Interactive penetration testing method and device based on dynamic graph evolution

Abstract

The invention provides an interactive penetration test method and device based on dynamic graph evolution, and the method comprises the following steps: S1, generating a root node of a dynamic attack graph based on the target information of a penetration test task, and enabling an intelligent agent to generate at least one attack action based on the effective network assets of the root node; s2, executing S3 on the attack action of which the execution risk value is not greater than the risk threshold value; executing S4 on the attack action of which the execution risk value is greater than the risk threshold value; s3, when the attack action is successfully executed, generating a child node, generating at least one attack action based on the effective network assets of the child node, and repeating S2; when the attack action fails to be executed, pruning operation is executed; s4, replacing the attack action with the replacement action, and executing S3; and S5, after the penetration test task is completed, generating a penetration test report. According to the scheme, the dynamic attack state atlas is constructed, and the penetration test process is modeled into topological mapping of the state snapshots, so that full-automatic penetration test is realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to an interactive penetration testing method and apparatus based on dynamic graph evolution. Background Technology

[0002] As enterprises continue to deepen their digital transformation, the widespread application of architectures such as microservices and cloud-native technologies has blurred the boundaries of modern network assets, leading to an exponential increase in system complexity and dynamism, and a significant expansion of the attack surface. Against this backdrop, penetration testing, as a key means of proactively assessing network system security and discovering potential vulnerabilities, has become a core component of cybersecurity assurance systems.

[0003] Existing penetration testing techniques have undergone several stages of development: early on, they relied on security experts manually operating discrete tools such as port scanners and vulnerability scanners; subsequently, they evolved into a playbook-based automated execution model based on Security Orchestration Automation and Response (SOAR) technology; in recent years, the industry has begun to introduce Large Language Models (LLM) as agent-assisted decision-making to further enhance the intelligence level of the technology. Despite the continuous improvement in automation and intelligence, existing solutions still face three major technical bottlenecks that urgently need to be addressed when facing complex, dynamic, and large-scale network environments, severely restricting the effectiveness and security of penetration testing.

[0004] First, the high cognitive load leads to a "human-machine comprehension gap." Current mainstream automated penetration testing systems mostly use "black-box execution" or "linear log stacking" to present the testing process. As the test progresses, massive amounts of unstructured logs, alerts, and fragmented clues are generated. Security experts must spend considerable effort manually sorting and correlating this information to reconstruct the attack surface, action topology, and potential attack paths. This information presentation method is severely incompatible with the structured, global cognitive patterns of humans, making it difficult for testers to quickly establish a global situational awareness and significantly reducing the efficiency of analysis, decision-making, and incident response.

[0005] Secondly, the rigid risk control mechanisms make it difficult to balance testing efficiency and business security. Existing solutions present a polarized dilemma: fully automated tools employ static and coarse-grained risk strategies, lacking awareness of dynamic environmental attributes such as business time periods and asset importance, making high-risk operations prone to disrupting critical business operations; while solutions relying on manual expert control or unadjusted LLM risk assessments are overly conservative in mitigating risks, frequently interrupting processes without justification or over-relying on human decision-making, resulting in fragmented testing processes and low automation efficiency. Currently, there is a lack of an intelligent control mechanism that can achieve an adaptive balance between "testing efficiency" and "business security" based on multi-dimensional dynamic context.

[0006] Third, large language models suffer from insufficient long-range reasoning capabilities and context forgetting issues. While LLM-based penetration testing systems excel in understanding and generating single-step instructions, they are limited by the length of the context window. As the number of test rounds increases, they gradually forget early key clues (such as default password rules and internal domain name patterns), which are crucial for deep attacks. At the same time, pure AI systems lack the intuition and experience of human experts, making it difficult to discover seemingly unrelated but logically interconnected clues. This can easily lead to the attack chain getting stuck due to reasoning gaps, causing the automation process to stall prematurely.

[0007] In summary, existing technologies have significant shortcomings in penetration testing in complex network environments, particularly in terms of situational awareness, adaptive risk control, and human-machine intelligent integration. An innovative solution is urgently needed to overcome these technical bottlenecks. Summary of the Invention

[0008] This application provides an interactive penetration testing method and apparatus based on dynamic graph evolution. By constructing a dynamic attack state graph, the penetration testing process is modeled as a topological mapping of state snapshots, thereby achieving fully automated penetration testing.

[0009] In a first aspect, embodiments of this application provide an interactive penetration testing method based on dynamic map evolution, the method comprising:

[0010] S1: Generate the root node of a dynamic attack graph based on the target information of the penetration test task, and generate at least one attack action based on the valid network assets of the root node. S2: Calculate the execution risk value of each attack action based on its own attributes, network segment range, and risk radius. For attack actions with execution risk values ​​not greater than the risk threshold, execute S3; for attack actions with execution risk values ​​greater than the risk threshold, execute S4. S3: Execute the attack action. When the attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node, and repeats S2. When the attack action fails to execute, a pruning operation is performed based on the current attack action. S4: Obtain alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value less than the current attack action, replace the attack action with the alternative actions, and execute S3. S5: When the penetration test task is completed or there are no more attack actions to perform, end the iteration and generate a penetration test report based on the dynamic attack graph.

[0011] Secondly, embodiments of this application provide an interactive penetration testing device based on dynamic map evolution, comprising: The generation module generates the root node of a dynamic attack graph based on the target information of the penetration test task, and the agent generates at least one attack action based on the valid network assets of the root node. The risk calculation module calculates the execution risk value of each attack action based on its own attributes, the network segment range it belongs to, and the risk radius. The action execution module processes attack actions whose execution risk value is not greater than the risk threshold, and the replacement module processes attack actions whose execution risk value is greater than the risk threshold. The action execution module executes attack actions. When an attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node and repeatedly executes the risk calculation module. When an attack action fails to execute, a pruning operation is performed based on the current attack action. The replacement module retrieves alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value lower than the current attack action. The alternative actions replace the attack actions, and the action execution module is then executed. The report generation module is used to end the iteration when the penetration test task is completed or there are no more attack actions to be performed, and to generate a penetration test report based on the dynamic attack graph.

[0012] Thirdly, embodiments of this application provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute an interactive penetration testing method based on dynamic graph evolution.

[0013] Fourthly, embodiments of this application provide a readable storage medium storing a computer program, which, when executed by a processor, implements an interactive penetration testing method based on dynamic graph evolution.

[0014] The main contributions and innovations of this invention are as follows: This application's embodiments model the penetration testing process as a dynamic attack graph, where each node represents a stable state and encapsulates the full context, asset clues, and subsequent plans. The graph intuitively maps the dynamic changes of the attack surface through the real-time creation, connection, and pruning of nodes. Before executing the attack plan, this application's embodiments dynamically assess the risk of the attack action based on its own attributes, network segment range, and risk radius, automatically triggering equivalent strategy optimization to search for low-risk alternative paths, rather than simply terminating the process. When no alternative path is available, control is automatically returned to the user. When a blocked node appears, this application's embodiments receive user-specified historical clues and natural language intent, fuse them with the current machine context to generate an enhanced context, and regenerate the attack action accordingly, overcoming the limitations of intelligent agent reasoning with human intuition.

[0015] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0016] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating an interactive penetration testing method based on dynamic graph evolution according to an embodiment of this application; Figure 2 This is a schematic diagram of the visualization result of a dynamic attack graph according to an embodiment of this application; Figure 3 This is a flowchart illustrating an attack based on the execution risk value of an attack action, according to an embodiment of this application. Figure 4 This is a schematic diagram illustrating an attack action generated based on a blocked node, according to an embodiment of this application. Figure 5 This is a structural block diagram of a data entry device according to an embodiment of this application; Figure 6 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0017] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0018] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0019] Example 1 This application provides an interactive penetration testing method based on dynamic graph evolution. By constructing a dynamic attack state graph, the penetration testing process is modeled as a topological mapping of state snapshots, thereby achieving fully automated penetration testing. Specifically, refer to... Figure 1 The method includes: S1: Generate the root node of a dynamic attack graph based on the target information of the penetration test task, and generate at least one attack action based on the valid network assets of the root node. S2: Calculate the execution risk value of each attack action based on its own attributes, network segment range, and risk radius. For attack actions with execution risk values ​​not greater than the risk threshold, execute S3; for attack actions with execution risk values ​​greater than the risk threshold, execute S4. S3: Execute the attack action. When the attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node, and repeats S2. When the attack action fails to execute, a pruning operation is performed based on the current attack action. S4: Obtain alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value less than the current attack action, replace the attack action with the alternative actions, and execute S3. S5: When the penetration test task is completed or there are no more attack actions to perform, end the iteration and generate a penetration test report based on the dynamic attack graph.

[0020] In some specific embodiments, the target information of the penetration test task is manually defined, such as the target IP address, domain name or network segment range, and the test intensity, risk preference and other settings of the target information of the penetration test task are configured to better achieve penetration testing of the target information.

[0021] In the current embodiment, each node in the dynamic attack graph is defined as a stable state reached during the penetration test, rather than a single instantaneous operation record. The node attributes of each stable state node encapsulate the current context, the effective network assets that have been accumulated, and the list of next attack actions deduced by the agent based on the current stable state node.

[0022] Furthermore, in the dynamic attack graph, the current node's state snapshot is obtained as a node attribute, wherein the node attribute includes: node ID, node state, valid network assets, list of next attack actions, lifecycle, upstream parent node ID and attack actions.

[0023] Specifically, the node ID is identified by Node_ID, which is of UUID data type. The node ID is a globally unique identifier for the node.

[0024] Specifically, the node state is identified by State_Type, which is of data type Enum. The node state indicates the stable state type of the penetration test represented by the node.

[0025] Specifically, valid network assets are identified by Asset_Pool, and the data type is List. Valid network asset nodes are the set of valid network assets that are deposited and inherited in the corresponding state.

[0026] Specifically, Action_Plans identifies the set of next attack actions, which is a List of data types. The set of next attack actions is a list of all potential next attack actions derived by the agent based on valid network assets.

[0027] Specifically, the lifecycle is identified by Node_Status, with data type Enum. The lifecycle indicates whether the current node belongs to one of the following lifecycles: Pending (pending processing / pending child node generation), Stable (stable / completed), Blocked (blocked / failed), or Pruned (pruned / invalid path).

[0028] For example, network assets include digital assets that can be exploited by attackers, such as IP addresses, port numbers, application fingerprints, credential hashes, and configuration files.

[0029] In the current embodiment, the attack actions ranked higher in the list of next attack actions for the current node are selected and executed sequentially.

[0030] In the current embodiment, the inherent attributes of the attack action represent the inherent attributes of the attack action itself related to the attack risk, the network segment range to which the attack action belongs represents the network segment range affected by the attack action, and the risk radius of the attack action represents the range of influence when the attack action is executed.

[0031] Furthermore, a basic risk score is calculated based on the attack action's inherent attributes, a dynamic environmental weight is obtained based on the network segment range, a risk radius prediction coefficient is obtained based on the attack action's risk radius, a prediction confidence factor is preset, and the basic risk score is adjusted using the dynamic environmental weight, the risk radius prediction coefficient, and the prediction confidence factor to obtain the execution risk value. The formula is expressed as follows:

[0032] Where R is the execution risk value, Basic risk score, For environmental dynamic weights, α is the prediction coefficient for the risk radius, and α is the prediction confidence factor.

[0033] For example, the inherent attributes of the attack action itself related to the attack risk include: the stage of the attack action in the attack chain, the read and write permissions of the attack action to system data and the scope of its impact, the computing resources expected to be occupied by the attack action, the impact of the attack action on the system environment, and the CVSS base score of the CVE vulnerability targeted by the attack action.

[0034] Specifically, Action_Category identifies the stage of the attack action in the attack chain, with different stages having different base risk weights.

[0035] Specifically, Data_Impact_Mode identifies the read and write permissions and scope of impact of the attack on system data.

[0036] Specifically, Resource_Cost is used to identify the computing resources that the attack is expected to consume, thereby assessing the impact on business availability.

[0037] Specifically, Irreversibility indicates the computing resources that the attack is expected to consume, and the Irreversibility Boolean value indicates whether the attack will cause permanent changes to the system that are difficult to recover after it is executed.

[0038] Specifically, CVSS_Reference identifies the base CVSS score of the CVE vulnerability targeted by the attack action. In other words, if the action targets a specific CVE vulnerability, the base CVSS score of that vulnerability is directly used as the base risk score.

[0039] In the current embodiment, before executing the attack action, a corresponding virtual prediction node is generated in the dynamic attack graph based on the agent. When the corresponding attack action is executed, the virtual prediction node changes its node state to a flashing state. When the corresponding attack action is successfully executed, the virtual prediction node is transformed into a child node and its node state is changed to a stable state. When the corresponding attack action fails, the virtual prediction node changes its node state to a failed state and performs a pruning operation on the corresponding virtual prediction node.

[0040] Specifically, to more intuitively demonstrate the entire penetration testing process, a dynamic attack graph is visualized. If a node is in a flashing state, it is displayed in a flashing manner, indicating that the system is attempting to migrate to that state. If a node is in a stable state, it means that the attack action corresponding to the node has been successfully executed, and the corresponding node is displayed in green. If a node is in a failed state, it means that the attack action corresponding to the node has failed, and the corresponding node is displayed in red.

[0041] Specifically, in the pruning operation, nodes in a failed state are disabled and all subsequent potential branches that logically depend on that node to continue extending are collapsed.

[0042] Specifically, by visualizing the dynamic attack graph, one can observe the color and connection patterns of nodes, thereby instantly establishing a global understanding of the current penetration progress. Figure 2 This is a schematic diagram of the visualization results of the dynamic attack graph.

[0043] In the current embodiment, the attack surface of the dynamic attack graph is defined as a logical boundary consisting of several key hub nodes (such as domain controller server nodes) with further expansion capabilities. When a probe path in the dynamic attack graph successfully breaches a specific key node, the graph will visually demonstrate the hierarchical leap of the penetration test from the current stage to the next stage.

[0044] Specifically, key hub nodes are essentially nodes in a dynamic attack graph, and their data structure is consistent with other ordinary nodes. However, compared to other ordinary nodes in the graph (such as simply scanning an open port), the successful acquisition of these key nodes signifies a breakthrough in the penetration testing process, such as successfully obtaining domain controller privileges, compromising the core database, or obtaining a jump server shell.

[0045] The timing of the creation of a critical hub node: Like all nodes, it is dynamically generated at runtime. When the system executes a specific attack action (such as vulnerability exploitation or credential verification) and returns a successful result, the system instantiates a new node based on the returned data (such as "obtained root privileges"). If the system determines that the node's state meets the criteria for a critical breach (such as identifying a domain controller IP), it marks it as a critical hub node.

[0046] For example, when a probe successfully breaches a specific critical node, it signifies a fundamental change in the attack surface, such as a leap from "Phase One," which only allows access to external web services, to "Phase Two," which grants core control over the internal network. The attack map, through the extension of the topology and the connection to specific nodes, transforms this abstract security domain crossing into a visual hierarchical progression, intuitively demonstrating that the penetration test has breached key defense boundaries and entered a deeper attack scenario.

[0047] In the current embodiment, when the execution risk value of an attack action is greater than the risk threshold, it indicates that the corresponding attack action is of high risk. In order to ensure that the penetration attack is not detected by the system, an alternative action with a semantic similarity greater than the set threshold and an execution risk value less than the current attack action is obtained from the attack action knowledge base to replace the attack action for execution. For example, if the attack action is "active brute-force attack" with an execution risk value greater than the risk threshold, then a search is performed in the attack action knowledge base, and "passive traffic sniffing" is used to replace "active brute-force attack".

[0048] Specifically, the attack action knowledge base is a pre-built database that stores all attack actions used in penetration testing tasks.

[0049] Furthermore, if there is no alternative action corresponding to the attack action in the attack action knowledge base, the execution of the attack action will be terminated.

[0050] Specifically, after terminating the attack action, the agent generates a decision brief including risk attribution and benefit prediction, and returns the decision brief to the user, who then decides whether to execute the corresponding attack action. The flowchart for the attack based on the risk value of the attack action is as follows: Figure 3 As shown.

[0051] In the current embodiment, a blocked node is a child node in the dynamic attack graph where all corresponding attack actions have failed. The agent generates at least one attack action based on the node attributes of the blocked node, specific clues in the historical asset list, and prompt words, and repeats S2.

[0052] Specifically, specific clues in the historical asset list are manually retrieved by the user from the historical asset list, and the prompts are written in natural language by the user.

[0053] Specifically, a diagram illustrating the generation of attack actions based on blocked nodes is shown below. Figure 4 As shown, in order to overcome the forgetting problem of agents in long-link reasoning, this scheme uses node attributes, specific clues in the historical asset list, and prompt words as external attention injections for agents, thereby correcting or guiding the reasoning direction of the model. For example, if the prompt word is "try to connect these clues for analysis", the agent will interpret this intention and transform it together with the selected clues and other information into new prompt words for the LLM to reason and give at least one new, specific, and executable attack action.

[0054] Specifically, this solution utilizes the intuitive and associative abilities of human experts to compensate for the blind spots of machine reasoning, enabling breakpoint resuming of complex attack paths, greatly improving the efficiency of penetration testing, and reducing the overhead of large models.

[0055] In the current embodiment, when the penetration test task is completed, it means that the penetration attack on the target has been completed. If there are no attack actions to be performed, it means that all paths in the dynamic attack graph have been explored. Therefore, the iteration ends and the penetration test is completed. A penetration test report is generated based on the dynamic attack graph. The penetration test report includes all tried paths, successful attack chains and blocked key points, and includes the node attributes and operation logs of each node for auditing and backtracking.

[0056] Example 2 Based on the same concept, referencing Figure 5 This application also proposes an interactive penetration testing device based on dynamic map evolution, comprising: The generation module generates the root node of a dynamic attack graph based on the target information of the penetration test task, and the agent generates at least one attack action based on the valid network assets of the root node. The risk calculation module calculates the execution risk value of each attack action based on its own attributes, the network segment range it belongs to, and the risk radius. The action execution module processes attack actions whose execution risk value is not greater than the risk threshold, and the replacement module processes attack actions whose execution risk value is greater than the risk threshold. The action execution module executes attack actions. When an attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node and repeatedly executes the risk calculation module. When an attack action fails to execute, a pruning operation is performed based on the current attack action. The replacement module retrieves alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value lower than the current attack action. The alternative actions replace the attack actions, and the action execution module is then executed. The report generation module is used to end the iteration when the penetration test task is completed or there are no more attack actions to be performed, and to generate a penetration test report based on the dynamic attack graph.

[0057] Example 3 This embodiment also provides an electronic device, see reference. Figure 6 It includes a memory 404 and a processor 402, wherein the memory 404 stores a computer program and the processor 402 is configured to run the computer program to perform the steps in any of the above method embodiments.

[0058] Specifically, the processor 402 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0059] Memory 404 may include a mass storage device for data or instructions. For example, and not limitingly, memory 404 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk drive, a magneto-optical disk drive, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 404 may include removable or non-removable (or fixed) media. Where appropriate, memory 404 may be internal or external to a data processing device. In a particular embodiment, memory 404 is non-volatile memory. In a particular embodiment, memory 404 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable read-only memory (PROM), an erasable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), an electrically alterable read-only memory (EAROM), or flash memory, or a combination of two or more of these. Where appropriate, the RAM can be Static Random-Access Memory (SRAM) or Dynamic Random-Access Memory (DRAM). DRAM can be Fast Page Mode Dynamic Random-Access Memory (FPMDRAM), Extended Data Out Dynamic Random-Access Memory (EDODRAM), Synchronous Dynamic Random-Access Memory (SDRAM), etc.

[0060] The memory 404 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 402.

[0061] The processor 402 reads and executes computer program instructions stored in the memory 404 to implement any of the interactive penetration testing methods based on dynamic map evolution in the above embodiments.

[0062] Optionally, the electronic device may further include a transmission device 406 and an input / output device 408, wherein the transmission device 406 is connected to the processor 402, and the input / output device 408 is connected to the processor 402.

[0063] The transmission device 406 can be used to receive or send data via a network. Specific examples of the network described above may include wired or wireless networks provided by the communication provider of the electronic device. In one example, the transmission device includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 406 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0064] Input / output device 408 is used to input or output information. In this embodiment, the input information may be target information of the penetration test task, and the output information may be attack actions, penetration test reports, etc.

[0065] Optionally, in this embodiment, the processor 402 can be configured to perform the following steps via a computer program: S1: Generate the root node of a dynamic attack graph based on the target information of the penetration test task, and generate at least one attack action based on the valid network assets of the root node. S2: Calculate the execution risk value of each attack action based on its own attributes, network segment range, and risk radius. For attack actions with execution risk values ​​not greater than the risk threshold, execute S3; for attack actions with execution risk values ​​greater than the risk threshold, execute S4. S3: Execute the attack action. When the attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node, and repeats S2. When the attack action fails to execute, a pruning operation is performed based on the current attack action. S4: Obtain alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value less than the current attack action, replace the attack action with the alternative actions, and execute S3. S5: When the penetration test task is completed or there are no more attack actions to perform, end the iteration and generate a penetration test report based on the dynamic attack graph.

[0066] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0067] Generally, various embodiments can be implemented in hardware or dedicated circuitry, software, logic, or any combination thereof. Some aspects of the invention can be implemented in hardware, while others can be implemented by firmware or software executed by a controller, microprocessor, or other computing device, but the invention is not limited thereto. Although various aspects of the invention may be shown and described as block diagrams, flowcharts, or using some other graphical representation, it should be understood that, by way of non-limiting example, these blocks, apparatuses, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or some combination thereof.

[0068] Embodiments of the present invention can be implemented by computer software, which may be executable by a data processor of a mobile device, such as a processor entity, or by hardware, or by a combination of software and hardware. Computer software or programs (also referred to as program products) including software routines, applets, and / or macros can be stored in any device-readable data storage medium, and they include program instructions for performing specific tasks. The computer program product may include one or more computer-executable components configured to perform the embodiments when the program is run. The one or more computer-executable components may be at least one piece of software code or a portion thereof. Additionally, it should be noted in this respect that, as Figure 6 Any box in the logical flow can represent a program step, or interconnected logic circuits, boxes and functions, or a combination of program steps and logic circuits, boxes and functions. Software can be stored on physical media such as memory chips or blocks of storage implemented within a processor, magnetic media such as hard disks or floppy disks, and optical media such as DVDs and their data variants, CDs, etc. The physical medium is a non-transient medium.

[0069] Those skilled in the art should understand that the technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0070] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An interactive penetration testing method based on dynamic map evolution, characterized in that, Includes the following steps: S1: Generate the root node of a dynamic attack graph based on the target information of the penetration test task, and generate at least one attack action based on the valid network assets of the root node. S2: Calculate the execution risk value of each attack action based on its own attributes, network segment range, and risk radius. For attack actions whose execution risk value is not greater than the risk threshold, execute S3. S4 is executed for attack actions whose risk value exceeds the risk threshold; S3: Execute the attack action. When the attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node, and repeats S2. When the attack action fails to execute, a pruning operation is performed based on the current attack action. S4: Obtain alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value less than the current attack action, replace the attack action with the alternative actions, and execute S3. S5: When the penetration test task is completed or there are no more attack actions to perform, end the iteration and generate a penetration test report based on the dynamic attack graph.

2. The interactive penetration testing method based on dynamic graph evolution according to claim 1, characterized in that, In the dynamic attack graph, the current node's state snapshot is obtained as a node attribute, which includes: node ID, node state, valid network assets, list of next attack actions, lifecycle, upstream parent node ID and attack actions.

3. The interactive penetration testing method based on dynamic map evolution according to claim 1, characterized in that, The inherent attributes of the attack action refer to the inherent attributes of the attack action itself related to the attack risk, the network segment range to which the attack action belongs refers to the network segment range affected by the attack action, and the risk radius of the attack action refers to the range of influence when the attack action is executed.

4. The interactive penetration testing method based on dynamic map evolution according to claim 1, characterized in that, A basic risk score is calculated based on the attack action's inherent attributes. Dynamic environmental weights are obtained based on the network segment range. A risk radius prediction coefficient is derived based on the attack action's risk radius. A prediction confidence factor is preset. The basic risk score is then adjusted using the dynamic environmental weights, the risk radius prediction coefficient, and the prediction confidence factor to obtain the execution risk value. The formula is as follows: Where R is the execution risk value, Basic risk score, For environmental dynamic weights, α is the prediction coefficient for the risk radius, and α is the prediction confidence factor.

5. The interactive penetration testing method based on dynamic graph evolution according to claim 1, characterized in that, Before executing an attack action, a corresponding virtual prediction node is generated in the dynamic attack graph based on the agent. When the corresponding attack action is executed, the virtual prediction node changes its state to a blinking state. When the corresponding attack action is successfully executed, the virtual prediction node is transformed into a child node and its state is changed to a stable state. When the corresponding attack action fails, the virtual prediction node changes its state to a failed state and performs a pruning operation on the corresponding virtual prediction node.

6. The interactive penetration testing method based on dynamic map evolution according to claim 1, characterized in that, If there is no alternative action corresponding to the attack action in the attack action knowledge base, the execution of the attack action will be terminated.

7. The interactive penetration testing method based on dynamic graph evolution according to claim 1, characterized in that, Using the child nodes in the dynamic attack graph where all corresponding attack actions fail to execute as blocked nodes, the agent generates at least one attack action based on the node attributes of the blocked node, specific clues in the historical asset list, and prompt words, and repeats S2.

8. An interactive penetration testing device based on dynamic map evolution, characterized in that, include: The generation module generates the root node of a dynamic attack graph based on the target information of the penetration test task, and the agent generates at least one attack action based on the valid network assets of the root node. The risk calculation module calculates the execution risk value of each attack action based on its own attributes, the network segment range it belongs to, and the risk radius. The action execution module processes attack actions whose execution risk value is not greater than the risk threshold. A replacement module is used to handle attack actions whose risk value exceeds the risk threshold; The action execution module executes attack actions. When an attack action is successfully executed, a child node is generated in the dynamic attack graph, and the corresponding attack action is used as the directed edge between the child node and the parent node. The agent generates at least one attack action based on the effective network assets of the child node and repeatedly executes the risk calculation module. When an attack action fails, pruning operations are performed based on the current attack action. The replacement module retrieves alternative actions from the attack action knowledge base that have a semantic similarity to the attack action greater than a set threshold and an execution risk value lower than the current attack action. The alternative actions replace the attack actions, and the action execution module is then executed. The report generation module is used to end the iteration when the penetration test task is completed or there are no more attack actions to be performed, and to generate a penetration test report based on the dynamic attack graph.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to execute an interactive penetration testing method based on dynamic map evolution as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The readable storage medium stores a computer program that, when executed by a processor, implements an interactive penetration testing method based on dynamic graph evolution as described in any one of claims 1-7.

Images