is used to perform penetration testing based on the target attack path.

[0114] In some embodiments, the processing module 802 is specifically used to determine the risk score of each node on each attack path, the level of the risk score reflecting the severity of the vulnerability of the node; determine the importance score of each node on each attack path, the level of the importance score reflecting the importance of the node; and calculate the attack benefit of each attack path in the attack graph of the target system based on the risk score of each node on each attack path, the importance score of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path.

[0115] In other embodiments, the processing module 802 is specifically used to perform a weighted summation based on the risk score of each node on each attack path, the weight coefficient of the risk score, the importance score of each node, and the weight coefficient of the importance score to obtain a weighted summation result; based on the weighted summation result, the number of times each node appears in all attack paths of the target system, and the length of each attack path, to determine the attack benefit of each attack path in the attack graph of the target system.

[0116] In some other embodiments, the attack benefit of each attack path satisfies the following formula:

[0117] in, Indicates the attack benefit of the attack path, Indicates the first attack path Risk score of each node, The weighting coefficients representing the risk score Indicates the first attack path Importance score of each node, Weighting coefficients representing importance scores Indicates the first attack path The number of times each node appears in all attack paths of the target system. Indicates the length of the attack path.

[0118] In some other embodiments, the testing module 803 is specifically used to formulate a penetration attack strategy based on the target attack path and to perform penetration testing based on the penetration attack strategy.

[0119] In some other embodiments, the test module 803 is specifically used to input the vulnerability information of each node on the target attack path into the attack strategy generation model, and obtain the penetration attack strategy for each node based on the vulnerability information of each node through the attack strategy generation model.

[0120] In the case of implementing the functions of the integrated modules described above in hardware, this embodiment of the invention provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 9 As shown, the electronic device 900 includes: a processor 902, a communication interface 903, and a bus 904. Optionally, the electronic device 900 may also include a memory 901.

[0121] Processor 902 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 902 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0122] The communication interface 903 is used to connect to other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0123] The memory 901 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0124] In one possible implementation, the memory 901 can exist independently of the processor 902. The memory 901 can be connected to the processor 902 via a bus 904 and is used to store instructions or program code. When the processor 902 calls and executes the instructions or program code stored in the memory 901, it can implement the penetration testing method provided in this embodiment of the invention.

[0125] In another possible implementation, the memory 901 can also be integrated with the processor 902.

[0126] The 904 bus can be an extended industry standard architecture (EISA) bus, etc. The 904 bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0127] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0128] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned service invocation device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned service invocation device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service invocation device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned service invocation device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0129] This application also provides a computer program product comprising a computer program that, when run on a computer, causes the computer to perform any of the penetration testing methods provided in the above embodiments.

[0130] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method of permeation testing, characterized by, The method comprises: obtaining a network topology graph of a target system; generating an attack graph of the target system based on the network topology graph of the target system and vulnerability information of each node in the target system, wherein the vulnerability information represents vulnerability information that an attacker can transfer from a current node to other nodes; the attack graph of the target system is used to reflect all attack paths that exist between an initial node and a target node of the attacker; calculating attack benefits of each attack path in the attack graph of the target system to obtain a target attack path with the maximum attack benefit; the attack benefit of the attack path is used to reflect the impact on the target system when an attack is performed based on the attack path; performing penetration testing based on the target attack path.

2. The method of claim 1, wherein, The attack benefits of each attack path in the attack graph of the target system are calculated, comprising: determining risk scores of nodes on the attack path, wherein the risk scores reflect the severity of the vulnerability of the nodes; determining importance scores of the nodes on the attack path, wherein the importance scores reflect the importance of the nodes; calculating the attack benefits of each attack path in the attack graph of the target system based on the risk scores of each node on the attack path, the importance scores of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path.

3. The method of claim 1, wherein, The attack benefits of each attack path in the attack graph of the target system are calculated based on the risk scores of each node on the attack path, the importance scores of each node, the number of times each node appears in all attack paths of the target system, and the length of each attack path, comprising: performing weighted summation based on the risk scores of each node on the attack path, a weight coefficient of the risk scores, the importance scores of each node, and a weight coefficient of the importance scores to obtain a weighted summation result; determining the attack benefits of each attack path in the attack graph of the target system based on the weighted summation result, the number of times each node appears in all attack paths of the target system, and the length of each attack path.

4. The method of claim 3, wherein, The attack benefits of each attack path satisfy the following formula: wherein the attack revenue of the attack path, risk score of the node in the attack path, weight coefficient of the risk score, importance score of the node in the attack path, weight coefficient of the importance score, number of times the node in the attack path appears in all attack paths of the target system, length of the attack path.

5. The method of claim 1, wherein, The penetration testing is performed based on the target attack path, comprising: developing a penetration attack strategy based on the target attack path; performing penetration testing based on the penetration attack strategy.

6. The method of claim 5, wherein, The penetration attack strategy is developed based on the target attack path, comprising: inputting vulnerability information of each node on the target attack path into an attack strategy generation model to obtain a penetration attack strategy of each node based on the vulnerability information of each node by the attack strategy generation model.

7. A permeation testing device characterized by, comprising: an acquisition module, a processing module, and a testing module; the acquisition module is configured to obtain a network topology graph of a target system; the processing module is configured to generate an attack graph of the target system based on the network topology graph of the target system and vulnerability information of each node in the target system; and the testing module is configured to perform penetration testing based on the target attack path. The processing module is further configured to calculate attack benefits of each attack path in an attack graph of the target system, and obtain a target attack path with the maximum attack benefit. The testing module is configured to perform penetration testing based on the target attack path.

8. An electronic device, comprising: The method comprises: a processor and a memory; the memory stores instructions executable by the processor; the processor is configured to execute the instructions, so that the electronic device implements the penetration testing method according to any one of claims 1-6.

9. A readable storage medium, characterized by, The readable storage medium comprises computer-executable instructions; when the computer-executable instructions run on a computer, the computer is caused to execute the penetration testing method according to any one of claims 1-6.

10. A computer program product, characterised in that, The computer program product comprises a computer program; when the computer program runs on an electronic device, the electronic device is caused to execute the penetration testing method according to any one of claims 1-6.

Images