Test method and device, related equipment and computer program product

Abstract

The invention provides a test method and device, related equipment and a computer program product, and relates to the technical field of information security and network attack and defense. The method comprises the following steps: acquiring an attack state diagram corresponding to a target network system, wherein the attack state diagram comprises nodes and edges connected with the nodes; wherein each edge corresponds to an edge attribute; determining an initial state node and a termination state node of vulnerability detection in the attack state diagram; searching the attack state diagram, and determining a plurality of candidate paths from the initial state node to the termination state node; determining the execution cost corresponding to each candidate path based on the edge attribute; screening out a target path with the lowest execution cost from the plurality of candidate paths; and performing penetration test on the target network system based on the target path to obtain a penetration test result. According to the embodiment of the invention, the target network system can be efficiently and accurately tested.

Description

Technical Field

[0001] This disclosure relates to the fields of information security and network attack and defense technology, and in particular to a testing method, apparatus, electronic device, computer-readable storage medium, and computer program product. Background Technology

[0002] This section is intended to provide background or context for the embodiments of this disclosure as set forth in the claims. The description herein is not intended to be a prior art simply because it is included in this section.

[0003] With the rapid development of information technology, the network attack surface is expanding and becoming more complex, making penetration testing, as a core means of proactive security defense, increasingly important.

[0004] Traditional automated penetration testing techniques, as well as some emerging intelligent testing tools, still have significant limitations when dealing with modern complex and dynamic network environments, making it difficult to meet the needs for efficient, in-depth, and intelligent security assessments.

[0005] Therefore, there is an urgent need for a testing solution that is highly automated, targeted, and efficient. Summary of the Invention

[0006] The purpose of this disclosure is to provide a test method, apparatus, electronic device, computer-readable storage medium, and computer program product that can efficiently and accurately perform targeted testing on a target network system.

[0007] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0008] This disclosure provides a testing method, comprising: acquiring an attack state graph corresponding to a target network system, the attack state graph including nodes and edges connecting the nodes, the nodes representing possible host states, service states, vulnerability states, and permission states in the target network system, and the edges representing executable actions that can trigger state transitions; wherein each edge corresponds to an edge attribute, the edge attribute including action cost information, action risk information, and action gain value; determining a starting state node and a ending state node for vulnerability detection in the attack state graph; searching the attack state graph to determine multiple candidate paths from the starting state node to the ending state node; determining the execution cost corresponding to each candidate path based on the edge attributes; selecting the target path with the lowest execution cost from the multiple candidate paths; and performing penetration testing on the target network system based on the target path to obtain penetration testing results.

[0009] In some embodiments, the method further includes updating the edge attributes in the attack state graph based on the penetration test results.

[0010] In some embodiments, the method further includes: performing action prediction processing on the attack state graph through a policy network to predict the probability of each action occurring on each edge in the attack state graph, and using the probability as the weight of the edge; and removing edges in the attack state graph whose weight is lower than a first threshold.

[0011] In some embodiments, the method further includes: updating the edge attributes in the attack state graph based on the penetration test results; calculating the reward value corresponding to each candidate path based on the updated edge attributes; wherein the reward value is negatively correlated with the cost information and action risk information, and positively correlated with the value obtainable by the action; and updating the parameters corresponding to the policy network based on the reward value.

[0012] In some embodiments, obtaining an attack state graph corresponding to a target network system includes: scanning the target network system to obtain its system information; extracting host status, service status, vulnerability status, and permission status based on the system information; wherein different states of the same host, service, or vulnerability are represented by different nodes; abstracting each extracted state into a corresponding node; determining executable actions between nodes based on a preset action library; and connecting two nodes with executable actions to generate the attack state graph, where one action corresponds to one edge.

[0013] In some embodiments, the plurality of candidate paths includes a first candidate path, which sequentially includes a first node, a second node, and a third node; a first edge exists between the first node and the second node on the first candidate path, and a second edge exists between the second node and the third node; wherein, determining the execution cost corresponding to each candidate path based on the edge attributes includes: determining the execution cost of the action corresponding to the first edge based on the edge attributes of the first edge; determining the execution cost of the action corresponding to the second edge based on the edge attributes of the second edge; and adding the execution cost of the action corresponding to the first edge to the execution cost of the action corresponding to the second edge to determine the execution cost corresponding to the first candidate path.

[0014] In some embodiments, the action cost information includes the time and / or hardware and software resources consumed by the action, the action risk information includes the possibility that the action will trigger protection devices and the negative impacts of the action being detected, the intrusion failing, or the system crashing, and the action value includes the access rights information and / or intelligence value that the action can obtain.

[0015] In some embodiments, the executable actions include at least one of: vulnerability exploitation, lateral movement, information gathering, and privilege escalation.

[0016] This disclosure provides a testing apparatus, including: an attack state graph acquisition module, a starting node determination module, a search module, an execution cost determination module, a target path determination module, and a penetration testing module.

[0017] The attack state graph acquisition module is used to acquire the attack state graph corresponding to the target network system. The attack state graph includes nodes and edges connecting the nodes. The nodes represent the host state, service state, vulnerability state, and permission state that may exist in the target network system. The edges represent executable actions that can trigger state transitions. Each edge has corresponding edge attributes, including action cost information, action risk information, and action gain value. The starting node determination module can be used to determine the starting state node and ending state node for vulnerability detection in the attack state graph. The search module can be used to search the attack state graph to determine multiple candidate paths from the starting state node to the ending state node. The execution cost determination module can be used to determine the execution cost corresponding to each candidate path based on the edge attributes. The target path determination module can be used to filter out the target path with the lowest execution cost from the multiple candidate paths. The penetration testing module can be used to perform penetration testing on the target network system based on the target path to obtain penetration testing results.

[0018] This disclosure provides an electronic device comprising: a memory and a processor; the memory for storing computer program instructions; and the processor for calling the computer program instructions stored in the memory to implement the testing method described above.

[0019] This disclosure provides a computer-readable storage medium having computer program instructions stored thereon to implement the test method as described in any of the preceding embodiments.

[0020] This disclosure provides a computer program product or computer program that includes computer program instructions stored in a computer-readable storage medium. The computer program instructions are read from the computer-readable storage medium, and a processor executes the computer program instructions to implement the above-described test method.

[0021] The testing methods, apparatus, electronic devices, computer-readable storage media, and computer program products provided in this disclosure, by constructing an attack state graph containing multiple state nodes and cost attribute edges, and combining global path search and cost optimization algorithms, can automatically plan the penetration testing path with the lowest cost, lowest risk, highest benefit, and highest efficiency. This effectively solves the problems of traditional methods relying on human experience, redundant attack paths, and low testing efficiency, and achieves automated, intelligent, efficient, low-cost, and high-return accurate penetration testing.

[0022] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this disclosure. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0024] Figure 1 A schematic diagram of a scenario that can be applied to the test method or test apparatus of the embodiments of this disclosure is shown.

[0025] Figure 2 This is a flowchart illustrating a testing method according to an exemplary embodiment.

[0026] Figure 3 This is a flowchart illustrating a testing method according to an exemplary embodiment.

[0027] Figure 4 This is a flowchart illustrating an edge optimization method for an attack state graph according to an exemplary embodiment.

[0028] Figure 5 This is a flowchart illustrating a parameter update method according to an exemplary embodiment.

[0029] Figure 6 This is a flowchart illustrating an attack state graph determination method according to an exemplary embodiment.

[0030] Figure 7 This is a flowchart illustrating an execution cost determination method according to an exemplary embodiment.

[0031] Figure 8 This is a test system architecture diagram illustrated according to an exemplary embodiment.

[0032] Figure 9This is a flowchart illustrating an attack state graph construction method according to an exemplary embodiment.

[0033] Figure 10 This is a flowchart illustrating a test path planning method according to an exemplary embodiment.

[0034] Figure 11 This is a feedback learning loop structure diagram illustrated according to an exemplary embodiment.

[0035] Figure 12 This is a flowchart illustrating a method for generating a reproduction script according to an exemplary embodiment.

[0036] Figure 13 This is a block diagram illustrating a testing apparatus according to an exemplary embodiment.

[0037] Figure 14 A schematic diagram of the structure of an electronic device suitable for implementing embodiments of the present disclosure is shown. Detailed Implementation

[0038] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, they are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted.

[0039] Those skilled in the art will recognize that embodiments of this disclosure can be a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0040] The features, structures, or characteristics described in this disclosure can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more specific details omitted, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0041] In this disclosure, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0042] The accompanying drawings are merely illustrative of this disclosure, and the same reference numerals in the drawings denote the same or similar parts, thus omitting repeated descriptions of them. Some block diagrams shown in the drawings do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0043] The flowchart shown in the accompanying drawings is merely illustrative and does not necessarily include all content and steps, nor does it require execution in the described order. For example, some steps may be broken down, while others may be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0044] In the description of this disclosure, unless otherwise stated, " / " means "or," for example, A / B can mean A or B. "And / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" means one or more, and "multiple" means two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences; the terms "contains," "includes," and "has" are used to indicate an open-ended meaning of inclusion and refer to the existence of additional elements / components / etc. besides those listed.

[0045] To better understand the above-mentioned objectives, features and advantages of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0046] The following section will first explain some of the terms used in the embodiments of this disclosure so that those skilled in the art can understand them.

[0047] RL (Reinforcement Learning): A machine learning method that uses reward feedback mechanisms to help agents learn optimal behavioral strategies.

[0048] Graph Search: Algorithms for finding optimal paths in a graph structure, such as Dijkstra's algorithm and A*. wait.

[0049] Payload: A data carrier that can be used to execute attack actions.

[0050] WAF (Web Application Firewall): A defense system that filters and monitors HTTP traffic.

[0051] IDS (Intrusion Detection System): A detection system that identifies malicious activities within a system.

[0052] EDR (Endpoint Detection and Response): A monitoring and response system for endpoint threats.

[0053] Attack State Graph: A graph structure that represents a model of the transition paths between attack states.

[0054] The preceding text introduced some terms and concepts involved in the embodiments of this disclosure. The following text introduces the technical features involved in the embodiments of this disclosure.

[0055] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0056] Figure 1 A schematic diagram of a scenario that can be applied to the test method or test apparatus of the embodiments of this disclosure is shown.

[0057] Please refer to Figure 1 The diagram illustrates an implementation environment provided by an exemplary embodiment of this disclosure.

[0058] like Figure 1 As shown, system architecture 100 may include terminal devices 101, 102, and 103, a network 104, and a server 105. Network 104 serves as the medium for providing communication links between terminal devices 101, 102, and 103 and server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0059] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Terminal devices 101, 102, and 103 can be various electronic devices with displays and web browsing capabilities, including but not limited to smartphones, tablets, laptops, desktop computers, wearable devices, virtual reality devices, smart home devices, etc.

[0060] Server 105 can be a server that provides various services, such as a backend management server that supports the devices operated by users using terminal devices 101, 102, and 103. The backend management server can analyze and process received requests and other data, and feed the processing results back to the terminal devices.

[0061] A server can be a standalone physical server, a server cluster or a distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. This disclosure does not impose any restrictions on this.

[0062] Server 105 can, for example, obtain an attack state graph corresponding to the target network system. The attack state graph includes nodes and edges connecting the nodes. Nodes represent the host states, service states, vulnerability states, and permission states that may exist in the target network system. Edges represent executable actions that can trigger state transitions. Each edge has corresponding edge attributes, including action cost information, action risk information, and action gain value. Server 105 can, for example, determine the starting and ending state nodes for vulnerability detection in the attack state graph. Server 105 can, for example, search the attack state graph to determine multiple candidate paths from the starting state node to the ending state node. Server 105 can, for example, determine the execution cost corresponding to each candidate path based on the edge attributes. Server 105 can, for example, filter out the target path with the lowest execution cost from the multiple candidate paths. Server 105 can, for example, perform penetration testing on the target network system based on the target path to obtain penetration test results.

[0063] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Server 105 can be a single physical server or a combination of multiple servers. Depending on actual needs, it can have any number of terminal devices, networks, and servers.

[0064] Under the above system architecture, in an embodiment of the present disclosure, a testing method is provided, and this method can be executed by any electronic device with computing and processing capabilities.

[0065] Figure 2 It is a flowchart of a testing method shown according to an exemplary embodiment. The method provided by the embodiments of the present disclosure can be executed by any electronic device with computing and processing capabilities. For example, this method can be executed by the server or terminal device in the above Figure 1 embodiments, or can be jointly executed by the server and the terminal device. In the following embodiments, the server is taken as an example of the execution entity for illustration, but the present disclosure is not limited thereto.

[0066] Referring to Figure 2 , the testing method provided by the embodiments of the present disclosure may include the following steps.

[0067] Step S202, obtain the attack state graph corresponding to the target network system. The attack state graph includes nodes and edges connecting the nodes. The nodes are used to represent the possible host states, service states, vulnerability states, and privilege states in the target network system, and the edges are used to represent the executable actions that can trigger state transitions; each edge corresponds to edge attributes, and the edge attributes include action cost information, action risk information, and value that can be obtained by the action.

[0068] The attack state graph is a directed graph data structure, and this graph is used to globally and structurally model the state and state transition relationships of the target network system.

[0069] The nodes are used to abstractly represent the possible states in the target network system. Each node represents a discrete system snapshot, specifically including but not limited to the following categories.

[0070] Host state (HostState): Represents the presence of a physical or virtual host discovered in the network, and its unique identifier is usually an IP address or a host name.

[0071] Service state (ServiceState): Represents the network service running on a specific host (or host port), and can be uniquely determined by a tuple such as <IP address, port, service type, version>.

[0072] Vulnerability state (VulnerabilityState): Represents the identified security weaknesses on a specific service or host, and is associated with entries in a standard vulnerability library (such as CVE, CNVD).

[0073] Privilege state (PrivilegeState): Represents the access privilege level obtained on a specific host, such as "unauthorized", "ordinary user privilege", "system administrator privilege", etc.

[0074] Edges are used to represent executable actions that can trigger state transitions. An edge can represent that, by performing a specific action, the safe state of the system can be transferred from one node to another. These actions include, but are not limited to, the following.

[0075] Exploitation: Using a vulnerability to gain a higher level of privilege.

[0076] Lateral movement: Using acquired credentials or trust relationships, moving from one host state to another host state within the network.

[0077] Privilege escalation: On the same host, elevating a user from a low-privilege state to a high-privilege state.

[0078] Information gathering: Discovering new service status or vulnerability status from the current state.

[0079] Edge attributes: Each edge has one or more attributes that quantify the cost and benefit of performing the action. These attributes collectively form the basis of the cost function of the path planning algorithm, and mainly include at least one of the following.

[0080] Action cost information (Cost): Quantifies the resources consumed in performing the action, which usually includes time cost, computing resource consumption, and network bandwidth usage.

[0081] Action Risk Information (Risk): Quantifies the negative impact of performing the action, typically including the probability of the action failing, the probability of causing system or service crashes, and the probability of triggering security alerts.

[0082] Gain / Value of an Action: This quantifies the benefit gained from successfully executing the action, typically expressed as the value of new permissions acquired, access levels for sensitive information, etc.

[0083] The host in the target network system may have different states depending on the user's state. For example, before a user logs in to the host, the host's state may include login credentials, and the permission state may include "user permissions"; after a user logs in to the host, the host's state may not include login credentials, but the weight state may include "guest permissions".

[0084] In some real-time scenarios, action cost information may include the time and / or hardware and software resources consumed by the action, action risk information may include the likelihood that the action will trigger protective equipment and the negative impact of the action being detected, the intrusion failing, or the system crashing, and the value that the action can obtain may include the access rights information and / or intelligence value that the action can acquire.

[0085] Step S204: Determine the start and end state nodes for vulnerability detection in the attack state graph.

[0086] The starting and ending state nodes together define the search boundary and objective of this test (such as a penetration test). The core mission of path planning algorithms (whether RL or graph search) is to find an optimal path that connects these two nodes.

[0087] Starting state node: This represents the attacker's initial location and initial information. It is the starting point of the attack path and usually corresponds to the outermost, lowest-privilege access point.

[0088] Termination state node: This represents the ultimate goal to be achieved in this test (such as a penetration test). It is the endpoint of the attack path planning and usually corresponds to the state with the highest business value or the highest system privileges.

[0089] In some embodiments, the aforementioned termination state node may be one that has obtained ROOT privileges on a host.

[0090] Step S206: Search the attack state graph to determine multiple candidate paths from the starting state node to the ending state node.

[0091] In some embodiments, a graph search algorithm can be used to search the attack state graph to determine multiple candidate paths from the starting state node to the ending state node.

[0092] Step S208: Determine the execution cost corresponding to each candidate path based on edge attributes.

[0093] In some embodiments, the execution cost corresponding to each edge can be calculated by edge attributes, and then all execution costs on the path can be added together (or weighted summed) to determine the execution cost of the corresponding path.

[0094] In some embodiments, the execution cost of an edge can be determined based on the edge's action cost information, action risk information, and action obtainable value. For example, the execution cost of an edge can be obtained by: action cost information + action risk information - action obtainable value.

[0095] In some embodiments, action cost information may include the time and / or hardware and software resources consumed by the action, action risk information may include the possibility that the action will trigger protection devices and the negative impacts of the action being detected, the intrusion failing, or the system crashing, and the value that the action can obtain may include the access rights information and / or intelligence value that the action can obtain.

[0096] In some embodiments, the reward function corresponding to an edge can be determined by the following formula (1).

[0097] (1)

[0098] in, The value of the permissions / intelligence that this action 'a' may acquire (value that the action can gain); : The negative impacts of action 'a' being detected, intrusion failure, system crash, etc. (Action risk information); : The time consumed by action a (e.g., port scan takes 5 seconds) (Action cost information); The likelihood that action 'a' will trigger a firewall / WAF alert; ~ The weights of each indicator are used to adjust system preferences.

[0099] In some embodiments, the execution cost of an edge can be set to - the reward function value of that edge.

[0100] In some embodiments, the execution costs of an edge can be summed to determine the execution cost corresponding to that edge, as can be found in formula (2).

[0101] (2) This represents the state at each step in a path p. ,action The sum of costs incurred; c(s,a) can be derived from the preceding reward function. Mapping (e.g., c = -r); i is an integer greater than or equal to 1.

[0102] Step S210: Select the target path with the lowest execution cost from multiple candidate paths.

[0103] In some embodiments, the candidate path with the lowest cost(p) can be selected as the attack path (target path).

[0104] Step S212: Perform penetration testing on the target network system based on the target path to obtain penetration test results.

[0105] In some embodiments, when performing penetration testing based on a target path, the executable actions in the target can be bypassed to avoid being identified by the defense system on the target system.

[0106] In some embodiments, the following methods can be used to bypass the defense of executable actions: perform adversarial perturbation on the payload or traffic before each action is executed; bypass the feature detection of WAF / EDR / IDS, such as encoding obfuscation, packet interval adjustment, path interruption, etc.; support the generation of minimum detectable perturbation based on the trained model; the output perturbation version can be compared with the original version to meet the requirements of auditing and reproduction.

[0107] This embodiment introduces a rapid perturbation generation mechanism to subtly transform payloads or network traffic, making them more difficult for security devices in the target network system to identify. The specific working process is as follows: Semantic equivalence perturbation: such as swapping logical operators and Boolean expressions in SQL injection statements; Encoding transformation: encoding sensitive keywords into URL encoding, Unicode encoding, or Base64 encoding; Instrumentation obfuscation: adding insignificant characters such as spaces, comments, and useless parameters at key locations; Protocol layer perturbation: adjusting the order of HTTP request header fields, method spelling, and capitalization. For details, please refer to [reference needed]. Figure 3 The illustrated embodiment.

[0108] In some embodiments, success / failure, alarm triggering, time elapsed, etc., are recorded after each action in order to update the edge attributes of the policy network and / or attack state graph.

[0109] In some embodiments, the edge attributes in the attack state graph can be updated based on the penetration test results so that path planning can continue based on the updated edge attributes.

[0110] The aforementioned technical solution constructs a multi-attribute attack state graph to globally model the target network, abstracting hosts, services, vulnerabilities, and permissions as nodes, and attack actions as edges with cost, risk, and value. Then, it utilizes a graph search algorithm to comprehensively evaluate the execution cost of multiple attack paths and select the optimal path, thereby achieving efficient and systematic penetration testing. Furthermore, the solution integrates a dynamic defense bypass mechanism, which can perturb the attack payload in real time during testing to evade security detection. Ultimately, while ensuring testing effectiveness, it significantly improves the stealth, automation, and success rate of penetration testing.

[0111] Figure 3 This is a flowchart illustrating a testing method according to an exemplary embodiment.

[0112] refer to Figure 3 The above testing method may include the following steps.

[0113] Step S302: Input the original attack payload.

[0114] Raw attack payloads refer to raw data packets or code snippets containing malicious code or attack instructions that are not disguised or modified in any way.

[0115] Step S304: Load the disturbance strategy module.

[0116] Multiple perturbation actions can be preset in the above perturbation strategy module.

[0117] Step S306: Generate multiple perturbation samples.

[0118] The original attack payload is perturbed by adding perturbation actions in the perturbation strategy module, resulting in multiple perturbation samples.

[0119] Step S308: Assess the suspiciousness score.

[0120] In some embodiments, the suspiciousness of each perturbation sample in the target system can be assessed.

[0121] Step S310: Select the most concealed sample (deformation attack payload).

[0122] In some embodiments, the perturbation sample with the lowest suspicion level can be selected as the most concealed sample.

[0123] Step S312: Execute the deformation attack payload.

[0124] Step S314: Record the disturbed samples and detection results.

[0125] The aforementioned technical solution utilizes a strategy module with pre-set multiple perturbation actions to automatically deform the original attack payload in batches, generating multiple perturbation samples. Then, a suspiciousness assessment mechanism is employed to select the most concealed deformed attack payload and execute it. This process achieves intelligent stealth of the attack payload, effectively bypassing feature-based security protection devices, significantly improving the concealment and success rate of penetration testing, and providing crucial data support for optimizing security defense strategies.

[0126] Figure 4 This is a flowchart illustrating an edge optimization method for an attack state graph according to an exemplary embodiment.

[0127] refer to Figure 4 The aforementioned edge optimization may include the following steps.

[0128] Step S402: The attack state graph is processed by the policy network to predict the probability of each action appearing on each edge in the attack state graph, and the probability is used as the weight of the edge.

[0129] In some embodiments, the attack state graph can be processed by a policy network to predict the probability value of performing a preset action (such as exploitation, lateral movement, information gathering, and privilege escalation) for each node in the attack state graph, and then the predicted probability value is used as the weight of the edge corresponding to the action.

[0130] For example, for nodes A and B, the probability that node A will perform various preset actions to reach node B can be predicted.

[0131] More specifically, the policy network can predict the probability of executing a preset action (Exploit CVE-2018-15473) starting from node [Service:SSH:22] to reach node [Privilege:User]. In other words, the policy network can predict the probability of reaching node [Privilege:User] by executing a preset action (Exploit CVE-2018-15473) starting from node [Service:SSH:22].

[0132] In other words, the optimal action direction between two nodes can be predicted through a policy network.

[0133] Among them, the policy function It can be expressed by formula (3).

[0134] (3)

[0135] in, Indicates the policy network in state Select action The probability of; These are the parameters of the policy network (which can be the weights of a deep neural network). For example: if the current system detects that a server has port 22 open, and the state s = {“Open SSH”, “Low version OpenSSH”}, the policy network may output an attack option with a probability of 0.8 for “Attempt SSH brute-force” and 0.2 for “Continue information gathering”.

[0136] Step S404: Remove edges with weights lower than the first threshold in the attack state graph.

[0137] In some embodiments, edges with weights below a first threshold in the attack state graph can be disconnected.

[0138] In some embodiments, there may be at least one edge between two nodes in the attack state graph.

[0139] In some embodiments, the edge with the largest weight between the two nodes can be retained, while the other edges can be disconnected.

[0140] This edge optimization method predicts the success probability of each action in the attack state graph through a policy network and uses it as the weight of the edges. It then intelligently prunes and focuses the attack graph by removing low-weight edges and retaining the optimal edges between nodes. This process dynamically optimizes the complex structure of the attack state graph, significantly improving the efficiency and accuracy of subsequent path search algorithms. It enables the system to quickly identify high-success-rate attack paths, thereby enhancing the intelligence and practicality of the overall penetration testing.

[0141] Figure 5 This is a flowchart illustrating a parameter update method according to an exemplary embodiment.

[0142] refer to Figure 5 The parameter update method for the above-mentioned policy network may include the following steps.

[0143] Step S502: Update the edge attributes in the attack state graph based on the penetration test results.

[0144] In some embodiments, after a test (such as a penetration test) has been actually performed according to the target attack path (whether successful or unsuccessful), the feedback data obtained in the field can be brought back to readjust (update) the attribute values ​​of the edges (i.e., the actions that can be performed) in the attack state graph.

[0145] In some embodiments, the above updates are primarily based on log information recorded after each action is executed, such as: Success / Failure: Did the action achieve the expected effect? ​​Time Consumption: How much time was actually spent? Alarm Triggered: Was it detected by devices such as WAF, IDS, and EDR? System Impact: Did it cause the target service to crash or become unstable?

[0146] Based on this feedback, the following edge attributes can be dynamically updated: 1. Update action cost information; 2. Update action risk information; 3. Update the value that can be obtained from the action; 4. Update the weights of the policy network.

[0147] In some embodiments, success / failure, alarm triggering, time consumption, etc. are recorded after each action; feedback signals are converted into reward values ​​to update the policy network or value function; edge weights and reward functions are allowed to be dynamically updated to achieve policy evolution.

[0148] Step S504: Calculate the reward value corresponding to each candidate path based on the updated edge attributes; wherein the reward value is negatively correlated with cost information and action risk information, and positively correlated with the value that the action can obtain.

[0149] Step S506: Update the parameters of the policy network based on the reward value.

[0150] In some embodiments, the weights in the attack state graph can be updated based on the policy network with updated parameters.

[0151] In some embodiments, edges in the attack state graph can be filtered based on the updated weights.

[0152] This parameter update method constructs a complete self-learning closed loop: the system first dynamically updates the edge attributes in the attack state graph using the practical results of penetration testing (such as success rate, time consumption, and alarm records) to ensure that its characterization of the target network is always realistic and accurate; then, based on the updated attributes, it recalculates the reward value of each path and uses this as a guide to optimize the parameters of the policy network. This process allows the system to accumulate experience from each test, continuously revise its decision model, and ultimately achieve the synergistic evolution of the policy network and the attack state graph, making the entire system's attack planning capabilities continuously enhanced with practice, becoming increasingly intelligent and efficient.

[0153] Figure 6 This is a flowchart illustrating an attack state graph determination method according to an exemplary embodiment.

[0154] refer to Figure 6 The above-mentioned method for determining the attack state diagram may include the following steps.

[0155] Step S602: Scan the target network system to obtain its system information.

[0156] Step S604: Based on system information, extract host status, service status, vulnerability status, and permission status; wherein, different statuses of the same host, service, or vulnerability are represented by different nodes.

[0157] Step S606: Abstract each extracted state into a corresponding node.

[0158] Step S608: Based on the preset action library, determine the executable actions between nodes.

[0159] Step S610: Connect two nodes with executable actions to generate an attack state graph, where one action corresponds to one edge.

[0160] Specifically, the attack state graph can be constructed using the following methods.

[0161] In some embodiments, information collection can begin by integrating various security scanning tools and vulnerability databases to achieve comprehensive information collection of the target network, including port and service identification, using nmap and masscan to obtain open ports and running services; service fingerprinting and version detection, extracting HTTP response headers, SSL certificates, etc., to identify specific versions; vulnerability information integration: collecting vulnerability descriptions, exploitation methods, and severity levels from vulnerability databases; and defense mechanism identification: detecting whether the target environment has deployed security protection systems such as WAF, IDS, and EDR.

[0162] For example, the results of scanning target 192.168.1.10 are shown below: / / The network identifier of the target server, equivalent to the target's "address". IP address: 192.168.1.10 / / A list of open ports, equivalent to an open "portal" on the target server. "ports": [ { "port": 22, / / Port number: 22. This is the default port for the SSH protocol, commonly used for remote security management.

[0163] "service": "ssh", / / Service type: SSH (Secure Shell). This indicates that the port is being listened to by a program that provides encrypted remote login services.

[0164] "version": "OpenSSH_7.2" / / Service version: OpenSSH 7.2. This is very critical information, as a specific version corresponds to a specific known vulnerability.

[0165] }, { "port": 80, / / Port number: 80. This is the default port for the HTTP protocol, used to provide web page access.

[0166] "service": "http", / / Service type: HTTP (Hypertext Transfer Protocol). This indicates that a web server is running on this port.

[0167] "version": "Apache / 2.4.7" / / Service version: Apache 2.4.7. This specific version is also used as a basis for subsequent vulnerability searches.

[0168] }

[0169] ], / / List of discovered vulnerabilities. The system identifies known security weaknesses by matching them against a vulnerability database based on the port and service version information mentioned above.

[0170] "vulnerabilities": [

[0171] "CVE-2018-15473" / / A specific vulnerability number. This vulnerability exists in OpenSSH version 7.2 and allows attackers to enumerate usernames.

[0172] ], / / List of identified defense measures. Indicates which security protection devices are deployed on the target system.

[0173] "defenses": [

[0174] "WAF" / / Web Application Firewall. It sits in front of the web server and is used to filter, monitor, and block malicious attacks in HTTP / HTTPS traffic. ]

[0176] }

[0177] In some embodiments, node extraction can then be performed: the collected raw data is abstracted into nodes in a state diagram, including host nodes (uniquely identified by IP address); service nodes, corresponding to specific ports and application types; vulnerability nodes, associated with service versions and vulnerabilities; and permission nodes, representing the current permission level on the host.

[0178] [Host:192.168.1.10]#

Host Node

[0179] ├── [Service:SSH:22] → [Vuln:CVE-2018-15473] #

Service Node

[0180] │# [Vulnerability Node]: Associated with the specific security weakness of this service (username enumeration vulnerability).

[0181] ├── [Service:HTTP:80]#

Service Node

[0182] └── [Privilege:Guest]#

Privilege Node

[0183] Next, edges are generated: edges represent actions that can be performed between different states, including: exploitation, moving from a vulnerable node to a higher-privilege node; lateral movement, logging into other hosts with known credentials; information gathering, further scanning and fingerprinting; and privilege escalation, using local privilege escalation or kernel vulnerabilities to obtain root access.

[0184] [Service:SSH:22] --(Exploit CVE-2018-15473)--> [Privilege:User].

[0185] [Privilege:User] --(Kernel Exploit)--> [Privilege:Root].

[0186] Finally, attribute annotation is performed: each edge is accompanied by detailed cost and risk information.

[0187] {

[0188] "action": "Exploit_CVE-2018-15473", "cost": { "time": 3.2, "risk": 0.2, "bandwidth": 12, "alert_prob": 0.3 }, "success_prob": 0.85 } This attack state graph determination method uses systematic scanning and information collection to accurately abstract entities such as hosts, services, vulnerabilities, and permissions in the target network into nodes, and constructs directed edges between nodes based on a preset action library, thereby automatically generating a structured attack state graph. This method achieves comprehensive, visual, and formal modeling of complex network attack surfaces, integrating scattered security data into a unified attack path planning foundation. It provides a precise and complete analytical framework for subsequent intelligent penetration testing, significantly improving the automation and systematic nature of security assessments.

[0189] Figure 7 This is a flowchart illustrating an execution cost determination method according to an exemplary embodiment.

[0190] In some embodiments, the multiple candidate paths may include a first candidate path, which includes a first node, a second node, and a third node in sequence; a first edge exists between the first node and the second node on the first candidate path, and a second edge exists between the second node and the third node.

[0191] refer to Figure 7 The above-mentioned determination of the execution cost corresponding to each candidate path based on edge attributes may include the following steps.

[0192] Step S702: Determine the execution cost of the action corresponding to the first side based on the edge attributes of the first side.

[0193] In some embodiments, the execution cost of the action corresponding to the first side can be determined with reference to formulas (1) to (2).

[0194] Step S704: Determine the execution cost of the action corresponding to the second side based on the edge attributes of the second side.

[0195] Step S706: Add the execution cost of the action corresponding to the first side to the execution cost of the action corresponding to the second side to determine the execution cost corresponding to the first candidate path.

[0196] This execution cost determination method achieves a quantitative assessment of the cost of the entire attack path by accumulating the independent costs of each edge in the attack path. This method decomposes the complex path cost calculation into cost analysis of each individual step (edge) and integrates them through simple arithmetic summation, thus providing an intuitive, computable, and scalable path cost evaluation mechanism. This provides a precise and unified quantitative basis for the subsequent selection of the optimal attack path.

[0197] In some embodiments, this application will explain and illustrate the testing methods in conjunction with specific examples.

[0198] In some embodiments, this application provides an intelligent automated penetration testing system and method, which can be applied to enterprise security assessments and automated attack simulation scenarios.

[0199] Figure 8 This is a test system architecture diagram illustrated according to an exemplary embodiment.

[0200] refer to Figure 8 The above test system architecture diagram may include an information collection module 801 (port / service / fingerprint), a state graph construction module 802 (nodes are states, edges are actions), a path planning module 803 (RL strategy + graph search), a bypass execution module 804, a reporting and closed-loop module 805 (attack path output + repair suggestions), and a feedback learning module 806 (reward mechanism and strategy update).

[0201] Figure 9 This is a flowchart illustrating an attack state graph construction method according to an exemplary embodiment.

[0202] refer to Figure 9The above attack state graph construction method may include the following steps.

[0203] Step S902, port scan.

[0204] In some embodiments, multiple security scanning tools and vulnerability databases can be integrated to achieve comprehensive information collection on the target network, including port and service identification, using nmap and masscan to obtain open ports and running services; service fingerprinting and version detection, extracting HTTP response headers, SSL certificates, etc., to identify specific versions; vulnerability information integration: collecting vulnerability descriptions, exploitation methods, and severity levels from vulnerability databases; and defense mechanism identification: detecting whether the target environment has deployed security protection systems such as WAF, IDS, and EDR.

[0205] For example, the results of scanning target 192.168.1.10 are shown below: { IP address: 192.168.1.10 "ports": [ {"port":22, "service":"ssh", "version":"OpenSSH_7.2"}, {"port":80, "service":"http", "version":"Apache / 2.4.7"} ], "vulnerabilities": ["CVE-2018-15473"], "defenses": ["WAF"] } Step S904, Service Identification.

[0206] Step S906, fingerprint recognition.

[0207] Step S908, vulnerability identification.

[0208] Step S910: Construct state nodes.

[0209] In some embodiments, node extraction can be performed by abstracting the collected raw data into nodes in a state diagram, including host nodes (uniquely identified by IP address); service nodes, corresponding to specific ports and application types; vulnerability nodes, associated with service versions and vulnerabilities; and permission nodes, representing the current permission level on the host.

[0210] [Host:192.168.1.10]

[0211] ├── [Service:SSH:22] → [Vuln:CVE-2018-15473]

[0212] ├── [Service:HTTP:80]

[0213] └── [Privilege:Guest]

[0214] Step S912: Add an actionable edge.

[0215] In some embodiments, edges can be generated by the following methods: edges represent actions that can be performed between different states, including: exploitation, from a vulnerable node to a higher-privilege node; lateral movement, logging into other hosts with known credentials; information gathering, further scanning and fingerprinting; privilege escalation, using local privilege escalation or kernel vulnerabilities to obtain root.

[0216] [Service:SSH:22] --(Exploit CVE-2018-15473)--> [Privilege:User]

[0217] [Privilege:User] --(Kernel Exploit)--> [Privilege:Root]

[0218] In some embodiments, the edges can also be labeled with attributes so that each edge is accompanied by detailed cost and risk information.

[0219] {

[0220] "action": "Exploit_CVE-2018-15473", "cost": { "time": 3.2, "risk": 0.2, "bandwidth": 12, "alert_prob": 0.3 }, "success_prob": 0.85 } Step S914: Generate an attack state diagram.

[0221] Figure 10 This is a flowchart illustrating a test path planning method according to an exemplary embodiment.

[0222] refer to Figure 10 The above test path planning method may include the following steps.

[0223] Step S1002, state s (target network system) is determined.

[0224] Step S1004: Obtain the strategy function.

[0225] Step S1006: The candidate action set is determined.

[0226] Step S1008: Calculate the reward function.

[0227] Step S1010: Calculate the path cost function.

[0228] Step S1012: Graph search yields multiple candidate paths.

[0229] Step S1014, Optimal attack path (action sequence).

[0230] In some embodiments, a reinforcement learning (RL) policy network can be used to select the optimal action direction; a graph search algorithm can be used to optimize the cost among candidate paths; the cost function integrates the attack cost, risk probability, and detection probability; and heuristic search and soft constraints (such as traffic, alarms, and time limits) can be supported.

[0231] In some embodiments, the attack actions can also be bypassed through the defense bypass module.

[0232] In some embodiments, adversarial perturbations can be applied to the payload or traffic before each action is executed; bypassing the feature detection of WAF / EDR / IDS, such as encoding obfuscation, packet spacing adjustment, path interruption, etc.; supporting the generation of minimal detectable perturbations based on trained models; the output perturbation version is comparable to the original version, meeting audit and reproduction requirements.

[0233] This application introduces a rapid perturbation generation mechanism to subtly transform payloads or network traffic, making them more difficult for security devices in the target network system to identify. The specific working process is as follows: Semantic equivalence perturbation: such as swapping logical operators and Boolean expressions in SQL injection statements; Encoding transformation: encoding sensitive keywords into URL encoding, Unicode encoding, or Base64 encoding; Instrumentation obfuscation: adding insignificant characters such as spaces, comments, and useless parameters at key locations; Protocol layer perturbation: adjusting the order of HTTP request header fields, method spelling, and capitalization.

[0234] Figure 11 This is a feedback learning loop structure diagram illustrated according to an exemplary embodiment.

[0235] refer to Figure 11 The feedback learning loop method corresponding to the feedback learning loop structure diagram can include the following:

[0236] In some embodiments, success / failure, alarm triggering, time consumption, etc. are recorded after each action; feedback signals are converted into reward values ​​to update the policy network or value function; edge weights and reward functions are allowed to be dynamically updated to achieve policy evolution.

[0237] Figure 12 This is a flowchart illustrating a method for generating a reproduction script according to an exemplary embodiment.

[0238] Step S1202, Scan.

[0239] Step S1204: Detect vulnerabilities.

[0240] Step S1206: Exploit the vulnerability to upload a system backdoor (Shell).

[0241] Step S1208: Generate the reproduction script.

[0242] In some embodiments, the attack path timeline, each action, result and timestamp can be output; attack evidence (commands, logs, traffic, data extraction files) can be provided; and reproducible scripts can be automatically generated.

[0243] The above embodiments can dynamically generate optimal attack paths, improving the efficiency and depth of penetration testing; significantly increase the bypass rate of defense systems; build an attack closed-loop feedback mechanism; automatically generate reproduction scripts and remediation suggestions, improving remediation efficiency; and achieve automated linkage capabilities of attack-detection-remediation.

[0244] The attack state graph construction module converts multi-source scan results (ports, services, vulnerabilities) into a unified graph structure model; its benefits include path search, strategy training, and behavior tracing. The RL + graph search path planning module uses reinforcement learning to select action sets and graph search algorithms to optimize attack costs; its benefits include dynamic and intelligent path selection, reducing attack time and risk. The defense bypass module (adversarial perturbation) perturbs the payload before execution, disguising it as normal traffic; its benefits include effectively circumventing detection systems and improving attack success rate. The feedback learning mechanism adjusts strategies based on attack results (success rate, detection status, time consumption); its benefits include continuous system evolution and learning capabilities. The attack path report and remediation suggestion generation module outputs attack timelines, evidence, reproduction scripts, and remediation suggestions; its benefits include improved report readability, operational reproducibility, and remediation executability.

[0245] It should be particularly noted that the steps in the various embodiments of the above testing method can be overlapped, substituted, added, or deleted from each other. Therefore, these reasonable permutations and combinations of the testing method should also fall within the protection scope of this disclosure, and the protection scope of this disclosure should not be limited to the embodiments.

[0246] Based on the same inventive concept, this disclosure also provides a testing device, as shown in the following embodiment. Since the principle by which this device embodiment solves the problem is similar to that of the above-described method embodiment, the implementation of this device embodiment can refer to the implementation of the above-described method embodiment, and repeated details will not be elaborated further.

[0247] Figure 13 This is a block diagram illustrating a testing apparatus according to an exemplary embodiment. (Refer to...) Figure 13 The testing device 1300 provided in this embodiment may include: an attack state graph acquisition module 1301, a starting node determination module 1302, a search module 1303, an execution cost determination module 1304, a target path determination module 1305, and a penetration testing module 1306.

[0248] The attack state graph acquisition module 1301 can be used to acquire the attack state graph corresponding to the target network system. The attack state graph includes nodes and edges connecting the nodes. Nodes represent the host state, service state, vulnerability state, and permission state that may exist in the target network system. Edges represent executable actions that can trigger state transitions. Each edge has corresponding edge attributes, including action cost information, action risk information, and action gain value. The starting node determination module 1302 can be used to determine the starting state node and ending state node for vulnerability detection in the attack state graph. The search module 1303 can be used to search the attack state graph to determine multiple candidate paths from the starting state node to the ending state node. The execution cost determination module 1304 can be used to determine the execution cost corresponding to each candidate path based on the edge attributes. The target path determination module 1305 can be used to filter out the target path with the lowest execution cost among multiple candidate paths. The penetration testing module 1306 can be used to perform penetration testing on the target network system based on the target path and obtain penetration testing results.

[0249] It should be noted that the attack state graph acquisition module 1301, starting node determination module 1302, search module 1303, execution cost determination module 1304, target path determination module 1305, and penetration testing module 1306 mentioned above correspond to the modules S22 to S212 in the method embodiment, and the examples and application scenarios implemented by the corresponding steps are the same, but are not limited to the content disclosed in the above method embodiment. It should also be noted that the above modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

[0250] In some embodiments, the testing apparatus 1300 may further include an edge attribute update module.

[0251] The edge attribute update module can be used to update the edge attributes in the attack state graph based on the penetration test results.

[0252] In some embodiments, the testing apparatus 1300 may further include an edge weight determination module and an edge removal module.

[0253] The edge weight determination module can be used to perform action prediction processing on the attack state graph through the policy network to predict the probability of the action corresponding to each edge in the attack state graph, and use the probability as the edge weight; the edge removal module can be used to remove edges with weights lower than a first threshold in the attack state graph.

[0254] In some embodiments, the testing apparatus 1300 may include: an edge attribute update module, a reward value update module, and a parameter update module.

[0255] The edge attribute update module can be used to update the edge attributes in the attack state graph based on the penetration test results; the reward value update module can be used to calculate the reward value corresponding to each candidate path based on the updated edge attributes; the reward value is negatively correlated with cost information and action risk information, and positively correlated with the value that the action can obtain; the parameter update module can be used to update the parameters corresponding to the policy network based on the reward value.

[0256] In some embodiments, the attack state graph acquisition module 1301 may include: a scanning submodule, a state extraction submodule, a node generation submodule, an executable action determination submodule, and an edge generation submodule.

[0257] The system comprises several modules: a scanning submodule for scanning the target network system to obtain system information; a state extraction submodule for extracting host state, service state, vulnerability state, and permission state based on system information, where different states of the same host, service, or vulnerability are represented by different nodes; a node generation submodule for abstracting each extracted state into a corresponding node; an executable action determination submodule for determining executable actions between nodes based on a preset action library; and an edge generation submodule for connecting two nodes with executable actions to generate an attack state graph, where one action corresponds to one edge.

[0258] In some embodiments, the multiple candidate paths include a first candidate path, which includes a first node, a second node, and a third node in sequence; there is a first edge between the first node and the second node on the first candidate path, and there is a second edge between the second node and the third node; wherein, the execution cost determination module 1304 may include: a first execution cost determination submodule, a second execution cost determination submodule, and a total cost determination submodule.

[0259] The first execution cost determination submodule can be used to determine the execution cost of the action corresponding to the first side based on the edge attributes of the first side; the second execution cost determination submodule can be used to determine the execution cost of the action corresponding to the second side based on the edge attributes of the second side; and the total cost determination submodule can be used to add the execution cost of the action corresponding to the first side to the execution cost of the action corresponding to the second side to determine the execution cost corresponding to the first candidate path.

[0260] In some embodiments, action cost information includes the time and / or hardware and software resources consumed by the action, action risk information includes the possibility that the action will trigger protection devices and the negative impacts of the action being detected, the intrusion failing, or the system crashing, and the value that the action can obtain includes the access rights information and / or intelligence value that the action can obtain.

[0261] In some embodiments, the action that can be performed includes at least one of: exploitation, lateral movement, information gathering, and privilege escalation.

[0262] Since the functions of the device 1300 have been described in detail in their respective method embodiments, they will not be repeated here.

[0263] The modules and / or submodules described in the embodiments of this disclosure can be implemented in software or hardware. The described modules and / or submodules can also be located in a processor. The names of these modules and / or submodules do not, in some cases, constitute a limitation on the module and / or submodule itself.

[0264] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a portion of a module or program segment containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer program instructions.

[0265] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of this disclosure and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0266] Figure 14 A schematic diagram of an electronic device suitable for implementing embodiments of the present disclosure is shown. It should be noted that... Figure 14 The illustrated electronic device 1400 is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0267] like Figure 14 As shown, the electronic device 1400 includes a central processing unit (CPU) 1401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1402 or a program loaded from a storage section 1408 into a random access memory (RAM) 1403. The RAM 1403 also stores various programs and data required for the operation of the electronic device 1400. The CPU 1401, ROM 1402, and RAM 1403 are interconnected via a bus 1404. An input / output (I / O) interface 1405 is also connected to the bus 1404.

[0268] The following components are connected to I / O interface 1405: an input section 1406 including a keyboard, mouse, etc.; an output section 1407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1408 including a hard disk, etc.; and a communication section 1409 including a network interface card such as a LAN card, modem, etc. The communication section 1409 performs communication processing via a network such as the Internet. Drive 1410 is also connected to I / O interface 1405 as needed. Removable media 1411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1410 as needed so that computer programs read from it can be installed into storage section 1408 as needed.

[0269] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing computer program instructions for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1409, and / or installed from removable medium 1411. When the computer program is executed by central processing unit (CPU) 1401, it performs the functions defined above in the system of this disclosure.

[0270] It should be noted that the computer-readable storage medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable computer program instructions. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable storage medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Computer program instructions contained on a computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0271] In another aspect, this disclosure also provides a computer-readable storage medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable storage medium carries one or more programs, which, when executed by the device, enable the device to perform the following functions: acquiring an attack state graph corresponding to a target network system, the attack state graph including nodes and edges connecting the nodes, nodes representing possible host states, service states, vulnerability states, and permission states in the target network system, and edges representing executable actions that can trigger state transitions; each edge corresponds to an edge attribute, including action cost information, action risk information, and action gain value; determining the starting and ending state nodes for vulnerability detection in the attack state graph; searching the attack state graph to determine multiple candidate paths from the starting state node to the ending state node; determining the execution cost corresponding to each candidate path based on the edge attributes; selecting the target path with the lowest execution cost from the multiple candidate paths; and performing penetration testing on the target network system based on the target path to obtain penetration test results.

[0272] According to one aspect of this disclosure, a computer program product or computer program is provided, comprising computer program instructions stored in a computer-readable storage medium. The computer program instructions are read from the computer-readable storage medium, and a processor executes the computer program instructions to implement the methods provided in various optional implementations of the above embodiments.

[0273] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions of the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, or portable hard drive) and includes several computer program instructions to cause an electronic device (such as a server or terminal device) to execute the method according to the embodiments of this disclosure.

[0274] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0275] It should be understood that this disclosure is not limited to the detailed structures, drawing arrangements or implementations shown herein; rather, this disclosure is intended to cover various modifications and equivalent arrangements contained within the spirit and scope of the appended claims.

Claims

1. A test method characterized by, The method comprises: obtaining an attack state graph corresponding to a target network system, wherein the attack state graph comprises nodes and edges connecting the nodes, the nodes are used to represent host states, service states, vulnerability states and permission states that may exist in the target network system, and the edges are used to represent executable actions that can trigger state transitions; wherein each edge has an edge attribute, and the edge attribute comprises action cost information, action risk information and action obtainable value; determining a starting state node and a terminating state node for vulnerability detection in the attack state graph; searching the attack state graph to determine a plurality of candidate paths from the starting state node to the terminating state node; determining an execution cost corresponding to each candidate path based on the edge attribute; selecting a target path with the lowest execution cost from the plurality of candidate paths; performing penetration testing on the target network system based on the target path to obtain a penetration testing result.

2. The method of claim 1, wherein, The method further comprises: updating the edge attribute in the attack state graph based on the penetration testing result.

3. The method of claim 1, wherein, The method further comprises: performing action prediction processing on the attack state graph by a policy network to predict the probability of occurrence of actions corresponding to each edge in the attack state graph, and taking the probability as the weight of the edge; removing edges with a weight lower than a first threshold value in the attack state graph.

4. The method of claim 3, wherein, The method further comprises: updating the edge attribute in the attack state graph based on the penetration testing result; calculating a reward value corresponding to each candidate path based on the updated edge attribute; wherein the reward value is negatively correlated with the cost information and action risk information, and positively correlated with the action obtainable value; updating the parameters corresponding to the policy network based on the reward value.

5. The method of claim 1, wherein, Obtaining an attack state graph corresponding to a target network system comprises: scanning the target network system to obtain system information thereof; extracting host states, service states, vulnerability states and permission states based on the system information; wherein different states of the same host, service or vulnerability are represented by different nodes; abstracting each state extracted as a corresponding node; determining executable actions between nodes based on a preset action library; connecting two nodes with executable actions to generate the attack state graph, wherein one action corresponds to one edge.

6. The method of claim 1, wherein, The plurality of candidate paths comprises a first candidate path, which comprises a first node, a second node and a third node in sequence; there is a first edge between the first node and the second node and a second edge between the second node and the third node on the first candidate path; wherein determining an execution cost corresponding to each candidate path based on the edge attribute comprises: determining the execution cost of the action corresponding to the first edge according to the edge attribute of the first edge; determining the execution cost of the action corresponding to the second edge according to the edge attribute of the second edge; adding the execution cost of the action corresponding to the first edge and the execution cost of the action corresponding to the second edge to determine the execution cost corresponding to the first candidate path.

7. The method of claim 1, wherein, The action cost information includes time and / or hardware and software resources consumed by the action, the action risk information includes the possibility of triggering a protection device and the negative impact of detection, intrusion failure and system crash, and the action obtainable value includes permission information and / or intelligence value that can be obtained by the action.

8. The method of claim 1, wherein, The executable action includes at least one of a vulnerability exploit, lateral movement, information collection and privilege escalation operation.

9. A test device, characterized by The method comprises the steps of: An attack state graph acquisition module is configured to acquire an attack state graph corresponding to a target network system, wherein the attack state graph includes nodes and edges connecting the nodes, the nodes are used to represent host states, service states, vulnerability states and permission states that can exist in the target network system, and the edges are used to represent executable actions that can trigger state transitions; each edge corresponds to an edge attribute, and the edge attribute includes action cost information, action risk information and action obtainable value; A start node determination module is configured to determine a start state node and a termination state node of vulnerability detection in the attack state graph; A search module is configured to search the attack state graph to determine a plurality of candidate paths from the start state node to the termination state node; An execution cost determination module is configured to determine an execution cost corresponding to each candidate path based on the edge attribute; A target path determination module is configured to filter a target path with the lowest execution cost from the plurality of candidate paths; A penetration testing module is configured to perform penetration testing on the target network system based on the target path to obtain a penetration testing result.

10. An electronic device, comprising: The method comprises the steps of: A memory and a processor; The memory is configured to store computer program instructions; the processor is configured to invoke the computer program instructions stored in the memory to implement the test method according to any one of claims 1-8.

11. A computer-readable storage medium having stored thereon computer program instructions, wherein, The computer program instructions are executed by the processor to implement the test method according to any one of claims 1-8.

12. A computer program product comprising computer program instructions stored in a computer readable storage medium, characterized in that, The computer program instructions are executed by the processor to implement the method according to any one of claims 1-8.

Images