Artificial intelligence-based network penetration and planning method and system

Abstract

This invention provides an artificial intelligence-based network penetration testing and planning method and system, relating to the field of network security. The method includes collecting network topology and host port data, identifying known and unknown exploit script vulnerabilities, constructing a vulnerability knowledge graph and generating penetration chains; generating an attack view in a 3D interface; generating technical and behavioral penetration chains and execution sequences based on target nodes; and finally generating attack instructions or code for different types of vulnerabilities and outputting protection strategies. This invention improves the automation level of penetration testing, enhances the ability to discover unknown vulnerabilities, and optimizes the allocation of attack and defense resources.

Description

Technical Field

[0001] This invention relates to network security technology, and in particular to a network penetration and planning method and system based on artificial intelligence. Background Technology

[0002] Cybersecurity threats are becoming increasingly complex and varied, and traditional network penetration testing and security planning methods are no longer sufficient to meet the security needs of the current network environment. As information systems grow in scale and complexity, network attack methods are also constantly evolving, from simple vulnerability exploitation to multi-stage, multi-vector attack chains. Network penetration testing, as a crucial means of assessing network security, directly impacts an organization's security protection capabilities. Traditional network penetration methods primarily rely on the experience and manual operation of security experts, including information gathering, vulnerability scanning, vulnerability exploitation, and privilege escalation.

[0003] With the development of artificial intelligence (AI) technology, applying AI to cybersecurity has become a new research hotspot, particularly in automated penetration testing, vulnerability analysis, and attack path planning. Currently, some research has attempted to use graph theory, machine learning, and other methods to construct attack graph models to analyze security vulnerabilities and attack paths in networks. However, existing network penetration and planning methods still have several shortcomings.

[0004] Traditional penetration testing methods struggle to effectively handle complex vulnerability exploitation relationships in large-scale network environments. They lack in-depth analysis of the correlations between vulnerabilities, cannot automatically generate optimal penetration paths, and have limited ability to exploit unknown vulnerabilities. They typically only handle vulnerabilities with existing exploit scripts and are ill-equipped to deal with newly discovered zero-day vulnerabilities or vulnerabilities lacking publicly available exploit code. Furthermore, they fail to present complex attack chains in an easily understandable way, hindering security personnel's overall grasp of network vulnerabilities and the development of effective protective measures. Summary of the Invention

[0005] This invention provides a network penetration and planning method and system based on artificial intelligence, which can solve the problems in the prior art.

[0006] A first aspect of this invention provides a network penetration and planning method based on artificial intelligence, comprising: Collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information; Based on the attack conditions and affected areas in the vulnerability information, a vulnerability knowledge graph is constructed, the exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, a multi-level vulnerability exploitation chain is generated, and the penetration path is output based on the attack success rate of the vulnerability exploitation chain. The penetration chain is generated into an attack view in a 3D interface according to the logical hierarchy of the nodes and the attack associations. The target node is located based on the attack view. Based on the reachable path and resource dependency strength of the target node in the vulnerability knowledge graph, a technical penetration chain and a behavioral penetration chain are generated. The temporal dependency relationship of the technical penetration chain and the behavioral penetration chain is calculated to form an execution sequence. Extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies.

[0007] The system collects network topology data and host port data, performs vulnerability scanning to obtain vulnerability information, and identifies known and unknown exploit script vulnerabilities within the vulnerability information, including: Collect TCP session traffic, and construct network connection data from the communication addresses and port numbers in the TCP session traffic; Analyze the communication characteristics of nodes in network connection data to generate node behavior data, cluster the node behavior data based on similarity to obtain node groups, and generate network topology data based on the data transmission relationship within the node groups. Extract data packets between nodes from network topology data, parse the payload content of the data packets to obtain host port data, and identify vulnerability information based on the service response identifier of the host port data; Parse the attack code in the vulnerability information, extract the execution operations in the attack code to obtain the exploit chain sequence, and generate a vulnerability fingerprint based on the exploit chain sequence. Based on vulnerability fingerprint analysis, the execution steps of the attack code in the vulnerability information are extracted. The execution steps are then matched with preset exploitation patterns. When a match is successful, it is determined to be a known exploit script vulnerability; when a match fails, it is determined to be an unknown exploit script vulnerability.

[0008] Based on the attack conditions and affected areas in the vulnerability information, a vulnerability knowledge graph is constructed. The exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, generating a multi-level vulnerability exploitation chain. Based on the attack success rate of the vulnerability exploitation chain, the penetration chain is output, including: The attack conditions and affected areas in the vulnerability information are obtained, and the resource dependencies of the attack conditions and affected areas in the target environment are analyzed to obtain a constraint matrix. An initial vulnerability knowledge graph is constructed based on the dependency relationship of the constraint matrix. The reachability states of adjacent vulnerability nodes are analyzed in the initial vulnerability knowledge graph. Environmental constraints are obtained based on the matching relationship between the reachability states and the constraint matrix. The exploitation probability between vulnerability nodes is calculated based on the environmental constraints. A weighted vulnerability knowledge graph is constructed by using the exploit probability as the association weight between vulnerability nodes. Vulnerability nodes in the weighted vulnerability knowledge graph are filtered according to the constraint matrix. Based on the exploit probability, a multi-level vulnerability exploit chain is generated by propagating between the filtered vulnerability nodes. The attack success rate is obtained by calculating the cumulative probability of exploitation of the vulnerability exploitation chain, and the penetration chain is output based on the attack success rate.

[0009] The penetration testing process generates an attack view in a 3D interface based on the logical hierarchy of nodes and attack associations, including: Calculate the in-degree and out-degree values ​​of nodes in the penetration path, determine the vulnerability severity of the nodes based on the in-degree and out-degree values, and map the vulnerability severity to the display size of the nodes; The attack association strength between nodes is calculated based on the in-degree and out-degree values, and the attack association strength is mapped to the curvature of the connected surface. Obtain the logical hierarchy of the nodes, assign nodes that meet the display size to different height planes of the 3D interface according to the logical hierarchy, calculate the interaction force between nodes based on the attack association strength, and generate the spatial coordinates of the nodes based on the interaction force. A spatial path for the connecting surface between nodes is generated based on the spatial coordinates and curvature. The nodes are arranged in spatial coordinates, and the nodes are connected along the spatial path through a connecting surface that conforms to the curvature to generate an attack view of the penetration link.

[0010] Based on the attack view, the target node is located. A technical penetration chain and a behavioral penetration chain are generated based on the reachability path and resource dependency strength of the target node in the vulnerability knowledge graph. The temporal dependencies of the technical penetration chain and the behavioral penetration chain are calculated to form an execution sequence, including: Calculate the node cost score based on the resource consumption of the nodes in the attack view, and locate the target node based on the node cost score; Extract the reachable path of the target node, calculate the resource state transition cost of adjacent nodes in the path, and generate an attack path that satisfies resource constraints based on the resource state transition cost; The resource dependency intensity is calculated based on the resource request and release amounts of nodes in the reachable path, and the resource acquisition order of the nodes is determined according to the resource dependency intensity. The vulnerability exploitation operations in the reachable path are extracted as technical penetration chains, and the resource acquisition order is extracted as behavioral penetration chains. The state correspondence between the technical penetration chains and behavioral penetration chains is constructed based on the resource consumption values ​​of the nodes. Based on the state correspondence analysis of the node state transition constraints, a temporal dependency matrix is ​​constructed. Based on the temporal dependency matrix analysis technology, the temporal dependency relationship of the penetration chain and behavior penetration chain is analyzed, and an execution sequence is generated according to the temporal dependency relationship.

[0011] The exploit operations in the reachable path are extracted as a technical penetration chain, and the resource acquisition sequence is extracted as a behavioral penetration chain. The state correspondence between the technical penetration chain and the behavioral penetration chain is constructed based on the resource consumption values ​​of the nodes, including: Extract exploit operations from reachable paths, obtain resource consumption values ​​for exploit operations, construct resource consumption sequences, extract resource utilization features from resource consumption sequences, and construct technology penetration chains based on the resource utilization features. Extract the resource request and release values ​​of nodes in the resource acquisition order, calculate the resource occupation period of the nodes, identify overlapping intervals based on the resource occupation period to calculate the resource competition, and construct a behavior penetration chain by combining the resource competition and resource utilization characteristics. Obtain the resource usage values ​​of nodes in the technology penetration chain and behavior penetration chain, generate a resource state change sequence, and identify the state transition critical point from the resource state change sequence; Based on the state transition critical point, the resource state interval is divided, and based on the resource density distribution of the resource state interval, the state affiliation of the nodes in the technology penetration chain and behavior penetration chain is determined. Based on the state similarity of the calculated nodes according to the state attribution, a state correspondence between the technology penetration chain and the behavior penetration chain is constructed based on the state similarity.

[0012] Extract vulnerability features from the execution sequence, generate attack instructions for known script vulnerabilities, infer attack code for unknown script vulnerabilities, and output protection strategies including: The operation execution order is obtained from the execution sequence, and the repeated sequences in the operation execution order are extracted. Vulnerability features are extracted based on the frequency and temporal position of the repeated sequences. Obtain control flow and data flow features from known exploit scripts, combine the control flow features, data flow features and vulnerability features to construct a feature template, perform feature matching on known exploit scripts based on the feature template, and generate attack instructions based on the feature matching results; Obtain an unknown execution sequence that exploits a script vulnerability, calculate the structural and behavioral similarities between the execution sequence and a feature template, extract matching features based on the structural and behavioral similarities, mutate and recombine the matching features, and infer and generate attack code. Extract the execution path from the attack instructions and attack code, identify the operation points in the execution path, and generate a protection strategy based on the operation points and vulnerability characteristics.

[0013] A second aspect of the present invention provides an artificial intelligence-based network penetration and planning system, comprising: The first unit is used to collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information. The second unit is used to construct a vulnerability knowledge graph based on the attack conditions and affected areas in the vulnerability information, calculate the exploitation probability between vulnerability nodes in the vulnerability knowledge graph, generate multi-level vulnerability exploitation chains, and output the penetration link based on the attack success rate of the vulnerability exploitation chains. The third unit is used to generate an attack view in a three-dimensional interface by dividing the penetration link into logical levels of nodes and attack associations. The fourth unit is used to locate target nodes based on the attack view, generate technical penetration chains and behavioral penetration chains based on the reachability paths and resource dependency strength of the target nodes in the vulnerability knowledge graph, and calculate the temporal dependencies of the technical penetration chains and behavioral penetration chains to form an execution sequence. The fifth unit is used to extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies.

[0014] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0015] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0016] In this embodiment, by constructing a vulnerability knowledge graph and calculating the exploitation probability between vulnerability nodes, multi-level vulnerability exploitation chains can be automatically generated, improving the automation and efficiency of penetration testing, reducing manual intervention, and significantly saving time and manpower costs in network security assessment. By generating an attack view in a 3D interface and analyzing the reachable paths of target nodes, the temporal dependencies of both technical and behavioral penetration chains can be considered simultaneously, making the penetration testing process more systematic and comprehensive, enhancing the penetration capability in complex network environments, and improving the accuracy and coverage of security assessments. For unknown exploit script vulnerabilities, the system can use artificial intelligence technology to infer and generate attack code and automatically output corresponding protection strategies, achieving rapid response and defense capabilities against new network threats, improving the adaptability and foresight of the network defense system, and providing more proactive and comprehensive technical support for network security protection. Attached Figure Description

[0017] Figure 1This is a flowchart illustrating the network penetration and planning method based on artificial intelligence, as described in an embodiment of the present invention. Figure 2 This is a flowchart illustrating the logic for calculating the resource consumption of attack view nodes in an embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0020] Figure 1 This is a flowchart illustrating the network penetration and planning method based on artificial intelligence according to an embodiment of the present invention. Figure 1 As shown, the method includes: Collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information; Based on the attack conditions and affected areas in the vulnerability information, a vulnerability knowledge graph is constructed, the exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, a multi-level vulnerability exploitation chain is generated, and the penetration path is output based on the attack success rate of the vulnerability exploitation chain. The penetration chain is generated into an attack view in a 3D interface according to the logical hierarchy of the nodes and the attack associations. The target node is located based on the attack view. Based on the reachable path and resource dependency strength of the target node in the vulnerability knowledge graph, a technical penetration chain and a behavioral penetration chain are generated. The temporal dependency relationship of the technical penetration chain and the behavioral penetration chain is calculated to form an execution sequence. Extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies.

[0021] In one optional implementation, network topology data and host port data are collected, vulnerability scanning is performed to obtain vulnerability information, and known and unknown exploit script vulnerabilities in the vulnerability information are identified, including: Collect TCP session traffic, and construct network connection data from the communication addresses and port numbers in the TCP session traffic; Analyze the communication characteristics of nodes in network connection data to generate node behavior data, cluster the node behavior data based on similarity to obtain node groups, and generate network topology data based on the data transmission relationship within the node groups. Extract data packets between nodes from network topology data, parse the payload content of the data packets to obtain host port data, and identify vulnerability information based on the service response identifier of the host port data; Parse the attack code in the vulnerability information, extract the execution operations in the attack code to obtain the exploit chain sequence, and generate a vulnerability fingerprint based on the exploit chain sequence. Based on vulnerability fingerprint analysis, the execution steps of the attack code in the vulnerability information are extracted. The execution steps are then matched with preset exploitation patterns. When a match is successful, it is determined to be a known exploit script vulnerability; when a match fails, it is determined to be an unknown exploit script vulnerability.

[0022] During implementation, TCP session traffic needs to be collected. This can be achieved by deploying traffic collection devices at key network nodes, such as traffic collection probes on the mirror ports of core network switches, to capture all TCP packets passing through that node. The collected packets contain information such as source IP address, source port, destination IP address, and destination port, which constitute network connection data. For example, a connection record in the form of "192.168.1.100: 3389 -> 192.168.1.200: 49152" can be recorded, indicating that a TCP connection was established from port 3389 of IP address 192.168.1.100 to port 49152 of IP address 192.168.1.200.

[0023] The collected network connection data is analyzed to extract the communication characteristics of the nodes, generating node behavior data. These communication characteristics include metrics such as connection frequency, data transmission volume, and connection duration. For example, for a web server node, its behavior data might include features such as "receiving an average of 200 connection requests per minute on port 80, an average connection duration of 15 seconds, and an average data transmission volume of 20KB per connection." Based on this node behavior data, a similarity clustering algorithm is used to group nodes with similar communication behaviors together. Similarity calculation can be based on the Euclidean distance of the behavior characteristics; when the distance between the behavior characteristics of two nodes is less than a preset threshold (e.g., 0.3), they are grouped into the same node group.

[0024] After the node groups are divided, the data transmission relationships between nodes within each group are analyzed to generate network topology data. For example, a relationship such as "nodes in node group A mainly send data to nodes in node group B, with an average transmission rate of 5 Mbps" can be identified. These relationships allow the construction of a complete network topology map, reflecting the logical connections between nodes in the network.

[0025] The process involves extracting data packets between nodes from network topology data, parsing the payload of these packets, and obtaining host port data. During parsing, appropriate parsing rules are applied based on different protocol types; for example, HTTP requires parsing request and response headers, while SSH requires extracting version information. The parsing yields host port data in the form of "Server 192.168.1.100 is running Apache 2.4.41 on port 80 and has PHP 7.2.24 enabled."

[0026] Potential vulnerabilities are identified by analyzing service response identifiers in host port data. These identifiers include information such as server type, version number, and functional modules. These identifiers are then matched against a known vulnerability database to identify potential vulnerabilities. Additionally, proactive probing methods can be used to verify exploitability, such as sending crafted request data to a specific port and observing the response to determine if the vulnerability exists.

[0027] The attack code in the identified vulnerability information is parsed to extract the execution operations and obtain the exploit chain sequence. The attack code may be in binary or script form, requiring the application of appropriate parsing techniques depending on the type. For a web vulnerability exploit script, an exploit chain sequence might be extracted such as "1. Send a specially crafted HTTP request to construct SQL injection; 2. Obtain database administrator privileges; 3. Write a webshell; 4. Obtain system shell privileges." Based on the extracted exploit chain sequence, a vulnerability fingerprint is generated that uniquely identifies the exploit method. The vulnerability fingerprint can be represented as a hash value or feature vector of the exploit chain sequence.

[0028] Based on the generated vulnerability fingerprint, the vulnerability information is further analyzed to extract the detailed execution steps of the attack code. These execution steps are more detailed than the exploit chain sequence, including specific parameters and conditions for each operation. For example, for the aforementioned web vulnerability, the detailed execution steps might include specific operations such as "POSTing data to the / login.php page with username=admin' OR 1=1-- to bypass login verification." The extracted execution steps are then matched against a pre-established exploit pattern library, which contains typical patterns of known vulnerability exploit scripts, such as "SQL injection followed by writing a webshell" and "buffer overflow to gain system privileges."

[0029] When the match rate between the execution steps and a preset exploitation pattern exceeds a threshold, such as 85%, the vulnerability is determined to be a known exploit script vulnerability, and the corresponding vulnerability type and severity level are marked. For example, it is determined that "this vulnerability is CVE-2020-11984, a remote code execution vulnerability, with a high severity level, and the exploit script type is remote command execution." When the match rate between the execution steps and all preset exploitation patterns is below the threshold, it is determined to be an unknown exploit script vulnerability. At this time, the system will record the characteristics of the unknown pattern and issue a security alert, indicating that there may be a zero-day vulnerability or a new attack method.

[0030] The above methods can comprehensively collect network topology data and host port data, effectively identify vulnerabilities in the network, and distinguish between known and unknown exploit script vulnerabilities, providing important evidence for network security protection.

[0031] In one optional implementation, a vulnerability knowledge graph is constructed based on the attack conditions and affected areas in the vulnerability information. The exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, generating a multi-level vulnerability exploitation chain. The penetration testing chain is output based on the attack success rate of the vulnerability exploitation chain, including: The attack conditions and affected areas in the vulnerability information are obtained, and the resource dependencies of the attack conditions and affected areas in the target environment are analyzed to obtain a constraint matrix. An initial vulnerability knowledge graph is constructed based on the dependency relationship of the constraint matrix. The reachability states of adjacent vulnerability nodes are analyzed in the initial vulnerability knowledge graph. Environmental constraints are obtained based on the matching relationship between the reachability states and the constraint matrix. The exploitation probability between vulnerability nodes is calculated based on the environmental constraints. A weighted vulnerability knowledge graph is constructed by using the exploit probability as the association weight between vulnerability nodes. Vulnerability nodes in the weighted vulnerability knowledge graph are filtered according to the constraint matrix. Based on the exploit probability, a multi-level vulnerability exploit chain is generated by propagating between the filtered vulnerability nodes. The attack success rate is obtained by calculating the cumulative probability of exploitation of the vulnerability exploitation chain, and the penetration chain is output based on the attack success rate.

[0032] In this invention, the penetration testing output method first obtains the attack conditions and affected areas from the vulnerability information. Taking a corporate network environment as an example, this environment includes a web server, an application server, and a database server, and contains three vulnerabilities: CVE-2021-A (remote code execution vulnerability, attack conditions are network access and ordinary user privileges, affected area is obtaining server control privileges); CVE-2021-B (privilege escalation vulnerability, attack conditions are obtaining target server control privileges, affected area is obtaining system administrator privileges); and CVE-2021-C (information disclosure vulnerability, attack conditions are having system administrator privileges, affected area is accessing sensitive data).

[0033] Analyze the attack conditions and resource dependencies of these vulnerabilities in the target environment to generate a constraint matrix. The constraint matrix records the dependencies between vulnerability nodes. For example, the affected region of CVE-2021-A, "gaining server control," matches the attack condition of CVE-2021-B, "having already gained control of the target server," indicating that exploiting CVE-2021-A can create conditions for exploiting CVE-2021-B. Based on these dependencies, construct an initial vulnerability knowledge graph, where nodes represent vulnerabilities and edges represent dependencies between vulnerabilities.

[0034] Based on the initial vulnerability knowledge graph, the reachability states of adjacent vulnerability nodes are analyzed. A reachable state represents the new state the system reaches after a vulnerability is successfully exploited. For example, after exploiting CVE-2021-A, the system state updates to "the attacker gained control of the server." These reachable states are matched against a constraint matrix to obtain environmental constraints. Environmental constraints include factors such as network isolation and access restrictions, which affect the difficulty of vulnerability exploitation.

[0035] Based on environmental constraints, the exploit probability between vulnerable nodes is calculated. Exploitation probability represents the likelihood of successfully exploiting a vulnerability given the preconditions. The calculation method considers the vulnerability's complexity, exploit difficulty, and the impact of environmental constraints. For example, if exploiting CVE-2021-A requires a specific software version and is restricted by a firewall, its exploit probability might be 0.7; while exploiting CVE-2021-B is relatively simple, its exploit probability might be 0.9; and CVE-2021-C, due to requiring specific operations, has an exploit probability of 0.8.

[0036] The calculated exploit probabilities are used as the association weights between vulnerable nodes to construct a weighted vulnerability knowledge graph. Based on this, vulnerable nodes in the weighted vulnerability knowledge graph are filtered according to the constraint matrix, removing nodes that do not meet the environmental conditions. If the target environment's web server does not have a specific version of the software installed, vulnerability nodes related to that software will be filtered out.

[0037] The vulnerability chain propagates between selected vulnerable nodes based on exploit probability, generating multi-level exploit chains. An exploit chain represents a series of exploitation steps from an initial state to the target state. For example, an exploit chain might be: using CVE-2021-A to gain control of the web server → using CVE-2021-B to escalate to system administrator privileges → using CVE-2021-C to obtain sensitive data. The system generates multiple possible exploit chains, covering different attack paths.

[0038] For each exploit chain, the cumulative probability of exploitation is calculated to obtain the attack success rate. The attack success rate represents the probability of successfully executing the entire attack chain. It is calculated by multiplying the exploit probabilities of each node. For example, the success rate of the above attack chain is 0.7 × 0.9 × 0.8 = 0.504, meaning there is a 50.4% probability of successfully executing the entire attack chain. Finally, the penetration testing path is output based on the attack success rate. The penetration testing path includes information such as the attack path, the attack conditions and impact of each node, the exploitation method, and the success rate. The system can sort multiple penetration testing paths from high to low attack success rate, helping security personnel prioritize high-risk attack paths.

[0039] In practical applications, this method can automatically analyze vulnerability associations in complex network environments and generate potential attack paths. In an enterprise environment containing 50 servers, 15 network zones, and 200 vulnerabilities, this method can analyze 30 possible penetration paths within 10 minutes. The path with the highest success rate is the one that starts with the CVE-2021-D vulnerability in an external web server, ultimately gaining access to the core database through 5 intermediate nodes, with a success rate of 32.4%. This enables security teams to implement targeted vulnerability remediation, prioritizing critical vulnerabilities that constitute high-risk paths, and effectively improving overall security protection capabilities.

[0040] In one alternative implementation, generating an attack view on a 3D interface by mapping the penetration chain according to the logical hierarchy of nodes and attack associations includes: Calculate the in-degree and out-degree values ​​of nodes in the penetration path, determine the vulnerability severity of the nodes based on the in-degree and out-degree values, and map the vulnerability severity to the display size of the nodes; The attack association strength between nodes is calculated based on the in-degree and out-degree values, and the attack association strength is mapped to the curvature of the connected surface. Obtain the logical hierarchy of the nodes, assign nodes that meet the display size to different height planes of the 3D interface according to the logical hierarchy, calculate the interaction force between nodes based on the attack association strength, and generate the spatial coordinates of the nodes based on the interaction force. A spatial path for the connecting surface between nodes is generated based on the spatial coordinates and curvature. The nodes are arranged in spatial coordinates, and the nodes are connected along the spatial path through a connecting surface that conforms to the curvature to generate an attack view of the penetration link.

[0041] In one specific embodiment, the in-degree and out-degree values ​​of each node in the penetration link are first calculated. The in-degree value represents the number of connections pointing to that node, and the out-degree value represents the number of connections originating from that node. For node A, if three other nodes point to it, its in-degree value is 3; if node A points to two other nodes, its out-degree value is 2. These relationships can be extracted by analyzing network log data and attack event records. For each node in the network, a connection table is maintained to record all related inbound and outbound connections.

[0042] The severity of a node's vulnerability is determined based on its in-degree and out-degree values. Specifically, the in-degree value is multiplied by a weighting factor of 0.4, and the out-degree value is multiplied by a weighting factor of 0.6, then summed to obtain the severity value. For node A with an in-degree of 3 and an out-degree of 2, its severity value is 3 × 0.4 + 2 × 0.6 = 2.4. The out-degree value has a higher weight because nodes capable of launching outward attacks typically pose a greater threat. The severity value typically ranges from 0 to 10, with higher values ​​indicating a greater threat.

[0043] When mapping the vulnerability severity of a node to its display size, a non-linear mapping method is used. Nodes with severity values ​​in the range of 0-2 have a size of 10-20 pixels; nodes with severity values ​​in the range of 2-5 have a size of 20-35 pixels; and nodes with severity values ​​in the range of 5-10 have a size of 35-50 pixels. For example, node A has a severity value of 2.4, which falls within the 2-5 range, therefore its display size is 23 pixels.

[0044] The attack correlation strength is calculated based on the in-degree and out-degree values ​​between nodes. The correlation strength is obtained by multiplying the out-degree of the source node by the in-degree of the target node and then dividing by 10. If node A has an out-degree of 2 and node B has an in-degree of 4, then the attack correlation strength from A to B is 2 × 4 ÷ 10 = 0.8. Correlation strength values ​​are typically between 0 and 1; a higher value indicates a stronger attack correlation.

[0045] The attack correlation strength is mapped to the curvature of the connection surface. Connections with correlation strength values ​​in the range of 0-0.3 have a curvature of 15-30 degrees; connections with correlation strength values ​​in the range of 0.3-0.7 have a curvature of 30-60 degrees; and connections with correlation strength values ​​in the range of 0.7-1.0 have a curvature of 60-90 degrees. For example, a correlation strength of 0.8 from A to B results in a curvature of 75 degrees. A greater curvature means a more curved connection surface, visually highlighting the strong correlation.

[0046] Obtain the logical hierarchy of the nodes; this hierarchy information is typically extracted from the network topology. For example, nodes in the Internet zone are Layer 1, nodes in the DMZ zone are Layer 2, intranet servers are Layer 3, and intranet terminals are Layer 4. Nodes that fit the display size are then assigned to different height planes in the 3D interface according to their logical hierarchy. The height value of Layer 1 is 0, the height value of Layer 2 is 100, the height value of Layer 3 is 200, and the height value of Layer 4 is 300. Taking node A as an example, if it belongs to the DMZ zone, then the height value of its plane is 100.

[0047] The interaction force between nodes is calculated based on the attack association strength. The magnitude of the interaction force is directly proportional to the attack association strength; specifically, it is calculated by multiplying the association strength value by 100. For example, if the association strength between node A and node B is 0.8, then the interaction force is 80 units. These interactions determine the relative positions of the nodes within their respective planes.

[0048] The spatial coordinates of nodes are generated based on forces using a force-directed algorithm. Initially, nodes at the same level are randomly distributed within their respective planes. Then, the repulsive and attractive forces between nodes are simulated, and after multiple iterations, the nodes reach equilibrium positions. Nodes with high affinity will move closer to each other, while nodes with low affinity will move further apart. After calculation, the final spatial coordinates of node A are (150, 100, 100), and the final spatial coordinates of node B are (200, 150, 200).

[0049] Based on the spatial coordinates of the nodes and the curvature of the connections, a spatial path for the connecting surfaces between the nodes is generated. The connecting surfaces are implemented using Bézier curves, and the positions of the control points are determined by the coordinates of the starting node, the coordinates of the ending node, and the curvature. Taking the connection between node A and node B as an example, with a curvature of 75 degrees, the calculated coordinates of the control point are (175, 75, 150). The generated Bézier curve starts from point A (150, 100, 100), passes through the control point, and finally reaches point B (200, 150, 200).

[0050] Nodes are arranged on calculated spatial coordinates, and related nodes are connected along a spatial path using connecting surfaces with varying degrees of curvature, generating a complete penetration attack view. In this view, the size of a node reflects the severity of its vulnerability, the curvature of the connecting surfaces reflects the strength of the attack correlation, and the spatial position of the node reflects its logical hierarchy and attack relationship. This 3D visualization method can intuitively display complex attack paths and key threat nodes, helping security analysts quickly identify high-risk areas and develop protection strategies.

[0051] In this embodiment, the severity of a vulnerability is determined by calculating the in-degree and out-degree values ​​of nodes and visualized as node dimensions, enabling attackers to intuitively identify critical vulnerability nodes. The attack correlation strength is calculated and mapped to the curvature of the connecting surfaces, clearly demonstrating the degree of attack correlation between nodes. Nodes are logically assigned to different height planes, and spatial coordinates are calculated based on forces to achieve a three-dimensional layout. Spatial paths of the connecting surfaces are generated based on spatial coordinates and curvature, constructing a complete penetration testing attack view. This solution can present the attack paths in the penetration testing chain in three dimensions, highlighting important vulnerability nodes and attack correlations, helping analysts quickly grasp the attack posture and improving the intuitiveness and understandability of penetration testing analysis.

[0052] like Figure 2 The diagram illustrates the logic flow for calculating the resource consumption of the attack view node in this embodiment.

[0053] In one optional implementation, the target node is located based on the attack view, and a technical penetration chain and a behavioral penetration chain are generated based on the reachability path and resource dependency strength of the target node in the vulnerability knowledge graph. The temporal dependencies of the technical penetration chain and the behavioral penetration chain are calculated to form an execution sequence, including: Calculate the node cost score based on the resource consumption of the nodes in the attack view, and locate the target node based on the node cost score; Extract the reachable path of the target node, calculate the resource state transition cost of adjacent nodes in the path, and generate an attack path that satisfies resource constraints based on the resource state transition cost; The resource dependency intensity is calculated based on the resource request and release amounts of nodes in the reachable path, and the resource acquisition order of the nodes is determined according to the resource dependency intensity. The vulnerability exploitation operations in the reachable path are extracted as technical penetration chains, and the resource acquisition order is extracted as behavioral penetration chains. The state correspondence between the technical penetration chains and behavioral penetration chains is constructed based on the resource consumption values ​​of the nodes. Based on the state correspondence analysis of the node state transition constraints, a temporal dependency matrix is ​​constructed. Based on the temporal dependency matrix analysis technology, the temporal dependency relationship of the penetration chain and behavior penetration chain is analyzed, and an execution sequence is generated according to the temporal dependency relationship.

[0054] In this embodiment, the attack view refers to a graphical model representing the nodes and their relationships in a network system. Each node in the attack view represents a system component, such as a server, application, or specific functional module. Each node has associated resource consumption attributes, including computing resources, storage resources, and network resources. The node cost score is a comprehensive score calculated based on these resource consumption attributes, representing the cost required to attack that node. The node cost score can be obtained by weighted summation of the various resource consumption attributes. For example, for a node with 8 units of computing resources, 5 units of storage resources, and 3 units of network resources, if the weights are 0.5, 0.3, and 0.2 respectively, then the cost score of this node is 8 × 0.5 + 5 × 0.3 + 3 × 0.2 = 6.1. In practical applications, the target node usually refers to a node with a low cost score but high value, which may be an important server or a database containing sensitive data. For example, in an attack view containing 10 nodes, if the cost scores from low to high are 3.5, 4.2, 5.0, 5.8, 6.1, 6.9, 7.3, 7.8, 8.2 and 9.0 respectively, and the node with a cost score of 5.0 is a server storing important data, then that node may be identified as the target node.

[0055] Extracting reachable paths to the target node refers to all possible paths from the attack origin to the target node. In a vulnerability knowledge graph, connections between nodes represent the possibility of an attacker moving from one node to another. The resource state transition cost between adjacent nodes refers to the resource consumption required to move from one node to another. For example, moving from node A to node B might consume 5 units of computing resources and 3 units of network resources, for a total cost of 8 units. Assume there are multiple paths from the attack origin to the target node, such as path 1 passing through nodes A, B, and C with a total resource consumption of 15 units; path 2 passing through nodes D and E with a total resource consumption of 12 units; and path 3 passing through nodes F, G, and H with a total resource consumption of 18 units. Among these three paths, path 2 has the lowest resource state transition cost and is therefore identified as the attack path that satisfies the resource constraints.

[0056] Resource dependency strength is an indicator calculated based on the resource request and release amounts of nodes in a reachable path, reflecting the resource dependencies between nodes. If node A requests 10 units of storage resources, and node B releases 8 units, then node A's resource dependency strength on node B might be 8 / 10 = 0.8. A higher resource dependency strength indicates a stronger resource dependency relationship between nodes. By calculating the resource dependency strength between nodes in a path, the resource acquisition order of nodes can be determined. For example, assuming the path includes nodes P, Q, and R, and node P's resource dependency strength on node Q is 0.7, node P's resource dependency strength on node R is 0.3, and node Q's resource dependency strength on node R is 0.6, then the resource acquisition order might be R→Q→P.

[0057] A technical penetration chain refers to a sequence of vulnerability exploitation operations extracted from a reachable path. A technical penetration chain may include steps such as "port scanning → vulnerability identification → privilege escalation → data theft." A behavioral penetration chain refers to a sequence of behaviors extracted based on the order in which resources are acquired. A behavioral penetration chain may include steps such as "acquiring network resources → acquiring computing resources → acquiring storage resources." The resource consumption values ​​of nodes can be used to construct a state correspondence between the technical and behavioral penetration chains. The "privilege escalation" step in a technical penetration chain may correspond to the "acquiring computing resources" step in a behavioral penetration chain, and requires 5 units of computing resources. Through this state correspondence, the mapping relationship between technical operations and resource acquisition behaviors can be determined.

[0058] State transition constraints refer to the rules that node state changes must follow. A node can only execute a corresponding technical operation after acquiring sufficient resources. Based on state correspondences, a temporal dependency matrix can be constructed. The temporal dependency matrix is ​​a two-dimensional matrix where each element represents the degree of dependency of a row node on a column node. If element M[i][j]=1 in the temporal dependency matrix, it means that node i must execute before node j; if M[i][j]=0, it means that there is no dependency between node i and node j. By analyzing the temporal dependency matrix, the execution order of each node in the technical penetration chain and the behavioral penetration chain can be determined. For example, assuming the technical penetration chain contains steps A, B, and C, and the behavioral penetration chain contains steps X, Y, and Z, and the temporal dependency matrix shows that A depends on X, B depends on Y, and C depends on Z, and X must execute before Y, and Y must execute before Z, then the possible execution sequence is X→A→Y→B→Z→C. In this way, the final execution sequence can be generated based on the temporal dependencies, ensuring the reasonable allocation of resources and the effective execution of technical operations during the attack process.

[0059] By calculating the resource dependency strength between nodes to determine the resource acquisition order, the rationality of resource scheduling is achieved. Vulnerability exploitation operations and resource acquisition order are extracted into technical penetration chains and behavioral penetration chains, respectively, and a state mapping relationship between the two types of penetration chains is established based on resource consumption values. A temporal dependency matrix is ​​constructed by analyzing node state transition constraints to effectively identify the temporal dependencies between technical and behavioral penetration chains. This scheme can generate the optimal execution sequence while ensuring resource constraints are met, improving the accuracy of attack path planning and resource utilization efficiency, and ensuring the continuity and feasibility of the penetration process.

[0060] In one optional implementation, the exploit operations in the reachable path are extracted as a technical penetration chain, and the resource acquisition sequence is extracted as a behavioral penetration chain. The state correspondence between the technical penetration chain and the behavioral penetration chain is constructed based on the resource consumption values ​​of the nodes, including: Extract exploit operations from reachable paths, obtain resource consumption values ​​for exploit operations, construct resource consumption sequences, extract resource utilization features from resource consumption sequences, and construct technology penetration chains based on the resource utilization features. Extract the resource request and release values ​​of nodes in the resource acquisition order, calculate the resource occupation period of the nodes, identify overlapping intervals based on the resource occupation period to calculate the resource competition, and construct a behavior penetration chain by combining the resource competition and resource utilization characteristics. Obtain the resource usage values ​​of nodes in the technology penetration chain and behavior penetration chain, generate a resource state change sequence, and identify the state transition critical point from the resource state change sequence; Based on the state transition critical point, the resource state interval is divided, and based on the resource density distribution of the resource state interval, the state affiliation of the nodes in the technology penetration chain and behavior penetration chain is determined. Based on the state similarity of the calculated nodes according to the state attribution, a state correspondence between the technology penetration chain and the behavior penetration chain is constructed based on the state similarity.

[0061] In this embodiment, exploit operations are first extracted from the reachable path. A reachable path refers to the complete intrusion path from the initial node to the target node, including multiple attack steps and resource acquisition processes. For each exploit operation, its resource consumption values ​​are obtained, such as CPU usage, memory usage, and network bandwidth consumption. Taking a network intrusion as an example, the reachable path contains five exploit operations: MS17-010 exploit, CVE-2019-0708 remote code execution, hash passing attack, privilege escalation, and data theft. The resource consumption values ​​for these operations are: CPU usage 85%, 50%, 30%, 60%, and 70%; memory usage 128MB, 64MB, 32MB, 96MB, and 192MB; and network bandwidth 2.5Mbps, 1.8Mbps, 0.5Mbps, 0.8Mbps, and 3.2Mbps.

[0062] Based on the extracted resource usage values, a resource usage sequence is constructed. For the example above, the resource usage sequence is: [(85%, 128MB, 2.5Mbps), (50%, 64MB, 1.8Mbps), (30%, 32MB, 0.5Mbps), (60%, 96MB, 0.8Mbps), (70%, 192MB, 3.2Mbps)]. Resource utilization characteristics are extracted from this sequence, including resource usage patterns, peak positions, and fluctuation ranges. For the above sequence, the following characteristics can be identified: CPU usage exhibits a "high-medium-low-medium-high" pattern; memory usage shows a "decreasing then increasing" trend; and network bandwidth is relatively high in the initial and final stages. Based on these characteristics, a penetration testing chain is constructed, linking vulnerability exploitation operations according to resource characteristics to form a vulnerability exploitation technology chain.

[0063] Next, we extract the resource request and release values ​​of the nodes in the resource acquisition sequence. In the above attack, the resource acquisition sequence was: acquiring user credentials, acquiring system privileges, accessing the file system, connecting to the database, and transferring data. The resource request values ​​for these nodes were: CPU request 40%, 65%, 25%, 55%, 75%; memory request 64MB, 96MB, 48MB, 128MB, 256MB. The resource release values ​​were: CPU release 15%, 35%, 15%, 20%, 45%; memory release 32MB, 48MB, 32MB, 64MB, 128MB.

[0064] The resource occupancy period of a computing node is the duration from resource request to resource release. Calculated in seconds, the resource occupancy periods for the five nodes are 8 seconds, 12 seconds, 6 seconds, 15 seconds, and 20 seconds, respectively. Based on these resource occupancy periods, overlapping intervals are identified, and resource contention is calculated. For example, the resource occupancy periods of nodes 1 and 2 overlap by 4 seconds. During this period, the CPU contention is (40% + 65% - 100%) × 4 = 20%, and the memory contention is (64MB + 96MB - 256MB) × 4 = 0 (not exceeding the total system resources, contention is 0). By combining the resource contention among all nodes with the aforementioned resource utilization characteristics, a behavioral penetration chain is constructed.

[0065] Resource usage values ​​for nodes in the technology penetration chain and the behavior penetration chain are obtained, generating resource state change sequences. The resource state change sequence for the technology penetration chain is: (85%, 128MB) → (50%, 64MB) → (30%, 32MB) → (60%, 96MB) → (70%, 192MB). The resource state change sequence for the behavior penetration chain is: (25%, 32MB) → (30%, 48MB) → (10%, 16MB) → (35%, 64MB) → (30%, 128MB). State transition critical points, i.e., points where resource usage changes significantly, are identified from these sequences. In the technology penetration chain, CPU usage shows a significant decrease between the second and third nodes and a significant increase between the third and fourth nodes, respectively, while memory usage shows a significant increase between the fourth and fifth nodes. These points can be identified as state transition critical points.

[0066] Resource states are divided into intervals based on state transition thresholds. For example, resource states can be categorized as: low load (CPU < 40%, memory < 64MB), medium load (40% ≤ CPU < 65%, 64MB ≤ memory < 128MB), and high load (CPU ≥ 65%, memory ≥ 128MB). Based on the resource density distribution within these intervals, the state affiliation of nodes in the technology penetration chain and behavioral penetration chain is determined.

[0067] In the technology penetration chain, nodes 1 and 5 are under high load, nodes 2 and 4 are under medium load, and node 3 is under low load. In the behavior penetration chain, nodes 1 and 3 are under low load, nodes 2 and 4 are under medium load, and node 5 is under high load.

[0068] State similarity is calculated based on the state affiliation of nodes. State similarity can be calculated by comparing the consistency of node state affiliation across different resource dimensions. For example, node 1 in the technical penetration chain matches node 5 in the behavioral penetration chain under high load conditions, with a similarity of 0.8; node 3 in the technical penetration chain matches node 1 in the behavioral penetration chain under low load conditions, with a similarity of 0.9. Based on the state similarity between all node pairs, the state correspondence between the technical penetration chain and the behavioral penetration chain is constructed, forming a complete penetration chain mapping graph, enabling accurate identification and analysis of attack behaviors.

[0069] In this embodiment, a technical penetration chain is constructed by extracting resource consumption values ​​and resource utilization characteristics of vulnerability exploitation operations, achieving a precise characterization of the vulnerability exploitation process; a behavioral penetration chain is constructed by calculating node resource consumption cycles and resource contention levels, effectively identifying resource contention conflicts; state transition critical points are identified based on resource state change sequences, achieving precise division of resource state intervals; node state affiliation is determined by analyzing resource density distribution, and state similarity is calculated to construct the state correspondence between the two types of penetration chains. This scheme can accurately describe the resource utilization characteristics of technical and behavioral penetration chains, effectively identify resource contention and state transition relationships, improve the accuracy and rationality of resource scheduling during the penetration process, and reduce resource contention risks.

[0070] In one optional implementation, vulnerability features are extracted from the execution sequence; attack instructions are generated for known exploits of script vulnerabilities; attack code is generated by reasoning about unknown exploits of script vulnerabilities; and a protection strategy is output, including: The operation execution order is obtained from the execution sequence, and the repeated sequences in the operation execution order are extracted. Vulnerability features are extracted based on the frequency and temporal position of the repeated sequences. Obtain control flow and data flow features from known exploit scripts, combine the control flow features, data flow features and vulnerability features to construct a feature template, perform feature matching on known exploit scripts based on the feature template, and generate attack instructions based on the feature matching results; Obtain an unknown execution sequence that exploits a script vulnerability, calculate the structural and behavioral similarities between the execution sequence and a feature template, extract matching features based on the structural and behavioral similarities, mutate and recombine the matching features, and infer and generate attack code. Extract the execution path from the attack instructions and attack code, identify the operation points in the execution path, and generate a protection strategy based on the operation points and vulnerability characteristics.

[0071] In this embodiment, when obtaining the operation execution order from the execution sequence and extracting the repeating sequence from the operation execution order, the system call sequence during program execution is collected. For example, in a Linux environment, the strace tool is used to record the program's system call sequence, including operations such as open, read, write, and socket. The collected system call sequences are analyzed using a sliding window method, with the window size set between 3 and 10. Each system call subsequence within the window is hashed to generate a sequence fingerprint. The occurrence frequency and position information of each hash fingerprint are recorded to construct a frequency table. When the frequency of a subsequence exceeds a preset threshold T (e.g., its proportion in the total sequence exceeds 0.05), it is marked as a repeating sequence.

[0072] When extracting vulnerability features based on the frequency and temporal position of repeating sequences, the distribution characteristics of repeating sequences within the overall execution flow are analyzed. For each repeating sequence R, its temporal distribution feature D is calculated, including the proportion of the sequence's first occurrence position to the total sequence length, the variance of the time interval between sequence occurrences, and the relative positional relationship between the sequence and critical system calls (such as execve and connect). Simultaneously, the transformation relationships between repeating sequences are analyzed, constructing a sequence transition graph where nodes represent repeating sequences and edges represent the probability that one sequence is executed immediately followed by another. This method can identify unique calling patterns during vulnerability exploitation. For example, when analyzing SQL injection vulnerabilities, an unusual pattern might be found where database connection operations are followed by a large number of table structure query operations.

[0073] When acquiring control flow and data flow characteristics from known exploit scripts, static analysis is performed on the script code to construct a control flow graph. For a Java deserialization vulnerability exploit script, control flow characteristics might include the number of conditional branches, loop structure characteristics, and the distribution of exception handling blocks. For example, it might extract features such as two main functional blocks, three conditional branch points, and one exception handling structure. For data flow characteristics, the definition and usage of variables are traced to identify the transmission paths of critical data. For example, when analyzing an XSS attack script, it might identify the data flow path where user input data is Base64 encoded and then appended to a DOM manipulation function. These characteristics are represented as a structured description.

[0074] When constructing a feature template by combining control flow features, data flow features, and vulnerability features, the extracted features are integrated into a unified feature vector. For each known vulnerability type, a feature template T={<CF1,DF1,VF1> ,<CF2,DF2,VF2> , ...}, where CF represents the control flow feature set, DF represents the data flow feature set, and VF represents the vulnerability feature set. For example, for a command injection vulnerability, the feature template might include: a system call sequence containing a string concatenation followed immediately by an execve call; a control flow containing features where input validation points are bypassed; and a data flow containing a path where user input flows directly to the command execution function.

[0075] Based on feature templates, known exploit scripts are matched for features. When generating attack commands based on the feature matching results, the similarity between the script to be analyzed and each template in the template library is calculated. The similarity calculation is based on a weighted matching degree of the feature dimension, and the weights are dynamically adjusted according to the discriminative power of the features. When the similarity exceeds a threshold (e.g., 0.85), the script is determined to have exploited the corresponding vulnerability. For example, for a script that matches a template with a remote code execution vulnerability, the system extracts the key attack path from the template and generates attack commands.

[0076] When acquiring the execution sequence of an unknown exploit script vulnerability and calculating its structural and behavioral similarity to a signature template, the unknown script is first run to collect the execution sequence. Structural similarity is calculated based on the sequence's morphological features, such as length distribution and key node positions; behavioral similarity is based on functional-level matching, such as resource access patterns and privileged operation sequences. For example, it might be discovered that while the execution sequence of an unknown script differs structurally from a known RCE exploit script, both contain the characteristic of creating a reverse shell connection.

[0077] The system extracts matching features based on structural and behavioral similarity, performs mutation and recombination on these features, and extracts key feature fragments from the most similar templates when generating attack code. Combination rules between features are determined based on contextual relevance analysis. A genetic algorithm is applied to recombine and mutate the features, generating a set of candidate attack code. The effectiveness of each candidate code is verified in a sandbox environment, and the code with the highest success rate is selected as the final attack code. For a suspected novel file inclusion vulnerability, attack code testing different path traversal methods may be generated based on a known LFI vulnerability template.

[0078] The system extracts execution paths from attack instructions and code, identifies operation points within those paths, analyzes the generated attack instructions and code, and extracts their complete execution paths. The system identifies key operation points O={ in the execution path.<op_i,type_i,impact_i>} where type represents the type of operation (such as file access or network connection), and impact represents the degree of impact. For example, when analyzing the execution path of a WebShell upload attack, the file write operation point and the subsequent script execution operation point may be identified as key points.

[0079] When generating protection strategies based on operation points and vulnerability characteristics, corresponding protection rules are generated for each critical operation point, taking into account the vulnerability characteristics. These protection rules may include various types such as enhanced input validation, permission restrictions, and resource access control. For detected SQL injection vulnerabilities, multi-layered protection strategies may be generated, including parameterized query transformation, adding privilege checks before sensitive operations, and real-time monitoring of abnormal SQL patterns. The protection strategies are output in the form of configuration rules or code patches, and can be directly applied to the target system.

[0080] This implementation method achieves accurate identification of cybersecurity threats by intelligently extracting vulnerability features from execution sequences, significantly reducing false positive and false negative rates. Attack instructions generated from known vulnerabilities and attack code generated through inference from unknown vulnerabilities greatly improve the efficiency and coverage of penetration testing, making security assessments more comprehensive and in-depth. Multi-layered protection strategies generated based on attack path analysis form a closed-loop security defense system, capable of blocking the attack chain even if single-point protection fails. This method overcomes the limitations of traditional signature databases, adapting to constantly evolving cyberattack methods and enabling continuous evolution of security protection capabilities. The system's inference ability for unknown vulnerabilities significantly improves the discovery and verification of zero-day vulnerabilities, shortening the time window from vulnerability discovery to protection deployment. Overall, this method enhances the initiative and foresight of cybersecurity protection, providing more reliable security guarantees for critical information infrastructure.

[0081] As an optional implementation, network topology data and host port data are first collected. The network device MIB database is read via the SNMP protocol to obtain network device types, node connectivity relationships, and network segmentation rules. Simultaneously, Echo Request messages are sent and Echo Reply messages are received using the ICMP protocol to detect live hosts and open ports. The data matching accuracy is quantified using a topology-port correlation formula; when the correlation exceeds 0.75, the collected data is considered to meet the requirements. Subsequently, vulnerability scanning is performed using a dual-engine approach with Nuclei and OpenVAS. The Nuclei engine focuses on rapid scanning for web application vulnerabilities and lightweight port service vulnerabilities, while the OpenVAS engine focuses on in-depth detection of system-level vulnerabilities. Scan results are categorized as "vulnerabilities with POC scripts" and "vulnerabilities without POC scripts," and the IP address of the vulnerable node, the corresponding port, and the severity level are recorded.

[0082] A multi-dimensional vulnerability knowledge graph is constructed based on the scan results. The knowledge graph covers four dimensions: vulnerability attributes, node associations, attack techniques, and pre- and post-exploitation relationships. A dual mechanism of "predefined rule base + dynamic optimization using AI-trained models" is employed to construct the pre- and post-exploitation relationships of vulnerabilities. The association weight calculation comprehensively considers historical success rate and condition similarity. When a user clicks on a target node, a penetration chain feasibility score is calculated using a penetration chain inference algorithm, generating five types of penetration chains: information probing, intrusion penetration, virus attack, remote control, and service disruption. The algorithm also indicates whether the vulnerability used contains a Proof-of-Concept (POC) script and its pre- and post-exploitation dependencies.

[0083] The system displays network topology and vulnerability information in a 3D visualization interface. A grid matrix layout is used, with 3D coordinate calculations ensuring uniform spatial distribution of nodes. Automatic aggregation is supported when the number of nodes within the same network segment exceeds 10. Aggregated nodes use a cylindrical model, with the radius dynamically calculated based on the number of child nodes. Based on knowledge graph data, multiple technical attack paths are generated using AI attack path planning. The multi-path planning algorithm considers four factors: penetration rate type weight, vulnerability severity coefficient, path length reciprocal, and the completeness of pre- and post-vulnerability correlations, calculating the feasibility score for each path. Simultaneously, the social engineering attack link generation submodule generates adapted social engineering links based on the matching degree between node role information and attack patterns, forming a dual-dimensional path system combining "technical" and "human" approaches.

[0084] Extract vulnerability features from execution sequences. Use a sliding window technique to identify operation subsequences, marking subsequences with a frequency exceeding a preset threshold as potential vulnerability features. For known script exploits, extract control flow features (conditional branches, loop structures, and function call relationships) and data flow features (variable definitions, usage, and propagation paths), and combine these features with vulnerability features to construct a feature template library. Match the vulnerability features extracted from the target environment with the template library, calculate similarity scores, and generate targeted attack instructions. For unknown script exploits, calculate the structural and behavioral similarities between the execution sequence and the feature templates, extract matching features, and then perform mutations (parameter replacement, operation sequence adjustment, and condition modification) and recombination to infer and generate attack code.

[0085] Finally, attack execution plans and protection strategies are generated. For vulnerabilities with Proof-of-Concept (POC) scripts, an exploitation plan including the script call path and execution parameters is generated. Attack chain tips are also provided, covering the vulnerability's pre- and post-dependencies, core principles, and execution precautions. The system analyzes the execution path in the attack commands and attack code, identifying key operation points such as input points, processing points, and output points, and generating multi-layered protection strategies, including input validation rules, runtime protection rules, and response processing rules, forming an "attack-defense" closed-loop system.

[0086] A second aspect of this invention provides a network penetration and planning system based on artificial intelligence, the system comprising: The first unit is used to collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information. The second unit is used to construct a vulnerability knowledge graph based on the attack conditions and affected areas in the vulnerability information, calculate the exploitation probability between vulnerability nodes in the vulnerability knowledge graph, generate multi-level vulnerability exploitation chains, and output the penetration link based on the attack success rate of the vulnerability exploitation chains. The third unit is used to generate an attack view in a three-dimensional interface by dividing the penetration link into logical levels of nodes and attack associations. The fourth unit is used to locate target nodes based on the attack view, generate technical penetration chains and behavioral penetration chains based on the reachability paths and resource dependency strength of the target nodes in the vulnerability knowledge graph, and calculate the temporal dependencies of the technical penetration chains and behavioral penetration chains to form an execution sequence. The fifth unit is used to extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies.

[0087] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0088] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0089] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network penetration and planning method based on artificial intelligence, characterized in that, include: Collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information; Based on the attack conditions and affected areas in the vulnerability information, a vulnerability knowledge graph is constructed, the exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, a multi-level vulnerability exploitation chain is generated, and the penetration path is output based on the attack success rate of the vulnerability exploitation chain. The penetration chain is generated into an attack view in a 3D interface according to the logical hierarchy of the nodes and the attack associations. The target node is located based on the attack view. Based on the reachable path and resource dependency strength of the target node in the vulnerability knowledge graph, a technical penetration chain and a behavioral penetration chain are generated. The temporal dependency relationship of the technical penetration chain and the behavioral penetration chain is calculated to form an execution sequence. Extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies. Based on the attack view, the target node is located. A technical penetration chain and a behavioral penetration chain are generated based on the reachability path and resource dependency strength of the target node in the vulnerability knowledge graph. The temporal dependencies of the technical penetration chain and the behavioral penetration chain are calculated to form an execution sequence, including: Calculate the node cost score based on the resource consumption of the nodes in the attack view, and locate the target node based on the node cost score; Extract the reachable path of the target node, calculate the resource state transition cost of adjacent nodes in the path, and generate an attack path that satisfies resource constraints based on the resource state transition cost; The resource dependency intensity is calculated based on the resource request and release amounts of nodes in the reachable path, and the resource acquisition order of the nodes is determined according to the resource dependency intensity. The vulnerability exploitation operations in the reachable path are extracted as technical penetration chains, and the resource acquisition order is extracted as behavioral penetration chains. The state correspondence between the technical penetration chains and behavioral penetration chains is constructed based on the resource consumption values ​​of the nodes. Based on the state correspondence analysis of the node state transition constraints, a temporal dependency matrix is ​​constructed. Based on the temporal dependency matrix analysis technology, the temporal dependency relationship of the penetration chain and behavior penetration chain is analyzed, and an execution sequence is generated according to the temporal dependency relationship.

2. The method according to claim 1, characterized in that, The system collects network topology data and host port data, performs vulnerability scanning to obtain vulnerability information, and identifies known and unknown exploit script vulnerabilities within the vulnerability information, including: Collect TCP session traffic, and construct network connection data from the communication addresses and port numbers in the TCP session traffic; Analyze the communication characteristics of nodes in network connection data to generate node behavior data, cluster the node behavior data based on similarity to obtain node groups, and generate network topology data based on the data transmission relationship within the node groups. Extract data packets between nodes from network topology data, parse the payload content of the data packets to obtain host port data, and identify vulnerability information based on the service response identifier of the host port data; Parse the attack code in the vulnerability information, extract the execution operations in the attack code to obtain the exploit chain sequence, and generate a vulnerability fingerprint based on the exploit chain sequence. Based on vulnerability fingerprint analysis, the execution steps of the attack code in the vulnerability information are extracted. The execution steps are then matched with preset exploitation patterns. When a match is successful, it is determined to be a known exploit script vulnerability; when a match fails, it is determined to be an unknown exploit script vulnerability.

3. The method according to claim 1, characterized in that, Based on the attack conditions and affected areas in the vulnerability information, a vulnerability knowledge graph is constructed. The exploitation probability between vulnerability nodes in the vulnerability knowledge graph is calculated, generating a multi-level vulnerability exploitation chain. Based on the attack success rate of the vulnerability exploitation chain, the penetration chain is output, including: The attack conditions and affected areas in the vulnerability information are obtained, and the resource dependencies of the attack conditions and affected areas in the target environment are analyzed to obtain a constraint matrix. An initial vulnerability knowledge graph is constructed based on the dependency relationship of the constraint matrix. The reachability states of adjacent vulnerability nodes are analyzed in the initial vulnerability knowledge graph. Environmental constraints are obtained based on the matching relationship between the reachability states and the constraint matrix. The exploitation probability between vulnerability nodes is calculated based on the environmental constraints. A weighted vulnerability knowledge graph is constructed by using the exploit probability as the association weight between vulnerability nodes. Vulnerability nodes in the weighted vulnerability knowledge graph are filtered according to the constraint matrix. Based on the exploit probability, a multi-level vulnerability exploit chain is generated by propagating between the filtered vulnerability nodes. The attack success rate is obtained by calculating the cumulative probability of exploitation of the vulnerability exploitation chain, and the penetration chain is output based on the attack success rate.

4. The method according to claim 1, characterized in that, The penetration testing process generates an attack view in a 3D interface based on the logical hierarchy of nodes and attack associations, including: Calculate the in-degree and out-degree values ​​of nodes in the penetration path, determine the vulnerability severity of the nodes based on the in-degree and out-degree values, and map the vulnerability severity to the display size of the nodes; The attack association strength between nodes is calculated based on the in-degree and out-degree values, and the attack association strength is mapped to the curvature of the connected surface. Obtain the logical hierarchy of the nodes, assign nodes that meet the display size to different height planes of the 3D interface according to the logical hierarchy, calculate the interaction force between nodes based on the attack association strength, and generate the spatial coordinates of the nodes based on the interaction force. A spatial path for the connecting surface between nodes is generated based on the spatial coordinates and curvature. The nodes are arranged in spatial coordinates, and the nodes are connected along the spatial path through a connecting surface that conforms to the curvature to generate an attack view of the penetration link.

5. The method according to claim 1, characterized in that, The exploit operations in the reachable path are extracted as a technical penetration chain, and the resource acquisition sequence is extracted as a behavioral penetration chain. The state correspondence between the technical penetration chain and the behavioral penetration chain is constructed based on the resource consumption values ​​of the nodes, including: Extract exploit operations from reachable paths, obtain resource consumption values ​​for exploit operations, construct resource consumption sequences, extract resource utilization features from resource consumption sequences, and construct technology penetration chains based on the resource utilization features. Extract the resource request and release values ​​of nodes in the resource acquisition order, calculate the resource occupation period of the nodes, identify overlapping intervals based on the resource occupation period to calculate the resource competition, and construct a behavior penetration chain by combining the resource competition and resource utilization characteristics. Obtain the resource usage values ​​of nodes in the technology penetration chain and behavior penetration chain, generate a resource state change sequence, and identify the state transition critical point from the resource state change sequence; Based on the state transition critical point, the resource state interval is divided, and based on the resource density distribution of the resource state interval, the state affiliation of the nodes in the technology penetration chain and behavior penetration chain is determined. Based on the state similarity of the calculated nodes according to the state attribution, a state correspondence between the technology penetration chain and the behavior penetration chain is constructed based on the state similarity.

6. The method according to claim 1, characterized in that, Extract vulnerability features from the execution sequence, generate attack instructions for known script vulnerabilities, infer attack code for unknown script vulnerabilities, and output protection strategies including: The operation execution order is obtained from the execution sequence, and the repeated sequences in the operation execution order are extracted. Vulnerability features are extracted based on the frequency and temporal position of the repeated sequences. Obtain control flow and data flow features from known exploit scripts, combine the control flow features, data flow features and vulnerability features to construct a feature template, perform feature matching on known exploit scripts based on the feature template, and generate attack instructions based on the feature matching results; Obtain an unknown execution sequence that exploits a script vulnerability, calculate the structural and behavioral similarities between the execution sequence and a feature template, extract matching features based on the structural and behavioral similarities, mutate and recombine the matching features, and infer and generate attack code. Extract the execution path from the attack instructions and attack code, identify the operation points in the execution path, and generate a protection strategy based on the operation points and vulnerability characteristics.

7. An artificial intelligence-based network penetration and planning system, used to implement the method of any one of claims 1-6, characterized in that, include: The first unit is used to collect network topology data and host port data, perform vulnerability scanning to obtain vulnerability information, and identify known and unknown exploit script vulnerabilities in the vulnerability information. The second unit is used to construct a vulnerability knowledge graph based on the attack conditions and affected areas in the vulnerability information, calculate the exploitation probability between vulnerability nodes in the vulnerability knowledge graph, generate multi-level vulnerability exploitation chains, and output the penetration link based on the attack success rate of the vulnerability exploitation chains. The third unit is used to generate an attack view in a three-dimensional interface by dividing the penetration link into logical levels of nodes and attack associations. The fourth unit is used to locate target nodes based on the attack view, generate technical penetration chains and behavioral penetration chains based on the reachability paths and resource dependency strength of the target nodes in the vulnerability knowledge graph, and calculate the temporal dependencies of the technical penetration chains and behavioral penetration chains to form an execution sequence. The fifth unit is used to extract vulnerability features from the execution sequence, generate attack instructions for known exploit script vulnerabilities, infer attack code for unknown exploit script vulnerabilities, and output protection strategies.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images