Automatic penetration test strategy decision method, device, equipment, medium and product

Abstract

The invention discloses an automatic penetration test strategy decision method, device and equipment, a medium and a product, and relates to the technical field of network security. The method comprises the following steps: after acquiring environment characteristic data of a to-be-tested target host and containing a service / software list, firstly searching whether a matched penetration test item exists in a test item list for each service / software in the list, if the matched penetration test item is found, generating a corresponding first penetration test script set according to the test item, and if the matched penetration test item is found, generating a second penetration test script set according to the first penetration test script set; and otherwise, searching an Exploit module array applicable under similar environment characteristics by applying multiple penetration script searching modes, generating a corresponding second penetration test script set by using the array, finally generating penetration test task sub-tables according to the script set, summarizing to obtain a penetration test task general table corresponding to the target host to be tested, and storing the penetration test task general table corresponding to the target host to be tested. Therefore, the self-adaption and closed-loop optimization capability and the operation and decision-making performance of the decision-making scheme can be improved, and finally the penetration test effect can be improved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to an automated penetration testing strategy determination method, apparatus, equipment, medium, and product. Background Technology

[0002] With the continuous development of digitalization, enterprises face increasing security threats in the field of network technology, making ensuring enterprise network security a crucial task for modern enterprises and organizations. While network security protection technologies have made rapid progress, they often face challenges in defense against increasingly fierce offensive and defensive confrontations.

[0003] Penetration testing has gradually developed in the security field. Penetration testing is a proactive method of preventing network attacks. It uses simulated attacks on target hosts to find exploitable vulnerabilities, thereby achieving the effect of improving defense through offense.

[0004] Traditional penetration testing typically requires manual testing by security testers, consuming significant manpower and time. Testers need substantial expertise in penetration testing to repeatedly try various testing steps and methods using a wide range of security testing tools with different functions to complete the test. Furthermore, a single penetration test cannot fully resolve an enterprise's cybersecurity issues. The various devices and software running within the system are constantly being updated, modified, and migrated, making penetration testing a cyclical process. Relying solely on security testers to conduct penetration tests results in enormous human and time costs for the enterprise. Therefore, automating penetration testing to improve testing efficiency is becoming increasingly important.

[0005] In automated penetration testing, penetration testing decision-making is the core of the automated process and a key factor in improving testing efficiency. However, existing penetration testing decision-making schemes are still mainly based on expert penetration testing experience, which clearly suffers from over-reliance on expert experience and a lack of adaptive and closed-loop optimization capabilities. Therefore, there is a need to provide a new automated penetration testing decision-making scheme. Summary of the Invention

[0006] The purpose of this invention is to provide an automated penetration testing strategy determination method, apparatus, computer device, computer-readable storage medium, and computer program product to solve the problems of existing penetration testing decision-making schemes that rely too heavily on expert experience and lack adaptive and closed-loop optimization capabilities.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: Firstly, an automated penetration testing strategy determination method is provided, including: Acquire environmental characteristic data of the target host under test, wherein the environmental characteristic data packet contains the operating system type and a list of services / software; For each service / software in the service / software list, search the test item list for a penetration test item whose feature attributes match the operating system type and the corresponding service / software name, version information, protocol information, and port number information. The test item list contains several penetration test items, which are used to store successfully executed penetration test scripts and the feature attributes corresponding to those scripts. The feature attributes include the operating system type, service / software name, version information, protocol information, and port number information. If at least one penetration test item matching any service / software in the service / software list is found, a first set of penetration test scripts corresponding to any service / software is generated based on the at least one penetration test item. Otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, multiple penetration script search methods listed in the incentive rule item list are applied to find an array of exploit modules applicable under similar environmental characteristics, and the exploit module array is used to generate a second set of penetration test scripts corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit. Based on the set of penetration test scripts corresponding to any of the services / software, generate a penetration test task sub-table corresponding to any of the services / software; By summarizing the penetration testing task sub-tables of each service / software, a master penetration testing task table corresponding to the target host under test is obtained.

[0008] Based on the above-mentioned invention, a novel scheme for generating penetration testing tasks using network host environment characteristics as the basic decision-making factor is provided. Specifically, after obtaining environmental characteristic data of the target host, including its operating system type and a list of services / software, the scheme first searches the test item list for each service / software in the table to see if a matching penetration testing item exists. If a matching penetration testing item is found, a corresponding first set of penetration testing scripts is generated based on that item. Otherwise, multiple penetration script search methods are used to find an array of exploit modules applicable to similar environmental characteristics, and this array is used to generate a corresponding second set of penetration testing scripts. Finally, a penetration testing task sub-table is generated based on the aforementioned script sets, and a summary table of penetration testing tasks corresponding to the target host is obtained. This allows successful penetration testing experience to, to some extent, replace expert penetration testing experience, optimizing the decision-making method for obtaining penetration scripts. This improves the adaptive and closed-loop optimization capabilities of the decision-making scheme, as well as its operational and decision-making performance, ultimately enhancing penetration testing effectiveness and facilitating practical application and promotion.

[0009] In one possible design, generating a first set of penetration test scripts corresponding to any one of the services / softwares based on the at least one penetration test item includes the following steps S311 to S319: S311. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S312, where k represents a positive integer; S312. Obtain the s-th penetration test item TestItem among the at least one penetration test item, and then execute step S313; S313. Initialize the first script array ExploitScripts, the second script array PayloadScripts, and the target configuration script targetScript, and then execute step S314; S314. Obtain the penetration test script template in the run properties of the s-th penetration test item TestItem, add the Exploit module usage script in the penetration test script template to the first script array ExploitScripts, add the Payload module configuration script in the penetration test script template to the second script array PayloadScripts, and add the Target configuration script in the penetration test script template to the target configuration script targetScript, and then execute step S315; S315. Obtain the Exploit module parameter configuration script in the penetration test script template. Then, according to the system reference parameter table, for any Exploit module parameter in the Exploit module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the system information collection. If the corresponding parameter has multiple corresponding values ​​or the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Exploit module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Exploit module parameter configuration script to the unique corresponding value of the corresponding parameter. Then, add the updated configuration script to the first script array ExploitScripts. Finally, execute step S316. S316. Obtain the Payload module parameter configuration script in the penetration test script template. Then, according to the system reference parameter table, for any Payload module parameter in the Payload module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the system information collection. If the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Payload module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Payload module parameter configuration script to the corresponding value of the corresponding parameter. Then, add the updated configuration script to the second script array PayloadScripts. Finally, execute step S317. S317. Initialize the third script array Scripts, and then execute step S318, wherein the initialization process of the third script array Scripts includes the following steps S3171 to S3177: S3171. Obtain all parameter configuration scripts in the first script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the first script array ExploitScripts, then initialize integer variables p and q to 1 respectively, and finally execute step S3172, wherein the mult identifier is used to indicate that it has multiple parameter values; S3172. Configure the script for the p-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3173; S3173. For the configuration script of the p-th parameter, obtain the q-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3174; S3174. Use the p-th parameter configuration script and the first script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3175; S3175. Initialize a complete penetration testing script, then add the new Exploit module usage and configuration script, the second script array PayloadScripts, the target configuration script targetScript, and the Exploit module name in the run property of the s-th penetration testing item TestItem to the penetration testing script. Then add the penetration testing script to the third script array Scripts, and finally execute step S3176. S3176. If q is less than the total number of values ​​corresponding to the p-th parameter configuration script, then increment q by 1 and return to step S3173; otherwise, proceed to step S3177. S3177. If p is less than the total number of scripts in all parameter configuration scripts, then p is incremented by 1, and then the process returns to step S3172; otherwise, the initialization process ends. S318. Add the third script array Scripts to the penetration testing script set Script[k], and then execute step S319; S319. If s is less than the total number of the at least one penetration test item, then increment s by 1 and return to step S312; otherwise, use the penetration test script set Script[k] as the first penetration test script set corresponding to any of the services / software.

[0010] In one possible design, based on the operating system type and the service / software name, version information, and protocol information of any service / software, the array of exploit modules applicable to similar environmental characteristics is found by applying various penetration script search methods listed in the incentive rule item list, including the following steps S321 to S329: S321. Based on the operating system type and the service / software name, version information and protocol information of any service / software, generate a set of key-value pairs for use as search conditions for the Exploit module, initialize the integer variable s to 1, and then execute step S322, wherein the set of key-value pairs includes operating system type key-value pairs, service / software name key-value pairs, version information key-value pairs and protocol information key-value pairs; S322. Select the sth type of penetration script search method from the list of incentive rule items, and find the key-value pair that matches the sth type of penetration script search method from the key-value pair set according to the matching rule. Then execute step S323, wherein the matching rule includes: the corresponding value of the sth type of penetration script search method contains the first element value of the value set in the key-value pair. S323. Determine whether the set of values ​​in the key-value pair is an empty set. If so, proceed to step S328; otherwise, initialize the integer variable p to 1 and then proceed to step S324. S324. Determine whether the corresponding value of the s-th penetration script search method indicates the operating system type, software / service name, software / service version information, or software / service protocol information. If yes, find the first Exploit module whose module name contains the p-th element value in the value set in the Exploit module list of the penetration testing tool Metasploit, and record the first Exploit module in the module array ExecExploits, and then execute step S325. Otherwise, find the second Exploit module whose module name contains the value in the key-value pair of the operating system type and the p-th element value in the value set in the Exploit module list of the penetration testing tool Metasploit, and record the second Exploit module in the module array ExecExploits, and then execute step S325. S325. Delete the executed Exploit modules from the module array ExecExploits, and also delete the Exploit modules whose availability tag value is lower than a preset threshold, and then execute step S326; S326. Determine whether the total number of modules in the module array ExecExploits is equal to zero. If yes, proceed to step S327; otherwise, proceed to step S329. S327. Determine whether p is less than the total number of elements in the value set. If so, increment p by 1 and then return to step S324. Otherwise, proceed to step S328. S328. Determine whether s is less than the total number of penetration script search methods in the list of incentive rules. If so, increment s by 1 and then return to step S322. Otherwise, terminate the search. S329. The module array ExecExploits is used as an array of exploit modules found based on the operating system type and the service / software name, version information and protocol information of any of the services / softwares and applicable under similar environmental characteristics, wherein the exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit.

[0011] In one possible design, based on the operating system type and the service / software name, version information, and protocol information of any of the services / softwares, a set of key-value pairs is generated to serve as search criteria for the Exploit module, including: Generate operating system type key-value pairs based on the operating system type; Based on the service / software name of any of the services / software, the service / software name key-value pairs with a first value set are generated by sequentially performing name decomposition, deleting duplicate values, and deleting strings with a length less than or equal to 2. Based on the version information of any of the services / software, version information key-value pairs with a second value set are generated by sequentially decomposing the version information, deleting duplicate values, and deleting strings with a length less than or equal to 2. Generate protocol information key-value pairs based on the protocol information of any of the services / software; In the second value set, delete the element value that is the same as another element value in the first value set, and also delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair, to obtain a new version information key-value pair; In the first set of values, delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair to obtain a new service / software name key-value pair; The key-value pairs of the operating system type, the new service / software name, the new version information, and the protocol information are aggregated to obtain a set of key-value pairs used as search criteria for the Exploit module.

[0012] In one possible design, the exploit module array is used to generate a second set of penetration testing scripts corresponding to any of the services / software, including the following steps S331 to S353: S331. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S332, where k represents a positive integer; S332. Obtain the s-th Exploit module in the Exploit module array, and then execute step S333; S333. Initialize the fourth script array ExploitScripts, then generate the exploit module usage script according to the penetration testing script template, add the exploit module usage script to the fourth script array ExploitScripts, finally initialize the integer variable p to 1, and execute step S334. S334. Obtain the p-th parameter Para from the parameter list of the s-th Exploit module, and then execute step S335; S335. If the value of the required item in the attribute of the p-th parameter Para indicates that the current value Current Setting is empty, then proceed to step S336; otherwise, proceed to step S337. S336. Based on the Exploit module parameter configuration script template and the system reference parameter table, if the parameter type of the p-th parameter Para is obtained before task allocation, then find the corresponding value of the p-th parameter Para in the system collected information. If the p-th parameter Para has multiple corresponding values, then use the corresponding value name identifier and the multit identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script. Otherwise, use the corresponding value to generate the Exploit module parameter configuration script. If the parameter type of the p-th parameter Para is obtained after task allocation, then use the corresponding value name identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script, and generate the Exploit module parameter configuration script. Finally, add the generated configuration script to the fourth script array ExploitScripts, and execute step S337. S337. If p is less than the total number of parameters in the parameter list of the s-th Exploit module, then p is incremented by 1, and then the process returns to step S334; otherwise, step S338 is executed. S338. If the number of scripts with the mult identifier in the fourth script array ExploitScripts exceeds two, it indicates that the generation of the fourth script array ExploitScripts failed, and step S339 is executed; otherwise, step S340 is executed, wherein the mult identifier is used to indicate that it has multiple parameter values. S339. If s is less than the total number of modules in the Exploit module array, increment s by 1 and then return to step S332; otherwise, end the script set generation. S340. Obtain the list of system types supported by the s-th Exploit module, SupportTargetList, and then execute step S341; S341. If the system type list SupportTargetList contains an Automatic Targeting type, then set the value of Target to equal the number of the Automatic Targeting type, and then execute step S343; otherwise, search for a system type in the system type list SupportTargetList whose name contains the name of the operating system type, and then execute step S342. S342. If the first system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then the value of the target Target is equal to the index of the first system type. If no system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then return to step S339. S343. Based on the value of the target and the target configuration script template, generate the target configuration script targetScript, and then execute step S344; S344. Obtain the Payload module list SupportPayloads supported by the s-th Exploit module, delete Payload modules whose availability tag value is lower than a preset threshold in the Payload module list SupportPayloads, initialize the integer variable q to 1, and then execute step S345. S345. Obtain the q-th Payload module in the Payload module list SupportPayloads, initialize the integer variable r and the fifth script array PayloadScripts, and then execute step S346; S346. Obtain the r-th parameter Para from the parameter list of the q-th Payload module, and then execute step S347; S347. If the value of the required item in the attribute of the r-th parameter Para indicates that the current value Current Setting is empty, then proceed to step S348; otherwise, proceed to step S349. S348. Based on the Payload module parameter configuration script template and the system reference parameter table, if the parameter type of the r-th parameter Para is obtained before task allocation, then find the corresponding value of the r-th parameter Para in the system collected information; if the parameter type of the r-th parameter Para is obtained after task allocation, use the parameter identifier to mark the position of the r-th parameter Para in the Payload module parameter configuration script, and generate the Payload module parameter configuration script. Finally, add the generated configuration script to the fifth script array PayloadScripts, and execute step S349. S349. If r is less than the total number of parameters in the parameter list of the q-th Payload module, then increment r by 1 and return to step 346; otherwise, proceed to step S350. S350. Initialize the sixth script array Scripts, and then execute step S351, wherein the initialization process of the sixth script array Scripts includes the following steps S3501 to S3507: S3501. Obtain all parameter configuration scripts in the fourth script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the fourth script array ExploitScripts, then initialize integer variables i and j to 1 respectively, and finally execute step S3502, wherein the mult identifier is used to indicate that there are multiple parameter values; S3502. Configure the script for the i-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3503; S3503. Configure the script for the i-th parameter, obtain the j-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3504; S3504. Use the i-th parameter configuration script and the fourth script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3505; S3505. Initialize a complete penetration testing script, then add the new exploit module usage and configuration script, the fifth script array PayloadScripts, the target configuration script targetScript, and the module name of the s-th exploit module to the penetration testing script. Then add the penetration testing script to the sixth script array Scripts, and finally execute step S3506. S3506. If j is less than the total number of values ​​of the multiple corresponding values ​​corresponding to the i-th parameter configuration script, then j is incremented by 1, and then the process returns to step S3503; otherwise, step S3507 is executed. S3507. If i is less than the total number of scripts in all parameter configuration scripts, then increment i by 1 and return to step S3502; otherwise, end the initialization process. S351. Add the sixth script array Scripts to the penetration testing script set Script[k], and then execute step S352; S352. If q is less than the total number of modules in the Payload module list SupportPayloads, then increment q by 1 and return to step S345; otherwise, proceed to step S353. S353. If s is less than the total number of modules in the Exploit module array, then increment s by 1 and return to step S332; otherwise, use the penetration test script set Script[k] as the second penetration test script set corresponding to any of the services / software.

[0013] In one possible design, after obtaining the master list of penetration testing tasks corresponding to the target host under test, the method further includes: Output the master list of penetration testing tasks to execute penetration tasks, and receive the corresponding task execution results; If the task execution result indicates that a penetration test task has been successfully executed, and the penetration test task is generated based on a penetration test script and the penetration test script is obtained by searching using a certain penetration script search method, then a new penetration test item is generated based on the penetration test script and the operating system type, service / software name, version information, protocol information, and port number information used to search for the penetration test script, and / or the application priority of the certain penetration script search method in the incentive rule item list is increased.

[0014] Secondly, an automated penetration testing strategy determination device is provided, including an environment feature acquisition unit, a test item search unit, a script set generation unit, a test task generation unit, and a test task summary unit that are sequentially connected by communication. The environmental feature acquisition unit is used to acquire environmental feature data of the target host under test, wherein the environmental feature data packet contains the operating system type and a list of services / software; The test item lookup unit is used to search the test item list for each service / software in the service / software list to see if there is a penetration test item whose feature attributes match the operating system type and the corresponding service / software name, version information, protocol information and port number information. The test item list contains a number of penetration test items. The penetration test item is used to store successfully executed penetration test scripts and the feature attributes corresponding to the penetration test scripts. The feature attributes include the operating system type and the service / software name, version information, protocol information and port number information. The script set generation unit is configured to, if at least one penetration test item matching any service / software in the service / software list is found, generate a first penetration test script set corresponding to any service / software based on the at least one penetration test item; otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, apply multiple penetration script search methods listed in the incentive rule item list to find an array of exploit modules applicable under similar environmental characteristics, and use the exploit module array to generate a second penetration test script set corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit. The test task generation unit is used to generate a penetration test task sub-table corresponding to any one of the services / softwares based on the set of penetration test scripts corresponding to any one of the services / softwares. The test task aggregation unit is used to aggregate the penetration test task sub-tables of each service / software to obtain the overall penetration test task table corresponding to the target host under test.

[0015] Thirdly, the present invention provides a computer device comprising a storage module, a processing module, and a transceiver module connected in sequence for communication, wherein the storage module is used to store a computer program, the transceiver module is used to send and receive messages, and the processing module is used to read the computer program and execute the automated penetration testing strategy determination method as described in the first aspect or any possible design in the first aspect.

[0016] Fourthly, the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, perform the automated penetration testing strategy determination method as described in the first aspect or any possible design in the first aspect.

[0017] Fifthly, the present invention provides a computer program product, including a computer program or instructions, which, when executed by a computer, implement the automated penetration testing strategy determination method as described in the first aspect or any possible design in the first aspect.

[0018] The beneficial effects of the above scheme are: (1) This invention creatively provides a new scheme for generating penetration testing tasks based on network host environment characteristics as the basic decision factor. That is, after obtaining the environment characteristic data of the target host to be tested, which includes the operating system type and service / software list, the system first searches for whether there is a matching penetration testing item in the test item list for each service / software in the table. If a matching penetration testing item is found, the system generates a corresponding first set of penetration testing scripts based on the test item. Otherwise, the system uses multiple penetration script search methods to find an array of Exploit modules applicable under similar environment characteristics, and uses the array to generate a corresponding second set of penetration testing scripts. Finally, the system generates a penetration testing task sub-table based on the aforementioned script set, and summarizes the results to obtain a total table of penetration testing tasks corresponding to the target host to be tested. This allows the successful penetration execution experience to replace expert penetration testing experience to a certain extent, optimizes the decision-making method for obtaining penetration scripts, and improves the adaptive and closed-loop optimization capabilities of the decision-making scheme as well as the running and decision-making performance. Ultimately, this is conducive to improving the penetration testing effect and is convenient for practical application and promotion. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the automated penetration testing strategy determination method provided in an embodiment of this application.

[0021] Figure 2 This is an example diagram showing the content breakdown of the live host information provided in an embodiment of the present invention.

[0022] Figure 3 This is an example diagram showing the attribute decomposition of penetration test items provided in an embodiment of the present invention.

[0023] Figure 4 This is an example diagram showing the content breakdown of system configuration information provided in an embodiment of the present invention.

[0024] Figure 5 A schematic diagram of the structure of the automated penetration testing strategy determination device provided in the embodiments of this application.

[0025] Figure 6 A schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and descriptions of the embodiments or the prior art. Obviously, the following description of the structure of the accompanying drawings is only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these embodiments without creative effort. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0027] It should be understood that although the terms "first" and "second", etc., may be used herein to describe various objects, these objects should not be limited by these terms. These terms are only used to distinguish one object from another. For example, the first object may be referred to as the second object, and similarly, the second object may be referred to as the first object, without departing from the scope of the exemplary embodiments of the invention.

[0028] It should be understood that the term "and / or" that may appear in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, B exists alone, or A and B exist simultaneously. Another example is A, B and / or C, which can mean that any one of A, B, and C or any combination thereof exists. The term " / and" that may appear in this document describes another relationship between related objects, indicating that two relationships can exist. For example, A / and B can mean: A exists alone or A and B exist simultaneously. In addition, the character " / " that may appear in this document generally indicates that the related objects before and after it are in an "or" relationship.

[0029] Example like Figures 1-4As shown, the automated penetration testing strategy determination method provided in the first aspect of this embodiment can be executed, but is not limited to, by a computer device with certain computing resources. For example, it can be executed by an electronic device such as a penetration strategy determination device in an automated penetration testing system, a server, a personal computer (PC, referring to a multi-purpose computer of a size, price, and performance suitable for personal use; desktop computers, laptops, mini-laptops, tablets, and ultrabooks are all considered personal computers), a smartphone, a personal digital assistant (PDA), or a wearable device. Figure 1 As shown, the automated penetration testing strategy determination method includes, but is not limited to, the following steps S1 to S5.

[0030] S1. Obtain environmental characteristic data of the target host to be tested, wherein the environmental characteristic data includes, but is not limited to, operating system type and service / software list.

[0031] In step S1, the target host to be tested is the object to be subjected to automated penetration testing. Specifically, it can be selected sequentially from the existing list of live hosts (HostList, which contains host information for each live host: IP address, operating system type, and a list of services / software, etc., where each service / software in the service / software list has, but is not limited to, service / software name, version information, protocol information, and port number information, etc.). Figure 2 The environmental characteristic data is obtained one by one from the data (as shown). Furthermore, the environmental characteristic data can be routinely collected before the penetration test by calling existing tools to access auxiliary interfaces and information collection tools (such as network probing and security auditing tools Nmap and / or website fingerprinting tools Whatweb, etc.); specific examples of the operating system type are shown in Table 1 below.

[0032] S2. For each service / software in the service / software list, search the test item list for any penetration test item whose characteristic attributes match the operating system type and the corresponding service / software name, version information, protocol information, and port number information. The test item list includes, but is not limited to, several penetration test items. The penetration test item is used to store successfully executed penetration test scripts and the characteristic attributes corresponding to the penetration test scripts. The characteristic attributes include, but are not limited to, the operating system type, service / software name, version information, protocol information, and port number information.

[0033] In step S2, the penetration test item is used to store the penetration test script that was successfully executed by the system and the corresponding environmental characteristic attributes. For example... Figure 3As shown, the runtime attributes of the penetration test item include, but are not limited to: test item ID, Exploit module (i.e., the Exploit attack module in the penetration testing tool Metasploit, hereinafter referred to as the Exploit module; Metasploit is an open-source existing penetration testing framework that includes a series of Exploit attack modules and Payload attack payload modules, which users can use to quickly construct penetration test scripts), and penetration test script template, etc.; the characteristic attributes of the penetration test item include, but are not limited to: operating system type, service / software name, version information, protocol, and port number, etc. The specific content of the penetration test script template includes, but is not limited to: Exploit module usage script (i.e., the exploit module usage script in the example below), Exploit module parameter configuration script (i.e., the exploit parameter configuration script in the example below), Target configuration script (i.e., the target configuration script in the example below), Payload module (i.e., the Payload attack payload module in the penetration testing tool Metasploit, hereinafter referred to as the Payload module) configuration script, and Payload module parameter configuration script (i.e., the Payload parameter configuration script in the example below), etc. In addition, the parameter identifier "" can be used in the penetration test script template.<InfoName:mult> The symbol "" indicates the parameter value to be replaced. The "mult" symbol indicates that there are multiple parameter values, while the absence of the "mult" symbol indicates that there is only one parameter value. Examples are shown below: .

[0034] In step S2, before searching for penetration testing items, the ServExploited array can be initialized to store the names of the exploit modules that the current service Serv has already executed; and service / software password cracking can be performed: using the system's built-in password cracking script library, and calling the Hydra tool (an open-source password cracking tool that supports cracking accounts and passwords for various service protocols) through the tool's auxiliary interface. The table format of the system's built-in password cracking script library is as follows: Table 1. Format of the system's built-in password cracking script library (where OSType refers to the operating system type)

[0035] Based on the aforementioned built-in script library, the corresponding script can be found using the current host operating system type and service name. The current host HostIP and service port are used as script parameters to generate an executable script. After that, the tool is used to call the auxiliary interface to call the Hydra tool. If the Hydra tool successfully cracks the password, the username and password are added to the current service as supplementary service information.

[0036] S3. If at least one penetration test item matching any service / software in the service / software list is found, a first set of penetration test scripts corresponding to any service / software is generated based on the at least one penetration test item. Otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, multiple penetration script search methods listed in the incentive rule item list are applied to find an array of exploit modules applicable under similar environmental characteristics, and the exploit module array is used to generate a second set of penetration test scripts corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit.

[0037] In step S3, two different methods for generating penetration test script sets are provided to achieve the following respectively: (1) under the same environmental characteristics, using the penetration scripts that have been verified by the system, verifying the exploitability of the target host vulnerability; (2) under similar environmental characteristics, finding the penetration test script through the penetration script search method, performing penetration testing, and verifying the exploitability of the target host vulnerability. Specifically, a first penetration test script set corresponding to any of the services / software is generated according to the at least one penetration test item, including but not limited to the following steps S311 to S319.

[0038] S311. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S312, where k represents a positive integer.

[0039] S312. Obtain the s-th penetration test item TestItem among the at least one penetration test item, and then execute step S313.

[0040] S313. Initialize the first script array ExploitScripts, the second script array PayloadScripts, and the target configuration script targetScript, and then execute step S314.

[0041] S314. Obtain the penetration test script template in the run properties of the s-th penetration test item TestItem, add the Exploit module usage script in the penetration test script template to the first script array ExploitScripts, add the Payload module configuration script in the penetration test script template to the second script array PayloadScripts, and add the Target configuration script in the penetration test script template to the target configuration script targetScript, and then execute step S315.

[0042] S315. Obtain the Exploit module parameter configuration script in the penetration testing script template. Then, according to the system parameter table, for any Exploit module parameter in the Exploit module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the system information collection. If the corresponding parameter has multiple corresponding values ​​or the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Exploit module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Exploit module parameter configuration script to the unique corresponding value of the corresponding parameter. Then, add the updated configuration script to the first script array ExploitScripts. Finally, execute step S316.

[0043] In step S315, the system parameter lookup table is used to look up parameter values ​​in the system when the penetration script is generated. An example is shown in Table 2 below: Table 2. Example of system parameter comparison

[0044] As shown in Table 2 above, the parameter types in the system parameter lookup table are divided into two categories: those obtained before task allocation and those obtained after task allocation. For example, the "LHOST" parameter can only be determined after the penetration task execution unit allocates a task to the specified penetration test host. The system configuration information includes, but is not limited to, an integration tool configuration information table, an exploit module list, a payload module list, and the system parameter lookup table, etc. (e.g., ...) Figure 4As shown in the diagram, the integration tool configuration information table is formed by the tool actively registering the interface URL (Uniform Resource Locator) address and tool type of the deployed integration testing tools with the testing system through the tool's auxiliary interface. The Exploit module list and the Payload module list can be obtained from the penetration testing tool Metasploit through the tool's auxiliary interface. The detailed information of the Exploit modules in the Exploit module list includes, but is not limited to, module name, exploit effect, description, supported Payload module list, supported system type list, and Exploit module parameter list. The detailed information of the Payload modules in the Payload module list includes, but is not limited to, module name, exploit effect, description, and Payload module parameter list.

[0045] S316. Obtain the Payload module parameter configuration script in the penetration test script template. Then, according to the system parameter table, for any Payload module parameter in the Payload module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the system information collection. If the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Payload module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Payload module parameter configuration script to the corresponding value of the corresponding parameter. Then, add the updated configuration script to the second script array PayloadScripts. Finally, execute step S317.

[0046] S317. Initialize the third script array Scripts, and then execute step S318, wherein the initialization process of the third script array Scripts includes, but is not limited to, the following steps S3171 to S3177.

[0047] S3171. Obtain all parameter configuration scripts in the first script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the first script array ExploitScripts, initialize integer variables p and q to 1, and finally execute step S3172, wherein the mult identifier is used to indicate that there are multiple parameter values.

[0048] S3172. Configure the script for the p-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3173.

[0049] S3173. For the configuration script of the p-th parameter, obtain the q-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3174.

[0050] S3174. Use the p-th parameter configuration script and the first script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3175.

[0051] S3175. Initialize a complete penetration testing script, then add the new Exploit module usage and configuration script, the second script array PayloadScripts, the target configuration script targetScript, and the Exploit module name in the run properties of the s-th penetration testing item TestItem to the penetration testing script. Then add the penetration testing script to the third script array Scripts, and finally execute step S3176.

[0052] In step S3175, the complete penetration testing script can be described using a Script object defined as follows:

[0053] As can be seen, the Script object contains: 1 exploit module usage script; m-1 exploit module parameter configuration scripts; 1 payload module configuration script; n-1 payload module parameter configuration scripts; and 1 target configuration script.

[0054] S3176. If q is less than the total number of values ​​corresponding to the p-th parameter configuration script, then increment q by 1 and return to step S3173; otherwise, proceed to step S3177.

[0055] S3177. If p is less than the total number of scripts in all parameter configuration scripts, then p is incremented by 1, and then the process returns to step S3172; otherwise, the initialization process ends.

[0056] S318. Add the third script array Scripts to the penetration testing script set Script[k], and then execute step S319.

[0057] S319. If s is less than the total number of the at least one penetration test item, then increment s by 1 and return to step S312; otherwise, use the penetration test script set Script[k] as the first penetration test script set corresponding to any of the services / software.

[0058] In step S3, the incentive rule list may, for example, include seven enumerated values ​​to represent system type (OSType), software service name (SerName), version information (SerVersion), protocol (Protocol), system type & software / service name (OSType & SerName), system type & version information (OSType & SerVersion), and system type & protocol (OSType & Protocol), respectively, so as to represent seven ways to find the penetration script in the penetration testing tool Metasploit. These seven ways can be sorted in order with an initial value of (0,0,0,0,1,1,1), as shown in Table 3 below: Table 3. Initial state of the incentive rule item list

[0059] In the testing system, the above seven penetration script search methods can be used to find successfully executed penetration scripts in the penetration testing tool Metasploit, and the count value of the corresponding method is incremented by 1 to increase the application priority of the system's selected search method. Specifically, based on the operating system type and the service / software name, version information, and protocol information of any service / software, the various penetration script search methods listed in the incentive rule item list are used to find an array of exploit modules applicable under similar environmental characteristics, including but not limited to the following steps S321 to S329.

[0060] S321. Based on the operating system type and the service / software name, version information, and protocol information of any service / software, generate a set of key-value pairs to be used as search conditions for the Exploit module, initialize the integer variable s to 1, and then execute step S322, wherein the set of key-value pairs includes operating system type key-value pairs, service / software name key-value pairs, version information key-value pairs, and protocol information key-value pairs.

[0061] In step S321, in detail, based on the operating system type and the service / software name, version information and protocol information of any service / software, a set of key-value pairs is generated to serve as the search conditions for the Exploit module, including but not limited to the following steps S3211 to S3215.

[0062] S3211. Generate operating system type key-value pairs according to the operating system type.

[0063] In step S3211, the operating system type key-value pair can be represented as: {'OSType', val1}.

[0064] S3212. Based on the service / software name of any of the services / softwares, generate service / software name key-value pairs with a first value set by sequentially performing name decomposition, deleting duplicate values, and deleting strings with a length less than or equal to 2.

[0065] In step S3212, the service / software name key-value pair can be represented as: {'SerName', val2}, where val2 is a set of values, and the name of the service / software can be decomposed using the special character set {'(',') ',','-',' / ',' '} to obtain the first value set A. N ={val 21 val 22 val 23 ... val 2m}

[0066] S3213. Based on the version information of any of the services / software, generate version information key-value pairs with a second value set by sequentially decomposing the version information, deleting duplicate values, and deleting strings with a length less than or equal to 2.

[0067] In step S3213, the version information key-value pair can be represented as: {'SerVersion', val3}, where val3 is another set of values, and the version information of the service / software can also be decomposed using the special character set {'(',') ',','-',' / ',' '} to obtain the second value set A. V ={ val 31 val 32 val 33 ... val 3n}

[0068] S3214. Generate protocol information key-value pairs based on the protocol information of any of the services / software.

[0069] In step S3214, the protocol information key-value pair can be represented as, for example, {'Protocol', val4}.

[0070] S3215. In the second value set, delete the element value that is the same as another element value in the first value set, and also delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair, to obtain a new version information key-value pair.

[0071] S3216. In the first value set, delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair, to obtain a new service / software name key-value pair.

[0072] S3217. Summarize the operating system type key-value pairs, the new service / software name key-value pairs, the new version information key-value pairs, and the protocol information key-value pairs to obtain a set of key-value pairs used as search conditions for the Exploit module.

[0073] Therefore, based on the above steps S3211 to S3217, the following set of key-value pairs can be obtained and used as the search criteria for the Exploit module: T'={{'OSType', {val1}}, {'SerName', {val 21 val 22 ... val 2i}}, {'SerVersion',{val 31 val 32 ... val 3j}, {'Protocol',{val4}}}.

[0074] S322. Select the sth type of penetration script search method from the list of incentive rule items, and find the key-value pair that matches the sth type of penetration script search method from the key-value pair set according to the matching rule. Then execute step S323, wherein the matching rule includes: the corresponding value of the sth type of penetration script search method contains the first element value of the value set in the key-value pair.

[0075] In step S322, the corresponding value of the s-th penetration script search method refers to the enumeration value in Table 2 above; the specific sequential listing method of the incentive rule item list may be, but is not limited to, sorting / listing in descending order of the enumeration value count.

[0076] S323. Determine whether the set of values ​​in the key-value pair is empty. If so, proceed to step S328; otherwise, initialize the integer variable p to 1 and then proceed to step S324.

[0077] S324. Determine whether the corresponding value of the s-th penetration script search method indicates the operating system type, software / service name, software / service version information, or software / service protocol information. If yes, find the first exploit module whose module name contains the p-th element value in the value set in the exploit module list of the penetration testing tool Metasploit, and record the first exploit module in the module array ExecExploits, and then execute step S325. Otherwise, find the second exploit module whose module name contains the value in the key-value pair of the operating system type and the p-th element value in the value set in the exploit module list of the penetration testing tool Metasploit, and record the second exploit module in the module array ExecExploits, and then execute step S325.

[0078] In step S324, the value in the operating system type key-value pair is val1.

[0079] S325. Delete the executed Exploit modules from the module array ExecExploits, and also delete the Exploit modules whose availability tag value is lower than a preset threshold, and then execute step S326.

[0080] In step S325, the exploit modules that have been executed against the current host in the module array ExecExploits can be deleted by comparing with the ServExploited array; and the exploit modules with a Rank value (i.e., the exploit effectiveness tag value used in the penetration testing tool Metasploit to represent the exploit module's exploitability tag value, which can be obtained by reading the basic attributes of the exploit module, and for example: manual for manual; automatic for automatic; low for low automation; medium for medium automation; high for high automation) equal to manual or low (i.e., the preset threshold is automatic or medium) can be deleted from the module array ExecExploits.

[0081] S326. Determine whether the total number of modules in the module array ExecExploits is equal to zero. If yes, proceed to step S327; otherwise, proceed to step S329.

[0082] S327. Determine whether p is less than the total number of elements in the value set. If so, increment p by 1 and then return to step S324. Otherwise, proceed to step S328.

[0083] S328. Determine whether s is less than the total number of penetration script search methods in the list of incentive rules. If so, increment s by 1 and then return to step S322. Otherwise, terminate the search.

[0084] S329. The module array ExecExploits is used as an array of exploit modules found based on the operating system type and the service / software name, version information and protocol information of any of the services / softwares and applicable under similar environmental characteristics, wherein the exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit.

[0085] In step S3, specifically, the exploit module array is used to generate a second set of penetration testing scripts corresponding to any of the services / software, including but not limited to the following steps S331 to S353.

[0086] S331. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S332, where k represents a positive integer.

[0087] S332. Obtain the s-th Exploit module in the Exploit module array, and then execute step S333.

[0088] S333. Initialize the fourth script array ExploitScripts, then generate an Exploit module usage script according to the penetration testing script template, add the Exploit module usage script to the fourth script array ExploitScripts, finally initialize the integer variable p to 1, and execute step S334.

[0089] S334. Obtain the p-th parameter Para from the parameter list of the s-th Exploit module, and then execute step S335.

[0090] S335. If the value of the required item in the attribute of the p-th parameter Para indicates yes and the current value Current Setting is empty, then proceed to step S336; otherwise, proceed to step S337.

[0091] S336. Based on the Exploit module parameter configuration script template and the system reference parameter table, if the parameter type of the p-th parameter Para is obtained before task allocation, then find the corresponding value of the p-th parameter Para in the system collected information. If the p-th parameter Para has multiple corresponding values, then use the corresponding value name identifier and the multit identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script. Otherwise, use the corresponding value to generate the Exploit module parameter configuration script. If the parameter type of the p-th parameter Para is obtained after task allocation, then use the corresponding value name identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script, and generate the Exploit module parameter configuration script. Finally, add the generated configuration script to the fourth script array ExploitScripts, and execute step S337.

[0092] S337. If p is less than the total number of parameters in the parameter list of the s-th Exploit module, then p is incremented by 1, and then the process returns to step S334; otherwise, step S338 is executed.

[0093] S338. If the number of scripts with the mult identifier in the fourth script array ExploitScripts exceeds two, it indicates that the generation of the fourth script array ExploitScripts failed, and step S339 is executed; otherwise, step S340 is executed, wherein the mult identifier is used to indicate that it has multiple parameter values.

[0094] S339. If s is less than the total number of modules in the Exploit module array, increment s by 1 and then return to step S332; otherwise, end the script set generation.

[0095] S340. Obtain the list of system types supported by the s-th Exploit module, SupportTargetList, and then execute step S341.

[0096] S341. If the system type list SupportTargetList contains an Automatic Targeting type, then set the value of Target to equal the index of the Automatic Targeting type, and then execute step S343; otherwise, search for a system type in the system type list SupportTargetList whose name contains the name of the operating system type, and then execute step S342.

[0097] S342. If the first system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then the value of the target Target is equal to the serial number of the first system type. If no system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then return to step S339.

[0098] S343. Based on the value of the target and the target configuration script template, generate the target configuration script targetScript, and then execute step S344.

[0099] S344. Obtain the Payload module list SupportPayloads supported by the s-th Exploit module, delete Payload modules whose availability tag value is lower than a preset threshold in the Payload module list SupportPayloads, initialize the integer variable q to 1, and then execute step S345.

[0100] In step S344, the specific details of the deletion process can be derived by referring to the conventional derivation of step S325 above, and will not be repeated here.

[0101] S345. Obtain the q-th Payload module in the Payload module list SupportPayloads, initialize the integer variable r and the fifth script array PayloadScripts, and then execute step S346.

[0102] S346. Obtain the r-th parameter Para from the parameter list of the q-th Payload module, and then execute step S347.

[0103] S347. If the value of the required item in the attribute of the r-th parameter Para indicates that the current value Current Setting is empty, then proceed to step S348; otherwise, proceed to step S349.

[0104] S348. Based on the Payload module parameter configuration script template and the system reference parameter table, if the parameter type of the r-th parameter Para is obtained before task allocation, then find the corresponding value of the r-th parameter Para in the system collected information; if the parameter type of the r-th parameter Para is obtained after task allocation, use the parameter identifier to mark the position of the r-th parameter Para in the Payload module parameter configuration script, and generate the Payload module parameter configuration script. Finally, add the generated configuration script to the fifth script array PayloadScripts, and execute step S349.

[0105] S349. If r is less than the total number of parameters in the parameter list of the q-th Payload module, then increment r by 1 and return to step 346; otherwise, proceed to step S350.

[0106] S350. Initialize the sixth script array Scripts, and then execute step S351, wherein the initialization process of the sixth script array Scripts includes, but is not limited to, the following steps S3501 to S3507.

[0107] S3501. Obtain all parameter configuration scripts in the fourth script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the fourth script array ExploitScripts, initialize integer variables i and j to 1 respectively, and finally execute step S3502, wherein the mult identifier is used to indicate that there are multiple parameter values.

[0108] S3502. Configure the script for the i-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3503.

[0109] S3503. For the i-th parameter configuration script, obtain the j-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3504.

[0110] S3504. Use the i-th parameter configuration script and the fourth script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3505.

[0111] S3505. Initialize a complete penetration testing script, then add the new exploit module usage and configuration script, the fifth script array PayloadScripts, the target configuration script targetScript, and the module name of the s-th exploit module to the penetration testing script. Then add the penetration testing script to the sixth script array Scripts, and finally execute step S3506.

[0112] S3506. If j is less than the total number of values ​​corresponding to the i-th parameter configuration script, then j is incremented by 1, and then the process returns to step S3503; otherwise, step S3507 is executed.

[0113] S3507. If i is less than the total number of scripts in all parameter configuration scripts, then increment i by 1 and return to step S3502; otherwise, end the initialization process.

[0114] S351. Add the sixth script array Scripts to the penetration testing script set Script[k], and then execute step S352.

[0115] S352. If q is less than the total number of modules in the Payload module list SupportPayloads, then increment q by 1 and return to step S345; otherwise, proceed to step S353.

[0116] S353. If s is less than the total number of modules in the Exploit module array, then increment s by 1 and return to step S332; otherwise, use the penetration test script set Script[k] as the second penetration test script set corresponding to any of the services / software.

[0117] S4. Generate a penetration testing task sub-table corresponding to any of the services / softwares based on the set of penetration testing scripts corresponding to each of the services / softwares.

[0118] In step S4, a penetration test task sub-table corresponding to any service / software can be generated by combining the IP address of the target host under test, the detailed information of any service / software, and the first or second set of penetration test scripts corresponding to any service / software.

[0119] S5. Summarize the penetration testing task sub-tables of each service / software to obtain the overall penetration testing task table corresponding to the target host to be tested.

[0120] After step S5, the penetration testing task summary table can be output to execute penetration tasks and receive the corresponding task execution results. Furthermore, to optimize the next penetration strategy decision based on the task execution results received for the penetration testing task summary table, preferably, after obtaining the penetration testing task summary table corresponding to the target host, the method further includes, but is not limited to: outputting the penetration testing task summary table to execute penetration tasks and receiving the corresponding task execution results; if the task execution result indicates that a penetration testing task has been successfully executed, and the penetration testing task is generated based on a penetration testing script and the penetration testing script was found using a certain penetration script search method, then a new penetration testing item is generated based on the penetration testing script and the operating system type, service / software name, version information, protocol information, and port number information used to find the penetration testing script, and / or the application priority of the certain penetration script search method in the incentive rule item list is increased. The aforementioned increase in the application priority of the aforementioned penetration script search method in the incentive rule item list includes, but is not limited to: incrementing the count value corresponding to the aforementioned penetration script search method by 1 in the incentive rule item list, and reordering all penetration script search methods in descending order of count value.

[0121] Therefore, based on the automated penetration testing strategy determination method described in steps S1 to S5 above, a new scheme for generating penetration testing tasks using network host environment characteristics as the basic decision factor is provided. Specifically, after obtaining environment characteristic data of the target host, including operating system type and service / software list, the system first searches the test item list for each service / software in the table to see if a matching penetration testing item exists. If a matching penetration testing item is found, a corresponding first set of penetration testing scripts is generated based on that item. Otherwise, multiple penetration script search methods are used to find an array of exploit modules applicable to similar environment characteristics, and this array is used to generate a corresponding second set of penetration testing scripts. Finally, a penetration testing task sub-table is generated based on the aforementioned script sets, and a summary table of penetration testing tasks corresponding to the target host is obtained. This allows successful penetration testing experience to replace expert penetration testing experience to a certain extent, optimizing the decision-making method for obtaining penetration scripts. This improves the adaptive and closed-loop optimization capabilities of the decision-making scheme, as well as its operational and decision-making performance, ultimately enhancing penetration testing effectiveness and facilitating practical application and promotion.

[0122] like Figure 5As shown, the second aspect of this embodiment provides a virtual device for implementing the automated penetration testing strategy determination method described in the first aspect, including an environment feature acquisition unit, a test item search unit, a script set generation unit, a test task generation unit, and a test task aggregation unit that are sequentially connected in communication. The environmental feature acquisition unit is used to acquire environmental feature data of the target host under test, wherein the environmental feature data packet contains the operating system type and a list of services / software; The test item lookup unit is used to search the test item list for each service / software in the service / software list to see if there is a penetration test item whose feature attributes match the operating system type and the corresponding service / software name, version information, protocol information and port number information. The test item list contains a number of penetration test items. The penetration test item is used to store successfully executed penetration test scripts and the feature attributes corresponding to the penetration test scripts. The feature attributes include the operating system type and the service / software name, version information, protocol information and port number information. The script set generation unit is configured to, if at least one penetration test item matching any service / software in the service / software list is found, generate a first penetration test script set corresponding to any service / software based on the at least one penetration test item; otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, apply multiple penetration script search methods listed in the incentive rule item list to find an array of exploit modules applicable under similar environmental characteristics, and use the exploit module array to generate a second penetration test script set corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit. The test task generation unit is used to generate a penetration test task sub-table corresponding to any one of the services / softwares based on the set of penetration test scripts corresponding to any one of the services / softwares. The test task aggregation unit is used to aggregate the penetration test task sub-tables of each service / software to obtain the overall penetration test task table corresponding to the target host under test.

[0123] The working process, working details and technical effects of the aforementioned device provided in the second aspect of this embodiment can be found in the automated penetration testing strategy determination method described in the first aspect, and will not be repeated here.

[0124] like Figure 6As shown, the third aspect of this embodiment provides a computer device for executing the automated penetration testing strategy determination method as described in the first aspect. The device includes a storage module, a processing module, and a transceiver module connected in sequence. The storage module stores a computer program, the transceiver module sends and receives messages, and the processing module reads the computer program and executes the automated penetration testing strategy determination method as described in the first aspect. Specifically, the storage module may include, but is not limited to, random-access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out (FIFO) memory, and / or first-in-last-out (FILO) memory, etc.; the processing module may, but is not limited to, use a microprocessor of the STM32F105 series. Furthermore, the computer device may also include, but is not limited to, a power supply module, a display screen, and other necessary components.

[0125] The working process, working details and technical effects of the aforementioned computer equipment provided in the third aspect of this embodiment can be found in the automated penetration testing strategy determination method described in the first aspect, and will not be repeated here.

[0126] This fourth aspect of the embodiment provides a computer-readable storage medium storing instructions comprising the automated penetration testing strategy determination method as described in the first aspect. Specifically, the computer-readable storage medium stores instructions that, when executed on a computer, perform the automated penetration testing strategy determination method as described in the first aspect. The computer-readable storage medium refers to a data storage medium, which may include, but is not limited to, floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0127] The working process, working details and technical effects of the aforementioned computer-readable storage medium provided in the fourth aspect of this embodiment can be found in the automated penetration testing strategy determination method described in the first aspect, and will not be repeated here.

[0128] This fifth aspect of the embodiment provides a computer program product, including a computer program or instructions, which, when executed by a computer, implement the automated penetration testing strategy determination method as described in the first aspect. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.

[0129] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An automated penetration testing strategy determination method, characterized in that, include: Acquire environmental characteristic data of the target host under test, wherein the environmental characteristic data packet contains the operating system type and a list of services / software; For each service / software in the service / software list, search the test item list for a penetration test item whose feature attributes match the operating system type and the corresponding service / software name, version information, protocol information, and port number information. The test item list contains several penetration test items, which are used to store successfully executed penetration test scripts and the feature attributes corresponding to those scripts. The feature attributes include the operating system type, service / software name, version information, protocol information, and port number information. If at least one penetration test item matching any service / software in the service / software list is found, a first set of penetration test scripts corresponding to any service / software is generated based on the at least one penetration test item. Otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, multiple penetration script search methods listed in the incentive rule item list are applied to find an array of exploit modules applicable under similar environmental characteristics, and the exploit module array is used to generate a second set of penetration test scripts corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit. Based on the set of penetration test scripts corresponding to any of the services / software, generate a penetration test task sub-table corresponding to any of the services / software; By summarizing the penetration testing task sub-tables of each service / software, a master penetration testing task table corresponding to the target host under test is obtained.

2. The automated penetration testing strategy determination method as described in claim 1, characterized in that, Generate a first set of penetration test scripts corresponding to any one of the services / softwares based on the at least one penetration test item, including the following steps S311 to S319: S311. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S312, where k represents a positive integer; S312. Obtain the s-th penetration test item TestItem among the at least one penetration test item, and then execute step S313; S313. Initialize the first script array ExploitScripts, the second script array PayloadScripts, and the target configuration script targetScript, and then execute step S314; S314. Obtain the penetration test script template in the run properties of the s-th penetration test item TestItem, add the Exploit module usage script in the penetration test script template to the first script array ExploitScripts, add the Payload module configuration script in the penetration test script template to the second script array PayloadScripts, and add the Target configuration script in the penetration test script template to the target configuration script targetScript, and then execute step S315; S315. Obtain the Exploit module parameter configuration script in the penetration test script template. Then, according to the system reference parameter table, for any Exploit module parameter in the Exploit module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the system information collection. If the corresponding parameter has multiple corresponding values ​​or the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Exploit module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Exploit module parameter configuration script to the unique corresponding value of the corresponding parameter. Then, add the updated configuration script to the first script array ExploitScripts. Finally, execute step S316. S316. Obtain the Payload module parameter configuration script in the penetration test script template. Then, according to the system reference parameter table, for any Payload module parameter in the Payload module parameter configuration script, if the corresponding parameter type is obtained before task allocation, find the corresponding value of the corresponding parameter in the information collected by the system. If the corresponding parameter type is obtained after task allocation, keep the configuration content of the corresponding parameter in the Payload module parameter configuration script unchanged. Otherwise, update the configuration content of the corresponding parameter in the Payload module parameter configuration script to the corresponding value of the corresponding parameter. Then, add the updated configuration script to the second script array PayloadScripts. Finally, execute step S317. S317. Initialize the third script array Scripts, and then execute step S318, wherein the initialization process of the third script array Scripts includes the following steps S3171 to S3177: S3171. Obtain all parameter configuration scripts in the first script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the first script array ExploitScripts, then initialize integer variables p and q to 1 respectively, and finally execute step S3172, wherein the mult identifier is used to indicate that it has multiple parameter values; S3172. Configure the script for the p-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3173; S3173. For the configuration script of the p-th parameter, obtain the q-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3174; S3174. Use the p-th parameter configuration script and the first script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3175; S3175. Initialize a complete penetration testing script, then add the new Exploit module usage and configuration script, the second script array PayloadScripts, the target configuration script targetScript, and the Exploit module name in the run property of the s-th penetration testing item TestItem to the penetration testing script. Then add the penetration testing script to the third script array Scripts, and finally execute step S3176. S3176. If q is less than the total number of values ​​corresponding to the p-th parameter configuration script, then increment q by 1 and return to step S3173; otherwise, proceed to step S3177. S3177. If p is less than the total number of scripts in all parameter configuration scripts, then p is incremented by 1, and then the process returns to step S3172; otherwise, the initialization process ends. S318. Add the third script array Scripts to the penetration testing script set Script[k], and then execute step S319; S319. If s is less than the total number of the at least one penetration test item, then increment s by 1 and return to step S312; otherwise, use the penetration test script set Script[k] as the first penetration test script set corresponding to any of the services / software.

3. The automated penetration testing strategy determination method as described in claim 1, characterized in that, Based on the operating system type and the service / software name, version information, and protocol information of any service / software, the array of exploit modules applicable to similar environmental characteristics is found by applying various penetration script search methods listed in the incentive rule item list, including the following steps S321 to S329: S321. Based on the operating system type and the service / software name, version information and protocol information of any service / software, generate a set of key-value pairs for use as search conditions for the Exploit module, initialize the integer variable s to 1, and then execute step S322, wherein the set of key-value pairs includes operating system type key-value pairs, service / software name key-value pairs, version information key-value pairs and protocol information key-value pairs; S322. Select the sth type of penetration script search method from the list of incentive rule items, and find the key-value pair that matches the sth type of penetration script search method from the key-value pair set according to the matching rule. Then execute step S323, wherein the matching rule includes: the corresponding value of the sth type of penetration script search method contains the first element value of the value set in the key-value pair. S323. Determine whether the set of values ​​in the key-value pair is an empty set. If so, proceed to step S328; otherwise, initialize the integer variable p to 1 and then proceed to step S324. S324. Determine whether the corresponding value of the s-th penetration script search method indicates the operating system type, software / service name, software / service version information, or software / service protocol information. If yes, find the first Exploit module whose module name contains the p-th element value in the value set in the Exploit module list of the penetration testing tool Metasploit, and record the first Exploit module in the module array ExecExploits, and then execute step S325. Otherwise, find the second Exploit module whose module name contains the value in the key-value pair of the operating system type and the p-th element value in the value set in the Exploit module list of the penetration testing tool Metasploit, and record the second Exploit module in the module array ExecExploits, and then execute step S325. S325. Delete the executed Exploit modules from the module array ExecExploits, and also delete the Exploit modules whose availability tag value is lower than a preset threshold, and then execute step S326; S326. Determine whether the total number of modules in the module array ExecExploits is equal to zero. If yes, proceed to step S327; otherwise, proceed to step S329. S327. Determine whether p is less than the total number of elements in the value set. If so, increment p by 1 and then return to step S324. Otherwise, proceed to step S328. S328. Determine whether s is less than the total number of penetration script search methods in the list of incentive rules. If so, increment s by 1 and then return to step S322. Otherwise, terminate the search. S329. The module array ExecExploits is used as an array of exploit modules found based on the operating system type and the service / software name, version information and protocol information of any of the services / softwares and applicable under similar environmental characteristics, wherein the exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit.

4. The automated penetration testing strategy determination method as described in claim 3, characterized in that, Based on the operating system type and the service / software name, version information, and protocol information of any of the services / softwares, a set of key-value pairs is generated to serve as search criteria for the Exploit module, including: Generate operating system type key-value pairs based on the operating system type; Based on the service / software name of any of the services / software, the service / software name key-value pairs with a first value set are generated by sequentially performing name decomposition, deleting duplicate values, and deleting strings with a length less than or equal to 2. Based on the version information of any of the services / software, version information key-value pairs with a second value set are generated by sequentially decomposing the version information, deleting duplicate values, and deleting strings with a length less than or equal to 2. Generate protocol information key-value pairs based on the protocol information of any of the services / software; In the second value set, delete the element value that is the same as another element value in the first value set, and also delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair, to obtain a new version information key-value pair; In the first set of values, delete the element value that is the same as the value in the operating system type key-value pair, and also delete the element value that is the same as the value in the protocol information key-value pair to obtain a new service / software name key-value pair; The key-value pairs of the operating system type, the new service / software name, the new version information, and the protocol information are aggregated to obtain a set of key-value pairs used as search criteria for the Exploit module.

5. The automated penetration testing strategy determination method as described in claim 1, characterized in that, The process of generating a second set of penetration testing scripts corresponding to any of the services / softwares using the Exploit module array includes the following steps S331 to S353: S331. Initialize the integer variable s to 1 and initialize the penetration test script set Script[k] containing k penetration test scripts, and then execute step S332, where k represents a positive integer; S332. Obtain the s-th Exploit module in the Exploit module array, and then execute step S333; S333. Initialize the fourth script array ExploitScripts, then generate the exploit module usage script according to the penetration testing script template, add the exploit module usage script to the fourth script array ExploitScripts, finally initialize the integer variable p to 1, and execute step S334. S334. Obtain the p-th parameter Para from the parameter list of the s-th Exploit module, and then execute step S335; S335. If the value of the required item in the attribute of the p-th parameter Para indicates yes and the current value Current Setting is empty, then proceed to step S336; otherwise, proceed to step S337. S336. Based on the Exploit module parameter configuration script template and the system reference parameter table, if the parameter type of the p-th parameter Para is obtained before task allocation, then find the corresponding value of the p-th parameter Para in the system collected information. If the p-th parameter Para has multiple corresponding values, then use the corresponding value name identifier and the multit identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script. Otherwise, use the corresponding value to generate the Exploit module parameter configuration script. If the parameter type of the p-th parameter Para is obtained after task allocation, then use the corresponding value name identifier to mark the position of the p-th parameter Para in the Exploit module parameter configuration script, and generate the Exploit module parameter configuration script. Finally, add the generated configuration script to the fourth script array ExploitScripts, and execute step S337. S337. If p is less than the total number of parameters in the parameter list of the s-th Exploit module, then p is incremented by 1, and then the process returns to step S334; otherwise, step S338 is executed. S338. If the number of scripts with the mult identifier in the fourth script array ExploitScripts exceeds two, it indicates that the generation of the fourth script array ExploitScripts failed, and step S339 is executed; otherwise, step S340 is executed, wherein the mult identifier is used to indicate that it has multiple parameter values. S339. If s is less than the total number of modules in the Exploit module array, increment s by 1 and then return to step S332; otherwise, end the script set generation. S340. Obtain the list of system types supported by the s-th Exploit module, SupportTargetList, and then execute step S341; S341. If the system type list SupportTargetList contains the automatic target type AutomaticTargeting, then set the value of the target Target to the number of the automatic target type AutomaticTargeting, and then execute step S343; otherwise, search for a system type in the system type list SupportTargetList whose name contains the name of the operating system type, and then execute step S342. S342. If the first system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then the value of the target Target is equal to the index of the first system type. If no system type whose name contains the name of the operating system type is found in the system type list SupportTargetList, then return to step S339. S343. Based on the value of the target and the target configuration script template, generate the target configuration script targetScript, and then execute step S344; S344. Obtain the Payload module list SupportPayloads supported by the s-th Exploit module, delete Payload modules whose availability tag value is lower than a preset threshold in the Payload module list SupportPayloads, initialize the integer variable q to 1, and then execute step S345. S345. Obtain the q-th Payload module in the Payload module list SupportPayloads, initialize the integer variable r and the fifth script array PayloadScripts, and then execute step S346; S346. Obtain the r-th parameter Para from the parameter list of the q-th Payload module, and then execute step S347; S347. If the value of the required item in the attribute of the r-th parameter Para indicates that the current value Current Setting is empty, then proceed to step S348; otherwise, proceed to step S349. S348. Based on the Payload module parameter configuration script template and the system reference parameter table, if the parameter type of the r-th parameter Para is obtained before task allocation, then find the corresponding value of the r-th parameter Para in the system collected information; if the parameter type of the r-th parameter Para is obtained after task allocation, use the parameter identifier to mark the position of the r-th parameter Para in the Payload module parameter configuration script, and generate the Payload module parameter configuration script. Finally, add the generated configuration script to the fifth script array PayloadScripts, and execute step S349. S349. If r is less than the total number of parameters in the parameter list of the q-th Payload module, then increment r by 1 and return to step 346; otherwise, proceed to step S350. S350. Initialize the sixth script array Scripts, and then execute step S351, wherein the initialization process of the sixth script array Scripts includes the following steps S3501 to S3507: S3501. Obtain all parameter configuration scripts in the fourth script array ExploitScripts that contain the mult identifier, delete all parameter configuration scripts in the fourth script array ExploitScripts, then initialize integer variables i and j to 1 respectively, and finally execute step S3502, wherein the mult identifier is used to indicate that there are multiple parameter values; S3502. Configure the script for the i-th parameter, use the corresponding parameter identifier to find multiple corresponding values ​​of the parameter in the information collected in the system, and then execute step S3503; S3503. Configure the script for the i-th parameter, obtain the j-th corresponding value from the multiple corresponding values, and use the corresponding value to replace the parameter identifier and mut identifier in the corresponding script, and then execute step S3504; S3504. Use the i-th parameter configuration script and the fourth script array ExploitScripts to generate a new Exploit module usage and configuration script, and then execute step S3505; S3505. Initialize a complete penetration testing script, then add the new exploit module usage and configuration script, the fifth script array PayloadScripts, the target configuration script targetScript, and the module name of the s-th exploit module to the penetration testing script. Then add the penetration testing script to the sixth script array Scripts, and finally execute step S3506. S3506. If j is less than the total number of values ​​of the multiple corresponding values ​​corresponding to the i-th parameter configuration script, then j is incremented by 1, and then the process returns to step S3503; otherwise, step S3507 is executed. S3507. If i is less than the total number of scripts in all parameter configuration scripts, then increment i by 1 and return to step S3502; otherwise, end the initialization process. S351. Add the sixth script array Scripts to the penetration testing script set Script[k], and then execute step S352; S352. If q is less than the total number of modules in the Payload module list SupportPayloads, then increment q by 1 and return to step S345; otherwise, proceed to step S353. S353. If s is less than the total number of modules in the Exploit module array, then increment s by 1 and return to step S332; otherwise, use the penetration test script set Script[k] as the second penetration test script set corresponding to any of the services / software.

6. The automated penetration testing strategy determination method as described in claim 1, characterized in that, After obtaining the master list of penetration testing tasks corresponding to the target host to be tested, the method further includes: Output the master list of penetration testing tasks to execute penetration tasks, and receive the corresponding task execution results; If the task execution result indicates that a penetration test task has been successfully executed, and the penetration test task is generated based on a penetration test script and the penetration test script is obtained by searching using a certain penetration script search method, then a new penetration test item is generated based on the penetration test script and the operating system type, service / software name, version information, protocol information, and port number information used to search for the penetration test script, and / or the application priority of the certain penetration script search method in the incentive rule item list is increased.

7. An automated penetration testing strategy determination device, characterized in that, It includes an environment feature acquisition unit with sequential communication connections, a test item search unit, a script set generation unit, a test task generation unit, and a test task summary unit; The environmental feature acquisition unit is used to acquire environmental feature data of the target host under test, wherein the environmental feature data packet contains the operating system type and a list of services / software; The test item lookup unit is used to search the test item list for each service / software in the service / software list to see if there is a penetration test item whose feature attributes match the operating system type and the corresponding service / software name, version information, protocol information and port number information. The test item list contains a number of penetration test items. The penetration test item is used to store successfully executed penetration test scripts and the feature attributes corresponding to the penetration test scripts. The feature attributes include the operating system type and the service / software name, version information, protocol information and port number information. The script set generation unit is configured to, if at least one penetration test item matching any service / software in the service / software list is found, generate a first penetration test script set corresponding to any service / software based on the at least one penetration test item; otherwise, based on the operating system type and the service / software name, version information, and protocol information of any service / software, apply multiple penetration script search methods listed in the incentive rule item list to find an array of exploit modules applicable under similar environmental characteristics, and use the exploit module array to generate a second penetration test script set corresponding to any service / software. The exploit module array is used to represent multiple exploit modules to be executed in the penetration testing tool Metasploit. The test task generation unit is used to generate a penetration test task sub-table corresponding to any one of the services / softwares based on the set of penetration test scripts corresponding to any one of the services / softwares. The test task aggregation unit is used to aggregate the penetration test task sub-tables of each service / software to obtain the overall penetration test task table corresponding to the target host under test.

8. A computer device, characterized in that, It includes a storage module, a processing module, and a transceiver module that are sequentially connected in communication. The storage module is used to store computer programs, the transceiver module is used to send and receive messages, and the processing module is used to read the computer programs and execute the automated penetration testing strategy determination method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that... The computer-readable storage medium stores instructions that, when executed on a computer, perform the automated penetration testing strategy determination method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or the instructions are executed by the computer, they implement the automated penetration testing strategy determination method as described in any one of claims 1 to 6.

Images