Automatic penetration test closed-loop method and device based on intelligent reasoning and safety knowledge system

Abstract

The invention discloses an automatic penetration test closed-loop method and device based on an intelligent reasoning and safety knowledge system. The method comprises the following steps: acquiring multi-source original data, and performing analysis and standardization processing; retrieving attack knowledge and a tool use guide related to the current task from the security knowledge base, and generating structured knowledge data; an intelligent reasoning engine is driven by LLM to fuse feature information and structured knowledge data in the context of the current task, a penetration test task tree PTT of a hierarchical structure according to tactics, technologies and sub-technologies is generated, a penetration tool is selected, an executable instruction is generated, and a penetration action is executed; the execution result is analyzed, key information is extracted, the task context is updated, and a new round of task planning and knowledge retrieval are triggered; and performing real-time risk monitoring and compliance control on the task execution process, and generating an audit log and a penetration test report. According to the method, redundant operations and repeated attempts are remarkably reduced, and the hit rate of the permeation path and the overall execution efficiency are improved.

Description

Technical Field

[0001] This invention belongs to the technical field of penetration testing, specifically relating to an automated penetration testing closed-loop method and apparatus based on intelligent reasoning and a security knowledge system. Background Technology

[0002] With the continuous evolution and increasing complexity of cyberattack techniques, penetration testing has become an indispensable part of information system security protection. By simulating the behavior of real attackers, it effectively uncovers potential security vulnerabilities, verifies the effectiveness of protection systems, and provides crucial evidence for security hardening. However, current mainstream penetration testing practices (whether manual or semi-automated) generally face multiple limitations in efficiency, coverage, and flexibility. Traditional penetration testing mainly relies on manual processes for information gathering, vulnerability detection, exploit verification, privilege escalation, and lateral movement. While manual methods have certain advantages in strategy adjustment and flexibility, they are characterized by long testing cycles, high resource consumption, and results that are highly dependent on the experience and skill level of the testers. The lack of standardized processes and repeatability makes it difficult to respond efficiently to frequent and large-scale assessment needs.

[0003] To improve efficiency, the industry has gradually introduced automated penetration testing methods. These methods connect information gathering, vulnerability scanning, and exploitation attempts through scripted task orchestration, and automatically execute them using pre-built tools. However, existing automation solutions mostly adopt fixed processes or static strategies, making it difficult to dynamically adjust the test path based on real-time feedback. This often results in redundant operations or missed opportunities at critical stages, thus affecting test effectiveness and resource utilization.

[0004] On the other hand, the various tools commonly used in penetration testing (such as Nmap, Nessus, SQLMap, Metasploit, etc.) have different output formats and varying information granularities, lacking a unified structured processing mechanism. Testers or automated scripts often need to parse the output separately for different tools, which not only increases integration complexity but also easily leads to the loss of critical information during information transmission, such as port details, service versions, CVE numbers, authentication information, and critical paths. This can affect the accuracy of subsequent attack path planning and even lead to incorrect decisions.

[0005] In recent years, Large-Scale Language Models (LLMs), with their superior natural language understanding and reasoning capabilities, have provided new ideas for the intelligent development of penetration testing. Some research and open-source projects have begun to explore using LLM parsing tools to output and generate attack suggestions, advancing the testing process through multiple rounds of interaction. However, these LLM-based auxiliary solutions still have significant limitations: they lack a closed-loop mechanism from execution feedback to task planning, making continuous optimization and dynamic adjustment impossible; the generated penetration plans often lack fine-grained descriptions and fail to systematically integrate security knowledge systems such as MITREATT&CK, resulting in weak global path planning capabilities and a tendency for duplicate tasks or path misjudgments; at the same time, existing solutions are mostly limited to a few tools, lacking scalable tool scheduling and multi-dimensional selection capabilities, making it difficult to cover the diverse needs of different protocols, services, and attack phases; furthermore, the task planning process often fails to fully incorporate structured knowledge bases such as ATT&CK, CWE, and OWASP, resulting in a lack of professional depth and relevance in the output.

[0006] In summary, whether it is traditional manual testing, script automation, or LLM-based auxiliary methods, common problems still exist when dealing with complex network environments, large-scale assets, and dynamic threats: fragmented information processing, lack of unified parsing and integration mechanisms; linear and rigid testing processes, making it difficult to adjust dynamically; insufficient knowledge utilization, failing to systematically integrate domain knowledge to improve decision-making quality; and coarse-grained execution control, lacking fine-grained risk management and auditing capabilities.

[0007] Therefore, there is an urgent need to build a new penetration testing methodology that integrates information gathering, knowledge enhancement, task planning, tool scheduling, result feedback, and risk control into a closed-loop system that continuously optimizes the entire process from input to execution and feedback. This architecture needs to support multi-mode operation (such as fully automated, semi-automated, and read-only drills) and possess scalability, interpretability, and traceability to meet the current high-frequency, complex, and diverse penetration testing needs. Summary of the Invention

[0008] The main objective of this invention is to overcome the shortcomings and deficiencies of existing technologies and provide an automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system. This invention significantly improves the efficiency, coverage, accuracy, and security of penetration testing through closed-loop feedback-driven dynamic optimization, knowledge system-enhanced global planning, highly adaptable execution with unified tool management, contextual updates for standardized result processing, and fully controllable risk governance. It solves the core problems of rigid processes, information loss, low tool adaptability, lack of global optimization, and controllability in existing technologies.

[0009] To achieve the above objectives, the present invention adopts the following technical solution:

[0010] In a first aspect, the present invention provides an automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system, comprising the following steps:

[0011] Acquire raw data from multiple sources, perform parsing and standardization processing, and construct a unified asset data model and network topology.

[0012] Based on the feature information in the current task context, attack knowledge and tool usage guidelines related to the current task are retrieved from the security knowledge base to generate structured knowledge data; the security knowledge base at least includes tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and usage instructions and parameter templates for penetration testing tools.

[0013] This system leverages an intelligent inference engine to fuse feature information and structured knowledge data from the current task context. Specifically, it utilizes a Large Language Model (LLM) and employs Retrieval Enhancement Generation (RAG) technology to integrate feature information and structured knowledge data from the current task context. Furthermore, it incorporates successful historical penetration testing cases for enhanced inference, generating a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes, connecting them to form a complete attack chain. Leaf node tasks are selected and instantiated based on ATT&CK sub-techniques and atomic attack operations. Combining real-time network topology, node preconditions, dependencies, execution status, and available tool sets, it generates optimal attack paths for real-world scenarios. A multi-dimensional priority evaluation mechanism dynamically scores and sorts task nodes, further optimizing the execution order and improving the penetration testing success rate.

[0014] Based on the node requirements of the task tree, LLM calls the MCP server to register penetration testing tools in the resource library, selects penetration testing tools, generates executable instructions, and automatically executes penetration actions.

[0015] The execution results are analyzed, key information is extracted and the task context is updated to form a network environment snapshot, triggering a new round of task planning and knowledge retrieval;

[0016] Perform real-time risk monitoring and compliance control on the task execution process, and generate audit logs and penetration test reports.

[0017] As a preferred technical solution, the acquisition of multi-source raw data and its parsing and standardization processing includes:

[0018] It receives information from multiple data sources, including active scanners, passive detection devices, intranet topology discovery tools, asset management platforms, and historical penetration records.

[0019] Using a parser corresponding to the data format, raw data in XML, JSON, or plain text format is mapped to a predefined unified asset data model, which includes fields such as IP address, MAC address, open port, running service, version information, vulnerability number, and account information.

[0020] Utilize graph databases to construct multi-layered network topologies, including network, host, and account relationship layers;

[0021] The confidence-weighted method is used to deduplicate and resolve conflicts in multi-source information, and topology pruning is performed based on reachability analysis to retain subgraphs related to the target asset.

[0022] As a preferred technical solution, the step of retrieving attack knowledge and tool usage guidelines related to the current task from the security knowledge base includes:

[0023] Based on the Large Language Model (LLM) and Retrieval Enhancement Generation (RAG) technology, at least one feature information from the target service type, port number, vulnerability number, and operating system version is extracted from the current task context, and historical successful penetration test cases are introduced to enhance the retrieval context.

[0024] A hybrid retrieval strategy is adopted, which integrates keyword matching and vector semantic similarity calculation, and searches are performed from a security knowledge base that integrates ATT&CK tactics, techniques, sub-techniques and atomic attack operations.

[0025] The search results are weighted and ranked according to TTP matching degree, ATT&CK tactical chain relevance, data source credibility, and information timeliness, and then converted into structured knowledge data containing exploitation conditions, attack methods, recommended tools, and execution precautions to generate the penetration testing task tree PTT node.

[0026] As a preferred technical solution, the multi-dimensional priority evaluation mechanism is specifically as follows:

[0027] A multi-dimensional priority evaluation model is adopted, which scores and ranks task nodes by weighted calculation of vulnerability severity CVSS score, target reachability based on network topology analysis, expected privilege escalation benefits, execution time and resource consumption costs, and risk level of triggering defense system.

[0028] As a preferred technical solution, the step of selecting penetration testing tools from the tool resource library and generating executable instructions includes:

[0029] Based on the TTP tags and prerequisites of the current PTT node, candidate tools are selected from the registered penetration testing tool library through the MCP server. The tool resource library records the applicable protocol, service type, supported TTP tags, parameter template, output format, execution cost and risk tags for each tool.

[0030] Candidate tools are prioritized based on at least one of the following metrics: compatibility between the target service version and the tool, historical success rate, and execution cost.

[0031] The parameter template of the selected tool is combined with the context information in the target IP, port, and credentials to generate standardized command-line execution instructions or API call instructions.

[0032] As a preferred technical solution, the step of parsing the execution results, extracting key information, updating the task context, and triggering a new round of task planning and knowledge retrieval specifically involves:

[0033] The raw output of the tool execution is parsed in a structured manner to extract key information from newly added ports, services, vulnerabilities, paths, and credentials;

[0034] The difference analysis method is used to compare the results of multiple executions with the existing task context, mark new information and remove duplicate data;

[0035] The updated task context is fed back to the knowledge retrieval and task planning steps to trigger a new round of knowledge enhancement and path optimization.

[0036] As a preferred technical solution, the real-time risk monitoring and compliance control of the task execution process includes:

[0037] The task to be executed is checked based on the compliance policies in the preset blacklists, whitelists, geographical restrictions and time window constraints;

[0038] For denial-of-service attacks or large-scale brute-force attacks identified as high-risk, a manual approval mechanism is triggered.

[0039] Real-time monitoring of execution rate, resource consumption, and network behavior anomalies, and automatic alerts and termination of related tasks when anomalies are detected;

[0040] Record audit logs for the entire process and automatically generate penetration test reports containing execution steps, success rates, and key evidence based on the task execution trajectory.

[0041] Secondly, the present invention provides an automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system, which is applied to the aforementioned automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system, including an information collection and modeling module, a knowledge enhancement module, a task planning and PTT tree generation module, a tool management and execution module, a result feedback and optimization module, and a control and governance module.

[0042] The information acquisition and modeling module is used to acquire multi-source raw data and perform parsing and standardization processing to construct a unified asset data model and network topology.

[0043] The knowledge enhancement module is used to retrieve attack knowledge and tool usage guidelines related to the current task from the security knowledge base based on feature information in the current task context, and generate structured knowledge data; the security knowledge base includes at least tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and instructions and parameter templates for penetration testing tools.

[0044] The task planning and PTT tree generation module utilizes an intelligent inference engine to fuse feature information and structured knowledge data from the current task context. Specifically, it employs a Large Language Model (LLM) and leverages Retrieval Enhancement Generation (RAG) technology to fuse feature information and structured knowledge data from the current task context. It also incorporates successful historical penetration testing cases for enhanced inference, generating a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes, connecting them to form a complete attack chain. Leaf node tasks are selected and instantiated based on ATT&CK sub-techniques and atomic attack operations. Combining real-time network topology, node preconditions, dependencies, execution status, and available tool sets, it generates the optimal attack path for real-world application. A multi-dimensional priority evaluation mechanism dynamically scores and sorts task nodes, further optimizing the execution order and improving the penetration testing success rate.

[0045] The tool management and execution module is used to select penetration tools from the tool resource library and generate executable instructions to perform penetration actions according to the node requirements of the task tree;

[0046] The result feedback and optimization module is used to parse the execution results, extract key information and update the task context, triggering a new round of task planning and knowledge retrieval.

[0047] The control and governance module is used to perform real-time risk monitoring and compliance control during the task execution process, and to generate audit logs and penetration test reports.

[0048] Thirdly, the present invention provides an electronic device, the electronic device comprising:

[0049] At least one processor; and,

[0050] A memory communicatively connected to the at least one processor; wherein,

[0051] The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to execute the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system.

[0052] Fourthly, the present invention provides a computer-readable storage medium storing a program, characterized in that, when the program is executed by a processor, it implements the aforementioned automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system.

[0053] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0054] (1) This invention adopts a closed-loop architecture that integrates six functional modules: information collection and modeling, knowledge enhancement, task planning and PTT tree generation, tool management and execution, result feedback and optimization, and control and governance. Seamless collaboration is achieved through standardized data and control flows. Unlike existing linear or unidirectional processes, this closed-loop architecture automatically feeds back feedback information after task execution, driving the planning module to update task paths and tool selections in real time, thus achieving adaptive dynamic optimization. This closed-loop feedback mechanism significantly reduces redundant operations and repeated attempts, improving the penetration path hit rate and overall execution efficiency.

[0055] (2) This invention introduces a security knowledge system and a multi-dimensional priority evaluation model at the task planning level. It uses authoritative knowledge bases such as MITREATT&CK, CWE, and OWASP to generate a hierarchical PTT task tree in combination with the task context, and ranks each node based on a comprehensive score based on vulnerability severity, target attainability, execution cost, expected benefits, and risk level. This dynamic planning from a global perspective not only reduces path illusion and inefficient tasks, but also ensures that critical attack chains are executed first, thereby improving test coverage and the predictability of results.

[0056] (3) This invention solves the problems of poor tool adaptability and difficulty in expansion in existing solutions by using a unified tool resource library and a multi-dimensional tool selection mechanism. The tool resource library defines the applicable protocol, service type, TTP tag, preconditions, parameter template, execution cost and risk tags for each tool. The system can automatically select the optimal tool and generate execution instructions based on task requirements and historical performance. This unified management approach improves the success rate and interpretability of tool calls and reduces the cost of integrating new tools.

[0057] (4) This invention employs standardized parsing and differential analysis techniques in the processing of execution results and context updates to ensure that key information (such as ports, services, versions, vulnerabilities, credentials, etc.) is not lost during the backflow process and can accurately update the task context, triggering a new round of knowledge enhancement and task optimization. This design ensures the integrity and continuity of information processing, provides high-quality input for the planning module, and directly improves the accuracy of subsequent reasoning and decision-making.

[0058] (5) This invention achieves secure control and compliance assurance of the automated execution process through the control and governance module. The module provides a human-machine collaborative approval mechanism, a high-risk task blocking strategy, real-time risk monitoring and full-link auditing functions to ensure that it can effectively prevent out-of-bounds behavior, illegal operations and potential attack risks even under fully automated operation. At the same time, it provides a traceable chain of evidence and standardized penetration test reports to meet the dual requirements of security assessment and compliance audit. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart of an automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system, according to an embodiment of the present invention.

[0061] Figure 2 This is a block diagram of an automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system, according to an embodiment of the present invention.

[0062] Figure 3 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0063] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0064] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0065] like Figure 1 As shown in the figure, this embodiment provides an automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system. It utilizes LLM-driven retrieval enhancement generation (RAG) technology to dynamically integrate multi-source context and security knowledge bases (including the ATT&CK system, vulnerability database, and historical cases) to generate a penetration testing task tree (PTT) that conforms to a real-world attack chain. Relying on MCP to register and schedule penetration testing tool libraries, multiple agents execute tasks and provide real-time environment snapshots to the LLM. The method iteratively optimizes PTT nodes and path planning, achieving end-to-end adaptive penetration testing from perception, decision-making, execution to feedback. The method includes the following steps:

[0066] S1. Multi-source information acquisition and modeling, specifically including the following:

[0067] S11. Receive raw information from multiple data sources, including port scan and service probe results from active scanners, traffic analysis from passive probe devices, host fingerprint information and ARP / LLDP neighbor information, routing tables and VLAN mappings from intranet topology discovery tools, asset lists from asset management platforms, historical penetration records, and external threat intelligence.

[0068] S12. The parser module parses, maps, and standardizes heterogeneous data in different formats (such as XML, JSON, and plain text logs), mapping them to a unified asset data model. This model includes fields such as IP address, MAC address, open ports, running services, version information, vulnerability number (CVE), host fingerprint, and account information.

[0069] S13. Use graph databases (such as Neo4j) to construct a multi-layered network topology that covers the network layer, host layer, and account relationship layer.

[0070] S14. Use a confidence-weighted method to deduplicatize and resolve conflicts in multi-source information. For example, prioritize version information from authoritative scanners and take the highest confidence value when data from different sources conflict.

[0071] S15. For large-scale network environments, topology pruning can be performed. Through reachability analysis (BFS / DFS), only the subgraph related to the target asset is retained, and the minimum sufficient context directly related to the penetration target is extracted, thereby reducing the computational burden and noise interference of subsequent inference.

[0072] S2. Knowledge Enhancement: This step, based on the task context, retrieves domain knowledge relevant to the current task node from the security knowledge base. The knowledge base can cover MITREATT&CK tactics, techniques, and sub-technical information, CWE vulnerability patterns, OWASP attack methods, common tool usage guides, and typical attack chain cases; specifically, it includes the following:

[0073] S21. Extract contextual features, such as target service type (HTTP, SMB, RDP, etc.), port number, vulnerability number (CVE), operating system version, and other feature information.

[0074] S22. Use a hybrid search strategy: first, perform initial screening based on keywords (such as vulnerability numbers or service agreements), and then use vector search for semantic similarity matching.

[0075] Specifically, the retrieval process can employ keyword matching, vector similarity calculation, or a hybrid retrieval strategy, and is further reordered based on TTP matching degree, data source credibility, and timeliness. The final output is structured knowledge data, corresponding one-to-one with task nodes, providing highly relevant professional references for subsequent planning.

[0076] S23. The search scope covers tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns, and instructions and parameter templates for commonly used penetration testing tools.

[0077] S24. The search results are ranked by weight based on TTP matching degree, data source credibility and information timeliness, low relevance or outdated information is removed, and the results are converted into a structured format (such as JSON) that includes exploitation conditions, optional attack methods, recommended tools and execution precautions.

[0078] S3, Task Planning and PTT Tree Generation, specifically:

[0079] S31. Using the intelligent inference engine, combine the context data from step S1 with the knowledge enhancement results from step S2 to generate or update the penetration testing task tree (PTT). The task tree is organized hierarchically as tactic → technique → sub-technique, with each node recording prerequisites (such as port reachability, valid credentials), dependencies, execution status, associated evidence, and a set of available tools.

[0080] S32. Introduce a multi-dimensional priority assessment model, which calculates task priority by weighting indicators such as vulnerability severity (CVSS score), target attainability (network topology analysis), expected benefits (privilege escalation or target achievement), execution cost (time and resource consumption), and risk level (probability of triggering the defense system).

[0081] Specifically, the multi-dimensional priority assessment model adopts a multi-dimensional path priority assessment mechanism, which comprehensively considers factors such as vulnerability severity, target achievability, execution cost, potential benefits, and risk level to score and rank task nodes, and prioritizes the execution of high-value, high-success-rate paths.

[0082] S33. The inference engine can be implemented using a large language model (such as an LLM based on RAG) or a rule engine to ensure that both global optimization and execution feasibility are considered when generating the task order.

[0083] S34. When execution feedback is received from step S5, this step can automatically adjust the path for failed or high-risk tasks to avoid repeated attempts at invalid actions.

[0084] S4, Tool Management and Execution: Responsible for transforming task planning results into directly executable penetration actions, specifically including:

[0085] S41. Retrieve candidate tools from the tool resource library that match the TTP tags and prerequisites of the current PTT node. The metadata of each tool in the resource library includes the applicable protocol, service type, supported TTP tags, prerequisites, parameter template, output format, execution cost, and risk tags.

[0086] S42. Then, the candidate tools are ranked according to the context matching degree (such as the compatibility between the target service version and the tool), historical success rate, execution cost and other indicators, and the tool with the highest priority is selected to generate the execution command. The command generator fills in the parameter template of the tool with context information (such as target IP, port, credentials) and outputs a standardized execution command (which can be a command line, API call or container image run command).

[0087] S43. The execution module calls the tool to complete the penetration action and collects the raw output (terminal logs, network response, file content) and metadata (execution environment, parameters, start and end time, time consumed, resource consumption, etc.) during the execution process.

[0088] S5. Result feedback and optimization, details of which are as follows:

[0089] S51. Perform structured parsing on the execution results generated in step S4, extract the newly added key information (port, service, vulnerability, path, credentials, characteristic echo, etc.), perform standardization processing, and merge it with the existing task context.

[0090] S52. For results from multiple executions, use a difference analysis method to mark new information and remove duplicate data.

[0091] S53. The updated task context is sent back to the knowledge enhancement module in step S2 and the task planning module in step S3, triggering new knowledge retrieval and task optimization, thereby realizing feedback-driven dynamic adjustment.

[0092] S54. In path optimization, this step can mark failed or high-risk tasks as unavailable and prioritize the use of newly discovered reachable paths or high-value vulnerabilities to ensure that the penetration process approaches the global optimum in multiple iterations.

[0093] S6. Control and Governance: This step involves real-time risk detection and compliance strategy control throughout the entire process from S1 to S5. Specific details are as follows:

[0094] S61, the policy engine will check each task about to be executed according to preset rules (such as blacklists and whitelists, geographical restrictions, time window constraints), and trigger manual approval (HITL) or automatic blocking for high-risk tasks (such as denial-of-service attacks, large-scale brute-force attempts).

[0095] S62. The risk detection module continuously monitors execution rate, resource consumption, and network behavior anomalies. When an anomaly is detected, it automatically issues an alarm and terminates the relevant tasks.

[0096] S63. The entire execution process generates a full-link audit log, including task context snapshots, executed commands, tool outputs, optimization decision records, etc.

[0097] S64. Automatically generate penetration test reports based on PTT execution trajectory. The reports include execution steps, success rate, key evidence and final results, supporting security assessment and compliance verification.

[0098] This invention aims to address the problems of fragmented information processing, linearized processes, limited knowledge utilization, and coarse-grained execution control in existing penetration testing techniques. The method employs a modular, layered architecture, integrating information acquisition, knowledge enhancement, task planning, tool management, result feedback, and control governance through standardized data and control flows, achieving a closed-loop process from input to execution and from feedback to optimization. The system not only supports a fully automated mode but also allows flexible switching between semi-automatic and read-only drill modes, and possesses scalability, interpretability, and traceability.

[0099] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0100] Based on the same ideas as the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system in the above embodiments, this invention also provides an automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system. This system can be used to execute the above-described automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system. For ease of explanation, the structural diagram of the embodiment of the automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system only shows the parts related to the embodiments of this invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0101] Please see Figure 2 In another embodiment of this application, an automated penetration testing closed-loop system 100 based on intelligent reasoning and security knowledge system is provided. The system includes an information collection and modeling module 101, a knowledge enhancement module 102, a task planning and PTT tree generation module 103, a tool management and execution module 104, a result feedback and optimization module 105, and a control and governance module 106.

[0102] The information acquisition and modeling module 101 is used to acquire multi-source raw data and perform parsing and standardization processing to construct a unified asset data model and network topology.

[0103] The knowledge enhancement module 102 is used to retrieve attack knowledge and tool usage guidelines related to the current task from the security knowledge base based on the feature information in the current task context, and generate structured knowledge data; the security knowledge base includes at least tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and instructions and parameter templates for penetration testing tools.

[0104] The task planning and PTT tree generation module 103 is used to integrate feature information and structured knowledge data in the current task context using an intelligent inference engine. Specifically, it uses a large language model (LLM) and retrieval enhancement generation (RAG) technology to integrate feature information and structured knowledge data in the current task context, and introduces historical successful penetration testing cases for enhanced inference to generate a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes to form a complete attack chain. Its leaf node tasks are selected and instantiated with reference to ATT&CK sub-techniques and atomic attack operations. It also combines information such as real-time network topology, node preconditions, dependencies, execution status, and available tool sets to generate the optimal attack path for actual combat. A multi-dimensional priority evaluation mechanism is used to dynamically score and sort task nodes to further optimize the execution order and improve the success rate of penetration testing.

[0105] The tool management and execution module 104 is used to select penetration tools from the tool resource library and generate executable instructions to perform penetration actions according to the node requirements of the task tree;

[0106] The result feedback and optimization module 105 is used to parse the execution results, extract key information and update the task context, and trigger a new round of task planning and knowledge retrieval.

[0107] The control and governance module 106 is used to perform real-time risk monitoring and compliance control on the task execution process, and to generate audit logs and penetration test reports.

[0108] It should be noted that the automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system of the present invention corresponds one-to-one with the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system of the present invention. The technical features and beneficial effects described in the embodiments of the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system are applicable to the embodiments of the automated penetration testing closed-loop based on intelligent reasoning and security knowledge system. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0109] Furthermore, in the above embodiments of the automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or the convenience of software implementation. That is, the internal structure of the automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system is divided into different program modules to complete all or part of the functions described above.

[0110] Please see Figure 3In one embodiment, an electronic device is provided for implementing an automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system. The electronic device 200 may include a first processor 201, a first memory 202, and a bus, and may also include a computer program stored in the first memory 202 and executable on the first processor 201, such as an automated penetration testing closed-loop program 203 based on intelligent reasoning and a security knowledge system.

[0111] The first memory 202 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory 202 can be an internal storage unit of the electronic device 200, such as the portable hard drive of the electronic device 200. In other embodiments, the first memory 202 can also be an external storage device of the electronic device 200, such as a plug-in portable hard drive, SmartMediaCard (SMC), SecureDigital (SD) card, FlashCard, etc., equipped on the electronic device 200. Furthermore, the first memory 202 can include both internal storage units and external storage devices of the electronic device 200. The first memory 202 can be used not only to store application software and various types of data installed on the electronic device 200, such as the code of the automated penetration testing closed-loop program 203 based on intelligent reasoning and security knowledge system, but also to temporarily store data that has been output or will be output.

[0112] In some embodiments, the first processor 201 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor 201 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory 202 and calls data stored in the first memory 202 to perform various functions of the electronic device 200 and process data.

[0113] Figure 3 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 3The structure shown does not constitute a limitation on the electronic device 200, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0114] The automated penetration testing closed-loop program 203 based on intelligent reasoning and security knowledge system stored in the first memory 202 of the electronic device 200 is a combination of multiple instructions. When run in the first processor 201, it can achieve the following:

[0115] Acquire raw data from multiple sources, perform parsing and standardization processing, and construct a unified asset data model and network topology.

[0116] Based on the feature information in the current task context, attack knowledge and tool usage guidelines related to the current task are retrieved from the security knowledge base to generate structured knowledge data; the security knowledge base at least includes tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and usage instructions and parameter templates for penetration testing tools.

[0117] This system leverages an intelligent inference engine to fuse feature information and structured knowledge data from the current task context. Specifically, it utilizes a Large Language Model (LLM) and employs Retrieval Enhancement Generation (RAG) technology to integrate feature information and structured knowledge data from the current task context. Furthermore, it incorporates successful historical penetration testing cases for enhanced inference, generating a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes, connecting them to form a complete attack chain. Leaf node tasks are selected and instantiated based on ATT&CK sub-techniques and atomic attack operations. Combining real-time network topology, node preconditions, dependencies, execution status, and available tool sets, it generates optimal attack paths for real-world scenarios. A multi-dimensional priority evaluation mechanism dynamically scores and sorts task nodes, further optimizing the execution order and improving the penetration testing success rate.

[0118] Based on the node requirements of the task tree, LLM calls the MCP server to register penetration testing tools in the resource library, selects penetration testing tools, generates executable instructions, and automatically executes penetration actions.

[0119] The execution results are analyzed, key information is extracted and the task context is updated to form a network environment snapshot, triggering a new round of task planning and knowledge retrieval;

[0120] Perform real-time risk monitoring and compliance control on the task execution process, and generate audit logs and penetration test reports.

[0121] The process of acquiring multi-source raw data and performing parsing and standardization includes:

[0122] It receives information from multiple data sources, including active scanners, passive detection devices, intranet topology discovery tools, asset management platforms, and historical penetration records.

[0123] Using a parser corresponding to the data format, raw data in XML, JSON, or plain text format is mapped to a predefined unified asset data model, which includes fields such as IP address, MAC address, open port, running service, version information, vulnerability number, and account information.

[0124] Utilize graph databases to construct multi-layered network topologies, including network, host, and account relationship layers;

[0125] The confidence-weighted method removes duplicates and resolves conflicts from multi-source information, and performs topology pruning based on reachability analysis to retain subgraphs related to the target asset.

[0126] Furthermore, if the modules / units integrated in the electronic device 200 are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0127] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0128] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0129] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. An automated penetration testing closed-loop method based on intelligent reasoning and a security knowledge system, characterized in that, Includes the following steps: Acquire raw data from multiple sources, perform parsing and standardization processing, and construct a unified asset data model and network topology. Based on the feature information in the current task context, attack knowledge and tool usage guidelines related to the current task are retrieved from the security knowledge base to generate structured knowledge data; the security knowledge base at least includes tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and usage instructions and parameter templates for penetration testing tools. This system leverages an intelligent inference engine to fuse feature information and structured knowledge data from the current task context. Specifically, it utilizes a Large Language Model (LLM) and employs Retrieval Enhancement Generation (RAG) technology to integrate feature information and structured knowledge data from the current task context. Furthermore, it incorporates successful historical penetration testing cases for enhanced inference, generating a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes, connecting them to form a complete attack chain. Leaf node tasks are selected and instantiated based on ATT&CK sub-techniques and atomic attack operations. Combining real-time network topology, node preconditions, dependencies, execution status, and available tool sets, it generates optimal attack paths for real-world scenarios. A multi-dimensional priority evaluation mechanism dynamically scores and sorts task nodes, further optimizing the execution order and improving the penetration testing success rate. Based on the node requirements of the task tree, LLM calls the MCP server to register penetration testing tools in the resource library, selects penetration testing tools, generates executable instructions, and automatically executes penetration actions. The execution results are analyzed, key information is extracted and the task context is updated to form a network environment snapshot, triggering a new round of task planning and knowledge retrieval; Perform real-time risk monitoring and compliance control on the task execution process, and generate audit logs and penetration test reports.

2. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The process of acquiring multi-source raw data and performing parsing and standardization includes: It receives information from multiple data sources, including active scanners, passive detection devices, intranet topology discovery tools, asset management platforms, and historical penetration records. Using a parser corresponding to the data format, raw data in XML, JSON, or plain text format is mapped to a predefined unified asset data model, which includes fields such as IP address, MAC address, open port, running service, version information, vulnerability number, and account information. Utilize graph databases to construct multi-layered network topologies, including network, host, and account relationship layers; The confidence-weighted method is used to deduplicate and resolve conflicts in multi-source information, and topology pruning is performed based on reachability analysis to retain subgraphs related to the target asset.

3. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The process of retrieving attack knowledge and tool usage guidelines relevant to the current task from the security knowledge base includes: Based on the Large Language Model (LLM) and Retrieval Enhancement Generation (RAG) technology, at least one feature information from the target service type, port number, vulnerability number, and operating system version is extracted from the current task context, and historical successful penetration test cases are introduced to enhance the retrieval context. A hybrid retrieval strategy is adopted, which integrates keyword matching and vector semantic similarity calculation, and searches are performed from a security knowledge base that integrates ATT&CK tactics, techniques, sub-techniques and atomic attack operations. The search results are weighted and ranked according to TTP matching degree, ATT&CK tactical chain relevance, data source credibility, and information timeliness, and then converted into structured knowledge data containing exploitation conditions, attack methods, recommended tools, and execution precautions to generate the penetration testing task tree PTT node.

4. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The multi-dimensional priority evaluation mechanism is as follows: A multi-dimensional priority evaluation model is adopted, which scores and ranks task nodes by weighted calculation of vulnerability severity CVSS score, target reachability based on network topology analysis, expected privilege escalation benefits, execution time and resource consumption costs, and risk level of triggering defense system.

5. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The step of selecting penetration testing tools from the tool resource library and generating executable instructions includes: Based on the TTP tags and prerequisites of the current PTT node, candidate tools are selected from the registered penetration testing tool library through the MCP server. The tool resource library records the applicable protocol, service type, supported TTP tags, parameter template, output format, execution cost and risk tags for each tool. Candidate tools are prioritized based on at least one of the following metrics: compatibility between the target service version and the tool, historical success rate, and execution cost. The parameter template of the selected tool is combined with the context information in the target IP, port, and credentials to generate standardized command-line execution instructions or API call instructions.

6. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The process of parsing the execution results, extracting key information, updating the task context, and triggering a new round of task planning and knowledge retrieval involves the following steps: The raw output of the tool execution is parsed in a structured manner to extract key information from newly added ports, services, vulnerabilities, paths, and credentials; The difference analysis method is used to compare the results of multiple executions with the existing task context, mark new information and remove duplicate data; The updated task context is fed back to the knowledge retrieval and task planning steps to trigger a new round of knowledge enhancement and path optimization.

7. The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system according to claim 1, characterized in that, The real-time risk monitoring and compliance control of the task execution process includes: The task to be executed is checked based on the compliance policies in the preset blacklists, whitelists, geographical restrictions and time window constraints; For denial-of-service attacks or large-scale brute-force attacks identified as high-risk, a manual approval mechanism is triggered. Real-time monitoring of execution rate, resource consumption, and network behavior anomalies, and automatic alerts and termination of related tasks when anomalies are detected; Record audit logs for the entire process and automatically generate penetration test reports containing execution steps, success rates, and key evidence based on the task execution trajectory.

8. An automated penetration testing closed-loop system based on intelligent reasoning and security knowledge system, characterized in that: The automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system applied to any one of claims 1-7 includes an information collection and modeling module, a knowledge enhancement module, a task planning and PTT tree generation module, a tool management and execution module, a result feedback and optimization module, and a control and governance module. The information acquisition and modeling module is used to acquire multi-source raw data and perform parsing and standardization processing to construct a unified asset data model and network topology. The knowledge enhancement module is used to retrieve attack knowledge and tool usage guidelines related to the current task from the security knowledge base based on feature information in the current task context, and generate structured knowledge data; the security knowledge base includes at least tactical, technical and sub-technical information in the MITREATT&CK framework, CWE vulnerability types, OWASP attack patterns and instructions and parameter templates for penetration testing tools. The task planning and PTT tree generation module utilizes an intelligent inference engine to fuse feature information and structured knowledge data from the current task context. Specifically, it employs a Large Language Model (LLM) and leverages Retrieval Enhancement Generation (RAG) technology to fuse feature information and structured knowledge data from the current task context. It also incorporates successful historical penetration testing cases for enhanced inference, generating a penetration testing task tree (PTT) that conforms to the ATT&CK standard tactical system. This task tree uses tactics as stage nodes, connecting them to form a complete attack chain. Leaf node tasks are selected and instantiated based on ATT&CK sub-techniques and atomic attack operations. Combining real-time network topology, node preconditions, dependencies, execution status, and available tool sets, it generates the optimal attack path for real-world application. A multi-dimensional priority evaluation mechanism dynamically scores and sorts task nodes, further optimizing the execution order and improving the penetration testing success rate. The tool management and execution module is used to select penetration tools from the tool resource library and generate executable instructions to perform penetration actions according to the node requirements of the task tree; The result feedback and optimization module is used to parse the execution results, extract key information and update the task context, triggering a new round of task planning and knowledge retrieval. The control and governance module is used to perform real-time risk monitoring and compliance control during the task execution process, and to generate audit logs and penetration test reports.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which enables the at least one processor to execute the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that, When the program is executed by the processor, it implements the automated penetration testing closed-loop method based on intelligent reasoning and security knowledge system as described in any one of claims 1-7.

Images