Penetration test intelligent scheduling method and system based on artificial intelligence

Abstract

The invention relates to the technical field of network information security and automatic penetration testing, in particular to a penetration testing intelligent scheduling method and system based on artificial intelligence. Comprising the following steps: S1, collecting asset fingerprint data of a target system and a preset test task template, and constructing an initial task dependence directed acyclic graph; s2, generating an initial scheduling instruction queue based on the initial task dependency directed acyclic graph, executing a detection task and capturing response state data of a target system in real time; s3, constructing a defense situation awareness model, and outputting a current defense activation state vector; s4, generating a reconstructed task execution graph based on the current defense activation state vector; s5, generating an adaptive scheduling instruction set based on the reconstructed task execution atlas; s6, completing penetration test task coverage of the target system; the problem that a traditional tool is easily intercepted and blocked by devices such as WAF and IPS due to a packet sending rule is effectively solved by constructing a defense early warning model containing a long short-term memory network.

Description

Technical Field

[0001] This invention relates to the fields of network information security and automated penetration testing technology, specifically to an intelligent scheduling method and system for penetration testing based on artificial intelligence. Background Technology

[0002] Currently, the penetration testing field uses a method based on preset scripts or fixed static scheduling. In this mode, test tasks are usually executed according to a predefined linear sequence or a simple task structure. After the system completes the initial asset identification, it issues standardized probe commands. However, with the evolution of dynamic defense mechanisms of target systems, static scheduling-based penetration testing schemes have encountered a series of bottlenecks and defects: traditional methods cannot capture the changes in the target system's response state during the testing process in real time, and it is difficult to identify the defense activation state triggered by probe behavior. This makes it easy to trigger the target system's protection mechanism when executing large-scale test tasks, resulting in the blocking of test IPs or interruption of chain tasks; static scheduling schemes cannot reconstruct the attack topology or adjust the attack rhythm in real time based on the target's defense feedback during execution; in complex network adversarial environments, it is difficult for the system to achieve a balance between improving the efficiency of vulnerability increment and maintaining testability. High-frequency probes are fast but easily overwhelmed, while low-frequency probes are stable but extremely inefficient; due to the lack of constructed task graph management, traditional testing processes are prone to invalid packet sending due to unmet preconditions; these unnecessary network traffic not only reduce the accuracy of test execution but also increase the risk of the target defense system capturing attack characteristics through correlation analysis; therefore, there is an urgent need for a solution to address the problems existing in the current technology.

[0003] The information disclosed in the background section above is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention discloses an intelligent scheduling method and system for penetration testing based on artificial intelligence. Specifically, the technical solution of this invention includes: An AI-based intelligent scheduling method for penetration testing includes: S1. Collect asset fingerprint data and preset test task templates of the target system. Based on the asset fingerprint data, analyze the service type and potential attack surface. Combine the logical dependencies in the preset test task templates to construct an initial task dependency directed acyclic graph. S2. Generate an initial scheduling instruction queue based on the initial task-dependent directed acyclic graph, execute the probe task and capture the response status data of the target system in real time. The response status data includes network latency timing, protocol status code distribution and connection reset frequency. S3. Construct a defense situation awareness model, which includes a temporal feature extraction layer and a state classification decision layer. Input the response state data into the defense situation awareness model and output the current defense activation state vector. S4. Based on the current defense activation state vector, calculate the concealment cost and blocking probability of task execution, and use the dynamic graph reconstruction algorithm to perform topological adjustment on the initial task-dependent directed acyclic graph to generate the reconstructed task execution graph. S5. Based on the reconstructed task execution graph, a multi-objective resource allocation strategy is adopted to dynamically adjust the concurrency weight and time slice interval of subsequent tasks and generate an adaptive scheduling instruction set. S6. Send the adaptive scheduling instruction set to the test execution engine to complete the penetration testing task coverage of the target system.

[0005] Preferably, S1 specifically includes: S11. Obtain the list of open ports, middleware version and operating system fingerprint of the target system through the cyberspace mapping engine to form asset fingerprint data; S12. Parse the preset test task template and extract the precursor conditions and subsequent outputs of each type of test task. The precursor conditions include necessary authentication tokens or environmental parameters. S13. Map each type of test task to a graph node, map the logical relationship between the predecessor condition and the successor output to a directed edge, and construct the initial task dependency directed acyclic graph. S14. Perform connectivity checks on the directed acyclic graph that the initial task depends on to ensure the logical path from the starting node to the ending node is complete and eliminate isolated nodes and circular dependencies.

[0006] Preferably, S3 specifically includes: S31. Perform sliding window sampling on the response status data to extract a time-series feature vector, wherein the time-series feature vector includes the average response delay, HTTP status code entropy value and proportion of non-standard protocol response packets within a preset time window. S32. Input the temporal feature vector into the temporal feature extraction layer of the defense situation awareness model, and use the long short-term memory network unit to extract the behavioral pattern features of the defense mechanism. S33. Input the behavioral pattern features into the state classification decision layer, and calculate the probability distribution of the target system in the current state of normal response, passive flow limiting or active blocking based on the pre-trained classifier. S34. Select the state corresponding to the maximum value in the probability distribution as the current defense activation state vector, wherein the vector includes the defense threshold level and the sensitivity coefficient.

[0007] Preferably, S4 specifically includes: S41. Construct a concealment cost function, using the sensitivity coefficient in the current defense activation state vector as a weighting factor, so that the calculated concealment cost value increases with the increase of the sensitivity coefficient. S42. Traverse the unexecuted nodes in the initial task-dependent directed acyclic graph and calculate the blocking probability of each node triggering the defense mechanism. S43. When the blocking probability exceeds a preset security threshold, a delayed waiting node is inserted between the node and its predecessor node, or the node is split into multiple sub-task nodes with a request frequency lower than a preset security frequency. S44. When a critical path is detected to be blocked, search for alternative paths or mark unreachable subgraphs, perform pruning operations, complete the topology update of the initial task-dependent directed acyclic graph, and generate the reconstructed task execution graph.

[0008] Preferably, S5 specifically includes: S51. Construct a resource allocation optimization objective function, wherein the value of the optimization objective function is calculated as the weighted difference between the number of vulnerabilities discovered per unit time and the number of times the defense mechanism is triggered; S52. A reinforcement learning agent model is used as the scheduling decision-maker, the state of the reconstructed task execution graph is used as the environmental observation value, and the number of concurrent threads and the request interval are used as the action space. S53. Calculate the immediate reward value based on the current defense activation state vector: a negative reward value is given in response to the detection of a defense blockade state; a positive reward value is given in response to the completion of the task and the failure to trigger a defense blockade state. S54. Update the parameters of the reinforcement learning agent model through the policy gradient algorithm, output the optimal combination of concurrent weights and time slice intervals at the current time, and generate an adaptive scheduling instruction set.

[0009] Preferably, S6 specifically includes: S61. Parse the adaptive scheduling instruction set and extract the atomic execution instructions containing the target address, payload type, execution time window and retry strategy; S62. Distribute atomic execution instructions in parallel through distributed agent nodes, and monitor the load status and health of each agent node; S63. Collect the execution results and send them back to step S2 to form a closed-loop feedback until all reachable nodes in the reconstructed task execution graph have been traversed.

[0010] Preferably, in step S4, the dynamic map reconstruction algorithm further includes: The system identifies parallel branches with the same successor node in the directed acyclic graph that the initial task depends on. When the defense status level triggered by any branch exceeds the preset parallel suppression threshold, the execution of the remaining parallel branches is automatically suspended until the defense status level drops below the preset parallel suppression threshold to prevent the associated triggering of the defense mechanism.

[0011] An intelligent scheduling system for penetration testing based on artificial intelligence includes the following modules: The asset graph construction module is used to collect asset fingerprint data and combine it with the test task template to construct an initial task dependency directed acyclic graph; The status monitoring and feedback module is used to perform probing tasks and capture response status data, including network latency and status code distribution, in real time. The defense situation awareness module is used to process response status data based on the defense situation awareness model and output the current defense activation state vector. The dynamic graph reconstruction module is used to adjust the task topology based on the defense activation state vector and generate a reconstructed task execution graph. The adaptive resource scheduling module is used to adjust the concurrency weights based on a multi-objective resource allocation strategy and generate an adaptive scheduling instruction set. The test execution control module is used to issue instruction sets and manage the entire lifecycle execution of test tasks.

[0012] Compared with the prior art, the present invention has the following beneficial effects: 1. By constructing a defense and early warning model that includes a long short-term memory network, the system can extract delay features from network latency, status code entropy, and protocol response. This allows for accurate identification of whether the target system is in a normal response, early warning and rate limiting, or active blocking state. Combined with a preset cost function and a dynamic graph reconstruction algorithm, the system can automatically insert delays or split subtasks between tasks when the blocking probability exceeds a threshold, ensuring that the detected traffic characteristics are always below the defense detection threshold. This effectively solves the problem that traditional tools are easily intercepted and blocked by WAF, IPS, and other devices due to packet sending patterns.

[0013] 2. This invention utilizes directed acyclic graphs to logically model penetration tasks and introduces a dynamic graph reconstruction mechanism to achieve dynamic optimization and efficient pruning of penetration paths. During execution, the system can identify and handle situations where critical paths are blocked in real time. By automatically searching for alternative paths or performing pruning operations on unreachable subgraphs, it can prevent modification mechanisms from triggering defenses and causing the overall task to be associated and closed for complex branches. This ensures that the test task can find the optimal execution path in complex logical dependencies, greatly improving the penetration efficiency of complex asset environments.

[0014] 3. Resource scheduling labeling and adaptive balancing: The system introduces a scheduling decision-maker based on a reinforcement learning agent model, transforming the penetration testing process into an optimization objective of a policy gradient algorithm. A multi-objective weighted function is established between "number of vulnerability discoveries" and "number of defense triggers." By learning initial environmental values ​​in real time, the system can automatically output the current mainstream time weights and time slice interval combinations. Without manual intervention, it can autonomously find the golden balance between detection efficiency and deployment under different network bandwidths and defense strengths. This adaptive scheduling capability shifts penetration testing from manual configuration to an AI-driven "autonomous driving" mode.

[0015] 4. By integrating the cyberspace mapping engine and distributed agent nodes, the entire lifecycle of task execution was determined with closed-loop and deep coverage. The system achieved closed-loop management from asset extraction and task template mapping to atomic instruction allocation. The global architecture not only enhanced the system's load balancing capabilities but also ensured that instruction execution results were fed back to the scheduling engine in real time for topology updates through health monitoring. This achieved a continuous feedback closed-loop mechanism, ensuring that all nodes in the reconstructed graph were fully covered. This eliminated common missed detections and logical blind spots in traditional penetration testing, providing a more rigorous and comprehensive security assessment for the target system. Attached Figure Description

[0016] The present invention will be further explained below with reference to the accompanying drawings and embodiments: Figure 1 This is a flowchart of the method of the present invention.

[0017] Figure 2 This is a system structure diagram of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0019] Example 1: Please see Figure 1An AI-based intelligent scheduling method for penetration testing includes: S1, collecting asset fingerprint data and preset test task templates from the target system; analyzing service types and potential attack surfaces based on the asset fingerprint data; and constructing an initial task dependency directed acyclic graph (DAG) based on the logical dependencies in the preset test task templates; S2, generating an initial scheduling instruction queue based on the initial task dependency DAG, executing probe tasks, and capturing the target system's response status data in real time, including network latency timing, protocol status code distribution, and connection reset frequency; and S3, constructing a defense situation awareness model, which includes time-series feature extraction. The layer and state classification decision layer input response state data into the defense situation awareness model and output the current defense activation state vector; S4, based on the current defense activation state vector, calculate the concealment cost and blocking probability of task execution, and use a dynamic graph reconstruction algorithm to adjust the topology of the initial task-dependent directed acyclic graph to generate a reconstructed task execution graph; S5, based on the reconstructed task execution graph, use a multi-objective resource allocation strategy to dynamically adjust the concurrency weight and time slice interval of subsequent tasks to generate an adaptive scheduling instruction set; S6, send the adaptive scheduling instruction set to the test execution engine to complete the penetration test task coverage of the target system; This embodiment elaborates on the execution logic of the above-mentioned AI-based intelligent scheduling method for penetration testing; The system executes step S1. During this process, asset fingerprint data refers to the set of information that can uniquely identify the hardware and software characteristics of the target system. The source is the detection results of the cyberspace mapping engine. Its physical meaning is to limit the attack surface range to avoid invalid detection. The initial task relies on a directed acyclic graph as the core data structure. The nodes in the graph represent specific atomic test tasks, and the directed edges represent the data flow between tasks or the execution preconditions, ensuring that the test tasks strictly follow the business logic order. The system executes step S2, in which response status data serves as sensor data to detect the target's defensive posture, network latency timing is used to analyze target load jitter, protocol status code distribution is designed to detect redirection behavior, and connection reset frequency directly reflects TCP layer blocking behavior. In step S3, the defense activation state vector serves as a quantitative indicator, transforming the ambiguous concept of being intercepted into a computable mathematical vector, providing input for subsequent modeling. Based on this, step S4 realizes the transformation from static planning to dynamic game. The dynamic graph reconstruction algorithm modifies the graph structure without destroying the integrity of the task logic, and automatically inserts delayed nodes or disassembles aggregated scan nodes when high risk is detected. The resource allocation strategy in step S5 no longer blindly pursues speed, but rather maximizes the vulnerability output per unit of concealment cost; step S6 ensures that the adaptive scheduling instruction set is executed accurately, completing the closed loop. In complex network attack and defense environments, this embodiment solves the problem that traditional static scheduling cannot cope with the dynamic defense mechanisms of the target system by introducing a defense situation awareness and dynamic graph reconstruction mechanism. The system can perceive the defense sentiment of the target system in real time and adaptively adjust the attack rhythm, effectively avoiding IP blocking and test interruption caused by large-scale triggering of defense mechanisms, and ensuring the integrity of the test task chain in complex business logic scenarios.

[0020] Example 2: S1 specifically includes: S11, obtaining the open port list, middleware version, and operating system fingerprint of the target system through a network space mapping engine to form asset fingerprint data; S12, parsing the preset test task template, extracting the precursor conditions and successor outputs of each type of test task, with precursor conditions including necessary authentication tokens or environment parameters; S13, mapping each type of test task to graph nodes, mapping the logical association between precursor conditions and successor outputs to directed edges, and constructing an initial task dependency directed acyclic graph; S14, performing connectivity detection on the initial task dependency directed acyclic graph to ensure the logical path from the starting node to the ending node is complete, and eliminating isolated nodes and circular dependencies; This embodiment is a further specification of the asset and task logical graph mapping process in step S1, based on embodiment 1. In step S11, the cyberspace mapping engine uses a combination of active and passive detection methods to acquire fingerprint data. This data is the basis for subsequent pruning. In response to the fingerprint display target being a Linux system, the system will automatically remove test task nodes targeting Windows IIS vulnerabilities when generating DAG. The preset test task template parsed in step S12 is a standardized POC description file. The prerequisites define the necessary inputs for starting the task, and the subsequent outputs define the data provided after the task is successful. Step S13 executes the graph theory mapping algorithm: The system traverses the asset fingerprints obtained in S11. If the fingerprint contains the label Apache2.4.x, it extracts all atomic tests whose predecessor conditions contain this label from the rule base and instantiates them as tasks. and respond to the node The input parameters belong to the node Given the output set, construct directed edges; Step S14 detects loops using a topology sorting algorithm and processes isolated nodes, i.e. dead tasks that cannot meet the preconditions, through reachability analysis, removing them from the graph or marking them as non-executable. This embodiment transforms unstructured test scripts into structured DAG graphs and performs connectivity preprocessing, ensuring the logical executability of the penetration testing process from a mathematical perspective, eliminating invalid packet sending caused by missing dependencies, and reducing the background noise detected by the target defense mechanism.

[0021] Example 3: S3 specifically includes: S31, performing sliding window sampling on the response status data to extract a temporal feature vector, which includes the average response latency, HTTP status code entropy, and proportion of non-standard protocol response packets within a preset time window; S32, inputting the temporal feature vector into the temporal feature extraction layer of the defense situation awareness model, and using long short-term memory network units to extract behavioral pattern features of the defense mechanism; S33, inputting the behavioral pattern features into the state classification decision layer, and calculating the probability distribution of the target system currently in a normal response, passive rate limiting, or active blocking state based on a pre-trained classifier; S34, selecting the state corresponding to the maximum value in the probability distribution as the current defense activation state vector, which includes the defense threshold level and sensitivity coefficient; This embodiment is a further specification of step S3, the data processing and reasoning logic of the defense situation awareness model, based on embodiment 1; step S31 introduces HTTP status code entropy values. To quantify the discreteness of the target response, and to prevent the logarithmic operation from being meaningless due to a certain status code having a frequency of 0 within the sampling window, the improved calculation formula is as follows:

[0022] in, To introduce a smoothing factor, the value is set to... ; For the first The probability of a status code appearing within the window; This represents the total number of status code types captured within the preset window. Corrections: Simultaneously, construct time-series feature vectors. ,in The normalized average response delay, This is the HTTP status code entropy value. This represents the proportion of non-standard protocol response packets, calculated as the ratio of the number of non-standard protocol packets within the current sliding window to the total number of response packets. The calculation formula uses a nonlinear compression function:

[0023] in This represents the average response time within the current sliding window. As a baseline delay; through this mapping, ensure Limited to Within the interval, to avoid feature vector imbalance caused by long-tailed delay data due to network jitter; step S32 uses a long short-term memory network to process sequence data. Calculate the hidden state vector To capture the evolution of defense patterns over time; step S33 calculates the probability distribution based on the fully connected layer and the Softmax function: , in, This is the weight matrix of the classifier; For bias vectors, These correspond to the probabilities of three states: normal, rate limiting, and blocked, respectively. Step S34: Output the current defense activation state vector Among them: defense threshold level Select the index mapping value corresponding to the maximum value in the probability distribution. The specific modification of the mapping logic is as follows: when the maximum probability is... hour, When the maximum probability is hour, When the maximum probability is hour, ;when When the sensitivity coefficient is reached, the corresponding defense logic is triggered. The calculation formula is:

[0024] in, As a reference delay, This represents the average response time within the current sliding window. r is the preset sensitivity weighting coefficient. t This represents the proportion of non-standard protocol response packets within the current sliding window; this formula ensures The non-linear increase in latency and the proportion of abnormal packets characterizes the target's attention to the current attack source; This embodiment utilizes LSTM to process multidimensional temporal features and maps the output probability of the neural network into physical quantities that can be used for subsequent control logic through explicit mathematical transformations. and This solves the problem of how difficult it is to quantify the defensive status.

[0025] Example 4: S4 specifically includes: S41, constructing a concealment cost function, using the sensitivity coefficient in the current defense activation state vector as a weighting factor, so that the calculated concealment cost value increases with the increase of the sensitivity coefficient; S42, traversing the unexecuted nodes in the initial task-dependent directed acyclic graph, and calculating the blocking probability of each node triggering the defense mechanism; S43, when the blocking probability exceeds the preset security threshold, inserting a delayed waiting node between the node and its predecessor node, or splitting the node into multiple sub-task nodes with a request frequency lower than the preset security frequency; S44, when the critical path is detected to be blocked, searching for alternative paths or marking unreachable subgraphs, performing pruning operations, completing the topology update of the initial task-dependent directed acyclic graph, and generating the reconstructed task execution graph; In S4, the dynamic graph reconstruction algorithm also includes: identifying parallel branches with the same successor node in the directed acyclic graph that the initial task depends on; when the defense state level triggered by any branch exceeds the preset parallel suppression threshold, the execution of the remaining parallel branches is automatically suspended until the defense state level drops below the preset parallel suppression threshold to prevent the associated triggering of the defense mechanism. This embodiment refines step S4 based on embodiment 1, and, in conjunction with a parallel branch suppression strategy, elucidates the mathematical principles of dynamic graph modification and reconstruction; it also addresses the hidden costs. The calculation formula is a dimensionless weighted form to solve the problem of directly adding time dimensions and constant terms: Step S41 defines the cost of task concealment. The formula is as follows:

[0026] in, For the current task node v i The inherent characteristic intensity, A preset upper limit for the intensity of the inherent characteristics of the task; Used as the base time; This is the time interval between the most recent request from this task node, used to measure the instantaneous change in the probe frequency; These are preset bias terms used to trace background issues in the test environment. Step S42 calculates the blocking probability based on the logistic regression model:

[0027] in, For the Sigmoid function, The weight coefficients of the logistic regression model represent the current defense threshold level. With bias constant It is through a pre-built labeled dataset Obtained through training; where the feature vector The hidden costs of including historical test tasks Compared to the defense threshold level at that time , This indicates whether the task was intercepted by the target system; the training process aims to minimize the binary cross-entropy loss function. To optimize the objective, among which, These are the model's predicted values. The ground truth value of the actual interception state is used to iteratively update the parameters using the stochastic gradient descent algorithm until convergence; Step S43 performs atlas deformation: when When, if node For a scalable scanning task, split it into... There are child nodes, among which... For the current node The probability of triggering the defense mechanism and causing a block. To preset a safety threshold, If it cannot be separated, then in Pre-insertion delay node Delay duration ;in, This is the default time decay factor, in units of This ensures that the calculation results have a time dimension; its physical meaning is the rate constant of the natural recovery of the target system's defense sensitivity over time, ensuring... The calculation results have practical guiding significance for implementation; The parameters involved in this process are defined as follows: The source is the task metadata, and its physical meaning is the request frequency of the original task; The source is the security policy configuration, and its physical meaning is the upper limit of the security frequency. The source is a preset decay constant, used to adjust the growth rate of the delay duration; Simultaneously, the system implements a parallel suppression strategy: identifying sets of parallel branches in the DAG that have the same successor node or belong to the same IP domain. Real-time monitoring of global status ;when And branches During execution, the system sends data to the collection. All other untriggered branches send a SUSPEND signal, locking their execution threads and negotiating. The value falls back below the safety threshold; in step S44, when the critical path is blocked, a depth-first search is used to find an alternative path, and if there is no alternative path, the subgraph is pruned. This embodiment transforms abstract security games into concrete graph theory operations through mathematical concealment cost control and instant graph configuration transformation; in particular, the parallel suppression mechanism breaks the correlation analysis logic of the defense system by sharing state locks, preventing WAF from triggering high-level blocking by aggregating different concurrent behavior features of the same source IP.

[0028] Example 5: S5 specifically includes: S51, constructing a resource allocation optimization objective function, the value of which is calculated as the weighted difference between the number of vulnerabilities discovered and the number of times defense mechanisms are triggered per unit time; S52, using a reinforcement learning agent model as the scheduling decision-maker, taking the state of the reconstructed task execution graph as the environmental observation value, and the number of concurrent threads and the request interval as the action space; S53, calculating the immediate reward value based on the current defense activation state vector: a negative reward value is given in response to the detection of a defense blocking state; a positive reward value is given in response to the completion of the task without triggering a defense blocking state; S54, updating the parameters of the reinforcement learning agent model through the policy gradient algorithm, outputting the optimal combination of concurrent weights and time slice intervals at the current moment, and generating an adaptive scheduling instruction set; This embodiment is a further specification of step S5, which is based on reinforcement learning and focuses on the resource scheduling strategy, in step S51, which is based on embodiment 1. :

[0029] The source is test execution feedback, representing the number of vulnerabilities discovered in this time step; The source is step S3, representing the number of times the defense mechanism alarm has been triggered; : is the indicator function, when the defense level Exceeding the lockdown threshold The value is 1 if the condition is met, otherwise it is 0. : is the preset positive weighting coefficient. This reflects a strategy that offers high rewards for discovering vulnerabilities but also incurs severe penalties for being blocked. Step S52 defines the state space for reinforcement learning. All state probabilities are normalized to a linear mapping. Intervals are defined to eliminate the influence of differences in the dimensions of different physical quantities; The CPU resource utilization of the current distributed agent node is used to characterize the load health of the execution end; where the current DAG completion degree is... The mathematical expression is:

[0030] in This refers to the set of nodes that have completed execution in the reconstructed task execution graph. The set of all reachable nodes in the graph. For nodes The preset computational overhead or task importance weight; after the graph reconstruction occurs, this value is recalculated based on the topology of the new graph; step S53 calculates the above. Step S54 employs the PPO algorithm, which maximizes the objective function. Update strategy network parameters :

[0031] In the formula This represents the expected value for a given time step; the parameters involved are defined as follows: The source is value network computing, and its physical meaning is action advantage function, which is used to evaluate the merits of an action relative to the average level. The source is the probability ratio of the old and new strategies; The source is the algorithm hyperparameter, and its physical meaning is the cutoff range to prevent the policy update step from being too large; the model outputs the optimal combination of concurrent weights and time slice intervals at the current moment to generate an adaptive scheduling instruction set. This embodiment uses reinforcement learning instead of manual rules, giving the scheduling system evolution capabilities; the system can... The feedback automatically converges to the optimal attack rhythm for a specific target, solving the balance problem of static strategies between high frequency being easily blocked and low frequency being inefficient.

[0032] Example 6: S6 specifically includes: S61, parsing the adaptive scheduling instruction set and extracting atomic execution instructions containing the target address, payload type, execution time window, and retry strategy; S62, distributing atomic execution instructions in parallel through distributed proxy nodes and monitoring the load status and health of each proxy node; S63, collecting execution results and sending them back to step S2 to form a closed-loop feedback until all reachable nodes in the reconstructed task execution graph have been traversed. This embodiment is a further specification of the closed-loop control at the execution level in step S6, based on embodiment 1. The atomic execution instructions parsed in step S61 contain explicit execution time windows, requiring the proxy nodes to send requests within a specified time, otherwise they will be invalidated, in order to cooperate with the time slice scheduling in S5. Step S62 uses distributed proxy nodes for parallel distribution and monitors the health of nodes in real time. Step S63 sends the execution results back to S2, triggering a new round of situational awareness, graph reconstruction and strategy optimization. If the results are not sent back, the system degenerates into an open-loop system until all reachable nodes have been traversed. This embodiment ensures that the upper-layer AI scheduling strategy can be accurately executed by the lower-layer execution engine through atomic instructions and time window constraints. At the same time, the distributed architecture guarantees the throughput in large-scale asset testing tasks and achieves precise synchronization between the strategy layer and the execution layer.

[0033] Example 7: Please see Figure 2 An AI-based intelligent scheduling system for penetration testing includes the following modules: an asset graph construction module, used to collect asset fingerprint data and combine it with test task templates to construct an initial task-dependent directed acyclic graph; a status monitoring and feedback module, used to execute probe tasks and capture response status data including network latency and status code distribution in real time; a defense situation awareness module, used to process response status data based on a defense situation awareness model and output the current defense activation state vector; a dynamic graph reconstruction module, used to adjust the task topology structure according to the defense activation state vector and generate a reconstructed task execution graph; an adaptive resource scheduling module, used to adjust concurrency weights based on a multi-objective resource allocation strategy and generate an adaptive scheduling instruction set; and a test execution control module, used to issue instruction sets and manage the entire lifecycle execution of test tasks. This embodiment details the hardware architecture and functional modules of an AI-based penetration testing intelligent scheduling system. The asset graph construction module embeds a graph database, such as Neo4j, for storing and querying large-scale task dependencies. The status monitoring and feedback module is deployed at the network egress point, employing bypass traffic analysis technology to extract TCP / HTTP header information in real time and calculate the status code entropy and latency data required for S3. The defense situation awareness module integrates a pre-trained LSTM neural network chip or computing unit, providing millisecond-level defense status inference. The dynamic graph reconstruction module, as the system's logical hub, maintains a dynamic DAG in memory and performs addition, deletion, and modification operations on the DAG in real time based on input. The adaptive resource scheduling module runs a reinforcement learning agent, periodically extracting task subsets from the reconstructed graph and allocating optimal concurrency parameters. The test execution control module is responsible for underlying Socket connection management, payload sending, and receiving the original response. This embodiment decouples the three dimensions of perception, decision-making, and execution through modular design. In particular, it modularizes the graph construction and dynamic reconstruction, enabling the system to seamlessly switch attack paths in memory without stopping the testing task, thereby improving the system's stability and practical performance.

[0034] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A penetration testing intelligent scheduling method based on artificial intelligence, characterized in that, Includes the following steps: S1. Collect asset fingerprint data and preset test task templates of the target system. Based on the asset fingerprint data, analyze the service type and potential attack surface. Combine the logical dependencies in the preset test task templates to construct an initial task dependency directed acyclic graph. S2. Generate an initial scheduling instruction queue based on the initial task-dependent directed acyclic graph, execute the probe task and capture the response status data of the target system in real time. The response status data includes network latency timing, protocol status code distribution and connection reset frequency. S3. Construct a defense situation awareness model, which includes a temporal feature extraction layer and a state classification decision layer. Input the response state data into the defense situation awareness model and output the current defense activation state vector. S4. Based on the current defense activation state vector, calculate the concealment cost and blocking probability of task execution, and use the dynamic graph reconstruction algorithm to perform topological adjustment on the initial task-dependent directed acyclic graph to generate the reconstructed task execution graph. S5. Based on the reconstructed task execution graph, a multi-objective resource allocation strategy is adopted to dynamically adjust the concurrency weight and time slice interval of subsequent tasks and generate an adaptive scheduling instruction set. S6. Send the adaptive scheduling instruction set to the test execution engine to complete the penetration testing task coverage of the target system.

2. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 1, characterized in that, S1 specifically includes: S11. Obtain the list of open ports, middleware version and operating system fingerprint of the target system through the cyberspace mapping engine to form asset fingerprint data; S12. Parse the preset test task template and extract the precursor conditions and subsequent outputs of each type of test task. The precursor conditions include necessary authentication tokens or environmental parameters. S13. Map each type of test task to a graph node, map the logical relationship between the predecessor condition and the successor output to a directed edge, and construct the initial task dependency directed acyclic graph. S14. Perform connectivity checks on the directed acyclic graph that the initial task depends on to ensure the logical path from the starting node to the ending node is complete and eliminate isolated nodes and circular dependencies.

3. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 2, characterized in that, S3 specifically includes: S31. Perform sliding window sampling on the response status data to extract a time-series feature vector, wherein the time-series feature vector includes the average response delay, HTTP status code entropy value and proportion of non-standard protocol response packets within a preset time window. S32. Input the temporal feature vector into the temporal feature extraction layer of the defense situation awareness model, and use the long short-term memory network unit to extract the behavioral pattern features of the defense mechanism. S33. Input the behavioral pattern features into the state classification decision layer, and calculate the probability distribution of the target system in the current state of normal response, passive flow limiting or active blocking based on the pre-trained classifier. S34. Select the state corresponding to the maximum value in the probability distribution as the current defense activation state vector, wherein the vector includes the defense threshold level and the sensitivity coefficient.

4. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 3, characterized in that, S4 specifically includes: S41. Construct a concealment cost function, using the sensitivity coefficient in the current defense activation state vector as a weighting factor, so that the calculated concealment cost value increases with the increase of the sensitivity coefficient. S42. Traverse the unexecuted nodes in the initial task-dependent directed acyclic graph and calculate the blocking probability of each node triggering the defense mechanism. S43. When the blocking probability exceeds a preset security threshold, a delayed waiting node is inserted between the node and its predecessor node, or the node is split into multiple sub-task nodes with a request frequency lower than a preset security frequency. S44. When a critical path is detected to be blocked, search for alternative paths or mark unreachable subgraphs, perform pruning operations, complete the topology update of the initial task-dependent directed acyclic graph, and generate the reconstructed task execution graph.

5. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 4, characterized in that, S5 specifically includes: S51. Construct a resource allocation optimization objective function, wherein the value of the optimization objective function is calculated as the weighted difference between the number of vulnerabilities discovered per unit time and the number of times the defense mechanism is triggered; S52. A reinforcement learning agent model is used as the scheduling decision-maker, the state of the reconstructed task execution graph is used as the environmental observation value, and the number of concurrent threads and the request interval are used as the action space. S53. Calculate the immediate reward value based on the current defense activation state vector: a negative reward value is given in response to the detection of a defense blockade state; a positive reward value is given in response to the completion of the task and the failure to trigger a defense blockade state. S54. Update the parameters of the reinforcement learning agent model through the policy gradient algorithm, output the optimal combination of concurrent weights and time slice intervals at the current time, and generate an adaptive scheduling instruction set.

6. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 5, characterized in that, S6 specifically includes: S61. Parse the adaptive scheduling instruction set and extract the atomic execution instructions containing the target address, payload type, execution time window and retry strategy; S62. Distribute atomic execution instructions in parallel through distributed agent nodes, and monitor the load status and health of each agent node; S63. Collect the execution results and send them back to step S2 to form a closed-loop feedback until all reachable nodes in the reconstructed task execution graph have been traversed.

7. The intelligent scheduling method for penetration testing based on artificial intelligence according to claim 1, characterized in that, In S4, the dynamic map reconstruction algorithm further includes: The system identifies parallel branches with the same successor node in the directed acyclic graph that the initial task depends on. When the defense status level triggered by any branch exceeds the preset parallel suppression threshold, the execution of the remaining parallel branches is automatically suspended until the defense status level drops below the preset parallel suppression threshold to prevent the associated triggering of the defense mechanism.

8. An AI-based intelligent scheduling system for penetration testing, applied to any one of the AI-based intelligent scheduling methods for penetration testing as described in claims 1 to 7, characterized in that, Includes the following modules: The asset graph construction module is used to collect asset fingerprint data and combine it with the test task template to construct an initial task dependency directed acyclic graph; The status monitoring and feedback module is used to perform probing tasks and capture response status data, including network latency and status code distribution, in real time. The defense situation awareness module is used to process response status data based on the defense situation awareness model and output the current defense activation state vector. The dynamic graph reconstruction module is used to adjust the task topology based on the defense activation state vector and generate a reconstructed task execution graph. The adaptive resource scheduling module is used to adjust the concurrency weights based on a multi-objective resource allocation strategy and generate an adaptive scheduling instruction set. The test execution control module is used to issue instruction sets and manage the entire lifecycle execution of test tasks.

Images