Automatic container penetration testing method and system based on large model agent

Abstract

The invention provides an automatic container penetration testing method and system based on a large model agent. The system comprises a core control node and a working node, the core control node comprises a user interaction module and an intelligent planning module, and the working node comprises an environment sensing module and a task execution module; the core control node initiates a connection request to the working node through a gRPC protocol and sends a serialized penetration test instruction; and the working node completes a penetration action according to the penetration test instruction, captures and packs a standard output log and an error log, and asynchronously returns the log to the core control node. The intelligent level of penetration testing is improved, and the limitation of a traditional static tool is broken through; the false alarm rate is obviously reduced, the test success rate is improved, and accurate strike in a dynamic environment is realized; the security of automatic testing is guaranteed, so that the system can flexibly adapt to a large-scale and cross-regional container cluster environment.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically, it relates to an automated penetration testing method and system for containers based on large model intelligent agents, and particularly to an automated penetration testing method and system for container environments that combines large language models (LLM) and distributed architecture in the fields of network security, virtualization technology and artificial intelligence. Background Technology

[0002] Container software applications based on virtualization technology are becoming increasingly common. With the popularization of cloud-native technologies, containerization technologies, represented by Docker and Kubernetes, have become the core paradigm of modern software development and deployment. However, the highly dynamic, transient, and distributed nature of container environments leads to a more complex and fragmented attack surface.

[0003] Existing container security assessment methods primarily rely on static scanning tools or rule-based runtime monitoring tools. These traditional techniques have the following significant limitations: 1. Lack of logical reasoning ability: Traditional tools can usually only identify known vulnerabilities or fixed abnormal behavior characteristics, and cannot understand complex attack logic that involves multiple stages and cross components.

[0004] 2. Inability to achieve automated closed loop: Most existing automation tools only stay at the "problem discovery" stage and lack the closed loop capability of "exploiting vulnerabilities - obtaining feedback - adjusting strategies" like human penetration testing experts.

[0005] 3. High reliance on manual intervention: Faced with massive alerts and complex attack paths, security experts still need to conduct a lot of manual verification and investigation, which is inefficient and costly.

[0006] In recent years, large language models have demonstrated powerful code understanding and logical reasoning capabilities, and agents based on large language models have the potential to simulate human thought processes for task planning. However, directly applying large language models to the highly sensitive field of container penetration testing still faces many challenges. For example, model illusions may lead to false positives, a lack of effective context awareness may cause test failures, and high-risk operations may be performed, resulting in irreversible damage to the production environment.

[0007] The patent document "A Penetration Testing Intelligent Agent System and Testing Method Driven by a Large Language Model" (CN119150912A) employs a task planning state machine, breaking down the task into a fixed set of controllable subtasks. State transitions occur according to predefined conditions. Logically, it divides the system into three units: memory, intelligence, and planning. However, it does not define the communication and interaction protocol between physical layer nodes in detail. It focuses on general detection results, primarily acquiring information through basic target probing.

[0008] The patent document "Framework for automated penetration testing" (US12287882B2) discloses a distributed application programming interface framework for penetration testing. It uses attack tree modeling to simulate attacker behavior, thereby enabling scalable and comprehensive system testing through a modular and programmatically configurable approach. However, it relies entirely on predefined attack tree configuration files, and the attack paths are fixed, requiring the logic to be pre-programmed manually or by script.

[0009] Both of the above technical solutions are general-purpose penetration testing solutions. The information they obtain is mainly general IPs, ports, and vulnerability descriptions. They lack in-depth automated perception and the ability to perform real-time autonomous reflection and dynamic logical correction based on environmental feedback during the testing process.

[0010] Therefore, there is a need for an automated penetration testing solution that can integrate environmental awareness, logical reasoning, and security control. Summary of the Invention

[0011] To address the shortcomings of existing technologies, the purpose of this invention is to provide an automated penetration testing method and system for containers based on large-scale intelligent agents.

[0012] The present invention provides an automated container penetration testing method based on a large model intelligent agent, comprising: a core control node and a working node.

[0013] The core control node includes a user interaction module and an intelligent planning module, and the working node includes an environmental perception module and a task execution module.

[0014] The user interaction module receives user commands, initializes the task context, and transmits it to the intelligent planning module.

[0015] The intelligent planning module drives the environmental perception module to scan the target environment according to the perception instructions, collect information, build an environmental state snapshot, and provide feedback. The intelligent planning module receives environmental state snapshots and combines them with perception data and vulnerability knowledge to generate penetration testing tasks; The task execution module generates attack instructions based on the penetration testing task and performs high-risk rule matching. After passing the verification or obtaining authorization, the attack instructions are executed and the execution results are captured. The intelligent planning module receives and analyzes the execution results. If the goal is not achieved, it dynamically modifies the penetration testing task until the preset goal is achieved or the test stops after traversing all paths. The user interaction module displays the final execution result of the task execution module.

[0016] Preferably, the core control node is deployed on a high-performance server or a cloud control plane; A connection request is initiated to the worker node via the gRPC protocol, the generated penetration testing task is serialized into Protocol Buffers messages, and pushed to the corresponding worker node through the established gRPC channel.

[0017] Worker nodes are deployed on the host machine of the container cluster of the test target in the form of DaemonSet or privileged containers; Upon receiving the task, immediately return a task receipt confirmation and query the ID, complete the penetration test according to the penetration test instructions, and after the task is completed, capture the standard output log and error log, package them, and send them back to the core control node through an asynchronous streaming interface.

[0018] Preferably, the user interaction module provides a web-based graphical interface or CLI command-line tool, which receives user instructions, including test targets or natural language instructions, through the command-line interface or web interface, initializes the task context, transmits them to the intelligent planning module, and displays the final execution results.

[0019] The intelligent planning module is configured with a large language model, uses the ReAct reasoning mode to parse user commands, combines the environmental context in the environmental state snapshot generated by the environmental perception module with the vulnerability knowledge obtained based on retrieval enhancement generation technology to perform logical reasoning, generate penetration testing tasks, and decide on the invocation of external tools.

[0020] The environment perception module dynamically scans and collects information on the Kubernetes cluster or container environment, gathers and perceives container status information and container environment information, and generates an environment status snapshot after filtering and aggregation, and feeds it back to the intelligent planning module.

[0021] The task execution module encapsulates a standard penetration testing toolset and integrates a security query mechanism. Before executing any instruction, it matches and verifies the instruction to be executed against a local high-risk rule base.

[0022] Preferably, the intelligent planning module includes an inference unit, a vector database, and a context manager.

[0023] Vector databases convert text data into high-dimensional vectors for indexing; After receiving user instructions or execution results, the intelligent planning module extracts key features and converts them into query vectors, which are then retrieved from the vector database to obtain vulnerability knowledge. The context manager assembles vulnerability knowledge, current environment state snapshots, and historical operation records into prompt words according to preset templates; Based on vulnerability knowledge and clue words, the reasoning module deduces attack intent and tool call parameters through thought chain, forming a penetration testing task that is then sent to the task execution module.

[0024] Preferably, the vector database is a dedicated knowledge base in the field of storage container security, and the vulnerability knowledge includes a vectorized CVE vulnerability database, proof-of-concept code, ATT&CK matrix tactics knowledge, and historical penetration test reports.

[0025] The context manager is used to maintain the state memory of the current penetration testing opportunity and assemble it into structured prompts.

[0026] The reasoning unit adopts the ReAct reasoning framework.

[0027] The vulnerability knowledge refers to the Top-K most relevant known vulnerabilities and their exploitation methods.

[0028] The state memory includes acquired environmental information, executed tool commands, and returned results.

[0029] The prompts include dialogue history, environment snapshots, and task status.

[0030] Preferably, the environment awareness module obtains cluster-level metadata, including Pod manifest, Service exposure information, NetworkPolicy, namespace, node, service, and network configuration information, by calling the read-only interface of the Kubernetes API Server. Call the underlying container runtime interface to obtain the process list, network connection status, file system status, environment variables and mounted volume information of the host machine inside the container by executing container runtime detection commands on the worker node; Semantic dimensionality reduction and aggregation are performed using pre-defined rules and pattern matching.

[0031] The aggregation process includes field-level filtering, regular expression pattern extraction, and snapshot serialization.

[0032] Preferably, the high-risk operation rule base includes dangerous behavior characteristics such as privileged container startup, host directory mounting, sensitive file reading, and kernel module loading.

[0033] The matching verification includes: If no match is found, the task execution module directly calls the security toolset to execute the instruction, and captures the standard output and error log after execution, asynchronously sending them back to the core control node. If a match is found, the test task corresponding to the instruction to be executed is suspended, and a confirmation request containing the risk level, operation intent, and original instruction is sent through the user interaction module. Based on the confirmation result, if the task execution module receives a confirmation authorization signal, it continues to execute; if it does not receive a confirmation authorization signal, it refuses to execute and returns a rejection feedback message to the intelligent planning module, terminating the task.

[0034] An automated container penetration testing method based on a large-scale intelligent agent, provided by the present invention, includes: Step 1: Input user commands. The core control node receives and establishes a gRPC connection with the worker node, and initializes the task context. Step 2: The environmental perception module scans the target environment according to the perception instructions, collects information to build an environmental status snapshot and feeds it back to the core control node; Step 3: The intelligent planning module receives an environmental state snapshot, combines the perceived data and vulnerability knowledge, and generates a penetration testing task. Step 4: The task execution module generates attack instructions based on the penetration testing task and performs high-risk rule matching. After passing the verification or obtaining authorization, the attack instructions are executed and the execution results are captured. Step 5: The intelligent planning module receives and analyzes the execution results. If the goal is not achieved, the penetration testing task is modified and Step 4 is executed. If the preset goal is achieved, the test is stopped.

[0035] Preferably, it further includes: Step 6: Once the objective is achieved or all paths have been tried, stop the test and generate a test report containing the complete attack path, exploit code, and hardening recommendations.

[0036] In step five, the execution result of the task execution module is sent back to the LLM of the intelligent planning module. If the execution fails, the LLM analyzes the reason for the failure, generates an alternative solution, and executes step four. If the execution is successful, the LLM updates the status, the task execution module captures the standard output and error log of the execution and sends them back, the intelligent planning module analyzes the returned results, evaluates the achievement of the goal, and if the preset goal is achieved, it enters the next attack instruction of the penetration testing task. If the preset goal is not achieved, the inference logic is corrected based on the execution feedback, the next attack instruction is regenerated, and step three is executed until the preset goal is achieved or the maximum number of iterations is reached.

[0037] The execution feedback-based correction inference logic includes: When the returned result contains a permission denial error, the intelligent planning module infers the privilege escalation path or replaces it with a low-privilege compatible scanning tool; When the feedback result indicates that the current path is not feasible, the intelligent planning module discards the current node, backtracks to the previous node, selects an alternative branch, and generates a new attack command.

[0038] Preferably, in step one, the user interaction module of the core control node receives the target cluster information and the test scope, parses the target address, verifies the validity of the credentials, actively establishes a heartbeat connection with all working nodes in the cluster, and initializes the global context of the penetration test task.

[0039] In step two, the intelligent planning module sends a perception command to the environment perception module, which in turn calls the Kubernetes API and Docker container runtime interface to collect metadata and real-time status of the target environment, build an environment status snapshot, scan the target environment, and collect statistics on node topology, service dependencies, and configuration baseline information, which are then fed back to the core control node.

[0040] In step three, the large language model configured by the intelligent planning module receives an environmental state snapshot and analyzes potential attack surfaces. Combined with vulnerability knowledge retrieved from the vector database, it uses thought chain reasoning to plan one or more attack paths containing specific tool call parameters, thereby generating a penetration testing task.

[0041] In step four, an attack command is generated based on the penetration testing task. After receiving the attack command, the task execution module performs risk verification and matches it with the local high-risk operation rule library.

[0042] If the attack command does not match, the security toolset is directly invoked to execute the attack command, and the standard output and error log are captured after execution and asynchronously sent back to the core control node. If the attack command matches and is successful, the test task corresponding to the command to be executed is suspended, and a confirmation request containing the risk level, operation intent and original command is sent through the user interaction module. Based on the confirmation result, if the task execution module receives the confirmation authorization signal, it continues to execute; if it does not receive the confirmation authorization signal, it refuses to execute and returns a rejection feedback message to the intelligent planning module, terminating the task.

[0043] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention introduces an LLM (Large Language Model) agent, which can simulate the thought process of human experts, automatically handle complex logical vulnerabilities and multi-stage attack paths, improve the intelligence level of penetration testing, and break through the limitations of traditional static tools.

[0044] 2. This invention utilizes an environment awareness module to obtain runtime status in real time and combines it with RAG (Retrieval-Augmented Generation) technology to introduce the latest vulnerability intelligence, which significantly reduces the false alarm rate, improves the success rate of testing, and achieves precise strikes in dynamic environments.

[0045] 3. The HITL (Human-In-The-Loop) security inquiry mechanism of this invention effectively builds a barrier between AI and the production environment, preventing intelligent agents from performing high-risk and destructive operations due to model illusion or overgeneralization, and ensuring the security of automated testing.

[0046] 4. The architecture of separating control nodes and worker nodes in this invention has high scalability, enabling the system to flexibly adapt to large-scale, cross-regional container cluster environments. Attached Figure Description

[0047] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram of an automated container penetration testing method based on a large-scale intelligent agent. Figure 2 This is a schematic diagram of an automated container penetration testing system based on a large-scale intelligent agent model. Figure 3 This is a schematic diagram of node communication interaction in a distributed architecture embodiment of the present invention; Figure 4 This is a diagram illustrating the decision logic of the intelligent planning module and the RAG retrieval principle in an embodiment of the present invention. Detailed Implementation

[0048] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0049] The present invention provides an automated container penetration testing system based on a large model intelligent agent, which utilizes the reasoning ability of a large language model to construct an intelligent agent, and combines a distributed architecture to achieve deep perception and closed-loop testing of container clusters. Furthermore, it solves the problems of model illusion and security risks through retrieval enhancement generation and security interrogation mechanisms.

[0050] by Figure 1For example, it adopts a distributed architecture deployment, which logically consists of a core control node and working nodes. The core control node specifically includes a user interaction module and an intelligent planning module, and the working node includes an environmental perception module and a task execution module.

[0051] The user interaction module receives user commands and transmits them to the intelligent planning module. The intelligent planning module analyzes the user's intent based on LLM (Large Language Model), calls the environment awareness module to obtain cluster container status information and configuration metadata, and combines it with vulnerability intelligence provided by the internal knowledge base to generate a multi-stage attack path plan. The task execution module calls the underlying security tools through standard interfaces to perform penetration operations on the target container and capture execution feedback. The intelligent planning module dynamically corrects the attack path plan based on the execution feedback results until the preset goal is achieved or all paths are traversed.

[0052] Specifically, the core control node is the command center of the system, usually deployed on a high-performance server or cloud control plane; the worker node is the execution unit of the system, usually deployed on the various host machines of the container cluster of the test target in the form of DaemonSet (DS, a workload controller in Kubernetes, used to ensure that a specified Pod replica is running on the relevant nodes in the cluster) or privileged containers.

[0053] At the cluster level, namespaces and network policies are obtained through the Kubernetes API Server; at the node level, process lists and sensitive mounted volume information are obtained through runtime detection commands. This deep metadata collection provides cloud-native-specific environmental semantics for large models, enabling them to infer specific paths such as "container escape" or "lateral movement".

[0054] The data interaction method between the core control node and the working node is as follows: Command issuance: The core control node, acting as a client, actively initiates a connection request to the worker node, which acts as the server, via the gRPC protocol, and sends serialized penetration test commands. Results feedback: After completing specific penetration actions, the worker node captures the standard output logs and error logs, packages them, and asynchronously sends them back to the core control node for the intelligent planning module to perform the next round of reasoning and analysis.

[0055] In the distributed "core control - worker node" architecture based on the gRPC protocol, the core control node acts as a client to actively push tasks to the worker nodes and supports asynchronous streaming of execution results, which significantly improves the concurrency and anti-blocking capabilities of large-scale container cluster penetration testing.

[0056] Furthermore, the user interaction module, deployed on the core control node, provides a web-based graphical interface or CLI (command-line interface) command-line tool. This module receives the user's test objectives (the scope of the test objectives, such as a specific Kubernetes Namespace, i.e., a namespace in the Kubernetes system) or natural language commands (test intent, such as "detect for unauthorized access vulnerabilities") through the command-line interface or web interface. After preprocessing the commands, it transmits them to the intelligent planning module and displays the final execution results.

[0057] The intelligent planning module, serving as the system's control core, is equipped with a large language model. This module utilizes the ReAct (Reasoning and Acting) reasoning model to parse user intent, combines the environmental context provided by the environmental awareness module with vulnerability intelligence obtained from a vulnerability knowledge base based on Retrieval Enhanced Generation (RAG) technology, performs logical reasoning to generate attack planning paths, and decides on the invocation of external tools. The large language model adopts publicly available models such as GPT-5, GPT-4O, and QW3, which can be configured and modified as needed.

[0058] Specifically, the ReAct framework combined with CoT (CoT) is adopted. Instead of relying on a pre-set attack tree or state machine, it is based on real-time analysis of environmental snapshots by a large model. In each iteration, it autonomously thinks about the next operation and, based on the execution results fed back by the tool, the intelligent agent can observe and reflect through CoT. Through the autonomous "reflection" mechanism of the large model, it dynamically corrects the reasoning logic or switches attack branches, which is more adaptable to the high-frequency changes and short duration of the container environment. This achieves an automated closed loop from problem discovery to "obtaining feedback and adjusting strategy".

[0059] The intelligent planning module specifically includes an inference unit, a vector database, and a context manager.

[0060] Vector Database: As a long-term memory component of the system, it is a dedicated knowledge base for storing container security knowledge. Its content includes a vectorized CVE (Common Vulnerabilities & Exposures) database, proof-of-concept (PoC) code, ATT & CK matrix tactical knowledge, and historical penetration test reports.

[0061] When the intelligent planning module needs domain-specific knowledge, it quickly retrieves it from the vector database using semantic retrieval technology. The vector database indexes text data by converting it into high-dimensional vectors, supports semantic similarity-based retrieval, and employs publicly available text vector models, such as OpenAI text-embedding-3-small.

[0062] Context Manager: Used to maintain the state memory of the current penetration testing task (penetration testing plan), including acquired environmental information, executed tool commands and their return results, and assemble the above information into structured prompts, including dialogue history, environment snapshots and task status, to ensure that the LLM maintains the memory of key information during long-term penetration testing.

[0063] Inference Unit: Employing the ReAct inference framework, it receives the prompt words, combines them with relevant vulnerability intelligence retrieved from the vector database, and derives the attack intent and specific tool call parameters for the current step through thought chain inference.

[0064] The environment awareness module is used to dynamically scan and collect information about Kubernetes clusters or container environments, including metadata such as Pod information, image versions, and network policies, and feeds back the perceived cluster and container environment information to the intelligent planning module.

[0065] Specifically, the environment awareness module obtains cluster container status information in the following ways: At the cluster level: By calling the read-only interface of the Kubernetes API Server, we can obtain cluster-level metadata, including Pod manifests, Service exposure information, NetworkPolicy policies, namespaces, nodes, services, and network configuration information.

[0066] At the node level: By calling the underlying container runtime interface (such as Docker Socket) and executing container runtime detection commands on the worker node, the system obtains the process list, network connection status, file system status, environment variables, and mounted volume information of the host machine inside the container.

[0067] To prevent information overload in large models (Token restriction), improve inference accuracy, and protect security and privacy, the environmental awareness module filters the raw data, including feature extraction and deduplication.

[0068] The environmental perception module aggregates and processes the collected scattered metadata to generate a standardized environmental state snapshot, which is then sent to the intelligent planning module as a basis for decision-making.

[0069] Specifically, the environment perception module actively calls the multi-source heterogeneous interface of the container environment to collect raw metadata, and uses preset rules and pattern matching (such as regular expression filtering) to perform semantic dimensionality reduction and aggregation processing on the raw data, thereby generating a standardized state snapshot that represents the current security characteristics of the environment, and uses it as the reasoning context to synchronize to the intelligent planning module in real time to drive subsequent automated penetration decisions.

[0070] The aggregation process includes the following steps: Field-level filtering: Predefine field filtering rules for Kubernetes API response data to remove non-critical operational information, including managed fields and status, and extract only a subset of attributes containing security context, mounted volumes, and environment variables.

[0071] Regular expression pattern extraction: Uses pre-defined regular expressions to scan the logs or process list of the container runtime, automatically matches and extracts strings that match network address characteristics, sensitive path characteristics, or specific middleware version characteristics, to achieve preliminary parsing of unstructured data.

[0072] Snapshot serialization: The extracted attribute subset and feature string are associated according to the preset hierarchical logic (such as cluster-namespace-Pod-container), and encapsulated into a standardized JSON format document.

[0073] The environment awareness module not only collects vulnerability information, but also delves into the container's interior. By calling the Kubernetes API and container runtime instructions (such as Inspect), it extracts container-specific metadata such as namespaces, Pod manifests, network policies, and host mounted volumes. This enables it to make accurate inferences about threats specific to cloud-native container architectures, such as container escape and unauthorized access, and provides deep cloud-native awareness capabilities.

[0074] The task execution module, deployed on worker nodes, is responsible for implementing specific penetration testing operations. It encapsulates a standard penetration testing toolset and receives instructions from the intelligent planning module to execute specific operations. It integrates a security inquiry mechanism; when a high-risk operation instruction is identified, the task is suspended and authorization is requested.

[0075] Specifically, the security query mechanism integrated into the task execution module matches the instruction to be executed against a local high-risk rule base before executing any instruction; once a rule is matched, the current task is immediately suspended and an authorization request is sent to the core control node to prevent the agent from engaging in unintended destructive behavior. The specific workflow is as follows: The system comes pre-loaded with a high-risk operation rule base, which includes dangerous behavior characteristics such as privileged container startup, host machine directory mounting, sensitive file reading, and kernel module loading. The content of the rule base can be modified and adjusted according to task requirements.

[0076] When the task execution module receives an instruction from the intelligent planning module, it matches it against the high-risk operation rule base. If a match is found, the task execution module suspends the current task and sends a confirmation request containing the risk level, operation intent, and original instruction to the user through the user interaction module. Execution continues or is rejected only after authorization is obtained. If no match is found, the task execution module directly calls the security toolset to execute the instruction. After execution, it captures the standard output and error log and asynchronously sends them back to the core control node for subsequent reasoning analysis and strategy correction by the intelligent planning module.

[0077] The task execution module will only continue to execute the instruction after receiving an explicit authorization signal from the user; otherwise, it will refuse to execute and return a "user refused" feedback message to the intelligent planning module.

[0078] like Figure 3 As shown, to adapt to the network isolation characteristics of cloud-native environments, a proactive distributed communication process was designed, which specifically includes: Connection Establishment: The core control node, acting as a gRPC client, proactively initiates connections to worker nodes (i.e., gRPC servers) distributed across different network regions. This reverse connection design facilitates the core control node's unified management of different worker nodes across network boundaries.

[0079] Command distribution: The attack tasks generated by the intelligent planning module are serialized into Protocol Buffers messages and pushed to the designated worker nodes through the established gRPC channel.

[0080] Asynchronous return: Given the time-consuming nature of worker node task execution, the worker node immediately returns a task reception confirmation and query ID upon receiving the task; after the task is completed, it packages the standard output and error log and returns them to the core control node through an asynchronous streaming interface.

[0081] by Figure 4 For example, the intelligent planning module adopts a closed-loop logic of "perception-retrieval-planning": Intent parsing and retrieval: Upon receiving user instructions or periodic feedback, the intelligent planning module first extracts the key features, transforms the features into query vectors, and retrieves the Top-K most relevant known vulnerabilities and their exploitation methods from the vector database.

[0082] Prompt word assembly: The system assembles the retrieved knowledge fragments, the current environment snapshot, and historical operation records into a structured prompt word according to a predefined template.

[0083] Thought chain reasoning: After receiving the prompt words, LLM uses the ReAct mode for reasoning, that is, it generates the reasoning process before outputting the operation command to ensure that each operation has logical support.

[0084] Instruction generation: Based on the inference results, LLM generates instructions in a format that conforms to the tool calling specification and sends them to the task execution module.

[0085] This invention provides an automated container penetration testing method based on a large-scale intelligent agent, used for efficient vulnerability assessment and penetration testing of cluster container environments. It effectively addresses the dynamic challenges of container environments, achieving an automated closed loop from intent understanding to attack execution, significantly improving penetration testing coverage and response efficiency. Figure 2 For example, specifically including: Step 1: Initialization. The core control node establishes a gRPC connection with the worker node and initializes the task context.

[0086] The user enters the target cluster information and test scope into the console. The user interaction module of the core control node receives the test target scope entered by the user, parses the target address, verifies the validity of the credentials, and actively establishes a heartbeat connection (i.e., a gRPC communication connection) with all worker nodes in the cluster, initializing the global context of this penetration test task.

[0087] Step 2: The global awareness and environment awareness modules scan the Kubernetes API and container runtime status.

[0088] The intelligent planning module sends perception commands to the environment perception module, driving it to call the Kubernetes API and Docker container runtime interface to collect metadata and real-time status of the target environment and build an environment status snapshot. The environment perception module scans the target environment, collects statistics on node topology, service dependencies, and configuration baseline information, and feeds this information back to the core control node.

[0089] Step 3: The attack path planning and intelligent planning module is based on LLM and combines awareness data and vulnerability knowledge in the vector database to generate attack instructions containing specific tool parameters.

[0090] The intelligent planning module's large language model receives environmental state snapshots and analyzes potential attack surfaces based on this information. Combined with vulnerability intelligence retrieved from the RAG vector database, it uses thought chain reasoning to generate attack instruction sequences containing specific tool call parameters, thus planning one or more attack paths (e.g., Web vulnerability exploitation -> Shell acquisition -> Container escape -> Cluster privilege escalation).

[0091] Specifically, the process of combining the vulnerability knowledge retrieved from the vector database includes: The intelligent planning module extracts the current environmental features into query vectors; performs semantic similarity matching in the vector database to retrieve the Top-K most relevant CVE vulnerability descriptions or attack tactics; and concatenates the retrieved knowledge fragments with the current task objective to assemble enhanced prompt words, which are then input into a large language model to guide it in generating targeted attack payloads.

[0092] Step 4: The execution and risk control and task execution modules match the instructions with high-risk rules, and after verification or authorization, call the tool to execute and capture the execution results.

[0093] Following the planned path, the first step of the attack command is generated. The task execution module receives the attack command and performs a risk check, matching it against the built-in high-risk operation rule library. If the command is determined to be low-risk, it passes the check or receives explicit user authorization and is executed directly, i.e., it invokes underlying security tools to perform the penetration operation. If the command is determined to be high-risk, a security inquiry mechanism is triggered, and execution proceeds only after administrator approval.

[0094] Step 5: The feedback loop and intelligent planning module analyze the returned execution results. If the goal is not achieved, the reasoning logic is corrected and the next stage instruction is generated until the goal is achieved.

[0095] The results of the tool's execution are sent back to the LLM. If the execution is successful, the LLM updates the status and proceeds to the next step in the path. If the execution fails, the LLM analyzes the cause of the failure, attempts to generate an alternative solution, and then jumps back to step four for execution.

[0096] The task execution module captures and returns the standard output and error logs of the tool execution. The intelligent planning module analyzes the returned results to evaluate the achievement of the target. If the preset target is not achieved, the inference logic is corrected based on the execution feedback, the attack instructions for the next stage are regenerated, and the process jumps to step three to continue execution until the target is achieved or the maximum number of iterations is reached.

[0097] Specifically, the execution feedback-based correction inference logic includes: If the returned result contains a permission denial error, the intelligent planning module infers and attempts to escalate privileges or switches to a low-privilege compatible scanning tool; if the returned result indicates that the current path is not feasible (e.g., the port is closed), the intelligent planning module discards the current node, backtracks to the previous node, selects an alternative branch, and generates new attack instructions.

[0098] In more preferred examples, step six is ​​also included: report generation. When the preset goal is achieved or all possible paths have been tried, the system automatically stops the test and generates a test report containing the complete attack chain, exploit code, and hardening suggestions.

[0099] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function as logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0100] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. An automated container penetration testing system based on a large-scale intelligent agent model, characterized in that, include: Core control nodes and working nodes; The core control node includes a user interaction module and an intelligent planning module, and the working node includes an environmental perception module and a task execution module. The user interaction module receives user commands, initializes the task context, and transmits it to the intelligent planning module. The intelligent planning module drives the environmental perception module to scan the target environment according to the perception instructions, collect information, build an environmental state snapshot, and provide feedback. The intelligent planning module receives environmental state snapshots and combines them with perception data and vulnerability knowledge to generate penetration testing tasks; The task execution module generates attack instructions based on the penetration testing task and performs high-risk rule matching. After passing the verification or obtaining authorization, the attack instructions are executed and the execution results are captured. The intelligent planning module receives and analyzes the execution results. If the goal is not achieved, it dynamically modifies the penetration testing task until the preset goal is achieved or the test stops after traversing all paths. The user interaction module displays the final execution result of the task execution module.

2. The container automated penetration testing system based on a large-scale intelligent agent as described in claim 1, characterized in that, The core control node is deployed on a high-performance server or cloud control plane; A connection request is initiated to the worker node via the gRPC protocol, the generated penetration test task is serialized into ProtocolBuffers messages, and pushed to the corresponding worker node through the established gRPC channel; Worker nodes are deployed on the host machine of the container cluster of the test target in the form of DaemonSet or privileged containers; Upon receiving the task, immediately return a task receipt confirmation and query the ID, complete the penetration test according to the penetration test instructions, and after the task is completed, capture the standard output log and error log, package them, and send them back to the core control node through an asynchronous streaming interface.

3. The container automated penetration testing system based on a large-scale intelligent agent as described in claim 2, characterized in that, The user interaction module provides a web-based graphical interface or CLI command-line tool to receive user instructions, including test targets or natural language instructions, through the command-line interface or web interface, initialize the task context, transmit them to the intelligent planning module, and display the final execution results. The intelligent planning module is configured with a large language model, uses the ReAct reasoning mode to parse user commands, combines the environmental context in the environmental state snapshot generated by the environmental perception module with the vulnerability knowledge obtained based on the retrieval enhancement generation technology to perform logical reasoning, generate penetration testing tasks, and decide on the invocation of external tools. The environment perception module dynamically scans and collects information on the Kubernetes cluster or container environment, collects and perceives container status information and container environment information, and generates an environment status snapshot after filtering and aggregation, and feeds it back to the intelligent planning module. The task execution module encapsulates a standard penetration testing toolset and integrates a security query mechanism. Before executing any instruction, it matches and verifies the instruction to be executed against a local high-risk rule base.

4. The container automated penetration testing system based on a large-scale intelligent agent according to claim 3, characterized in that, The intelligent planning module includes an inference unit, a vector database, and a context manager; Vector databases convert text data into high-dimensional vectors for indexing; After receiving user instructions or execution results, the intelligent planning module extracts key features and converts them into query vectors, which are then retrieved from the vector database to obtain vulnerability knowledge. The context manager assembles vulnerability knowledge, current environment state snapshots, and historical operation records into prompt words according to preset templates; Based on vulnerability knowledge and clue words, the reasoning module deduces attack intent and tool call parameters through thought chain, forming a penetration testing task that is then sent to the task execution module.

5. The container automated penetration testing system based on a large-scale intelligent agent according to claim 4, characterized in that, The vector database is a dedicated knowledge base for the field of storage container security. The vulnerability knowledge includes a vectorized CVE vulnerability database, proof-of-concept code, ATT&CK matrix tactics knowledge, and historical penetration test reports. The context manager is used to maintain the state memory of the current penetration testing opportunity and assemble it into structured prompt words; The reasoning unit adopts the ReAct reasoning framework; The vulnerability knowledge refers to the Top-K most relevant known vulnerabilities and their exploitation methods; The state memory includes acquired environmental information, executed tool commands, and return results; The prompts include dialogue history, environment snapshots, and task status.

6. The container automated penetration testing system based on a large-scale intelligent agent according to claim 3, characterized in that, The environment awareness module obtains cluster-level metadata, including Pod listings, Service exposure information, NetworkPolicy policies, namespaces, nodes, services, and network configuration information, by calling the read-only interface of the Kubernetes API Server. Call the underlying container runtime interface to obtain the process list, network connection status, file system status, environment variables and mounted volume information of the host machine inside the container by executing container runtime detection commands on the worker node; Semantic dimensionality reduction and aggregation are performed using pre-defined rules and pattern matching. The aggregation process includes field-level filtering, regular expression pattern extraction, and snapshot serialization.

7. The container automated penetration testing system based on a large-scale intelligent agent according to claim 3, characterized in that, The high-risk operation rule base includes dangerous behavior characteristics such as privileged container startup, host directory mounting, sensitive file reading, and kernel module loading. The matching verification includes: If no match is found, the task execution module directly calls the security toolset to execute the instructions, and captures the standard output and error log after execution, and asynchronously sends them back to the core control node. If a match is found, the test task corresponding to the instruction to be executed is suspended, and a confirmation request containing the risk level, operation intention and original instruction is sent through the user interaction module. Based on the confirmation result, if the task execution module receives the confirmation authorization signal, it continues to execute; if it does not receive the confirmation authorization signal, it refuses to execute and returns a rejection feedback message to the intelligent planning module, terminating the task.

8. An automated penetration testing method for containers based on a large-scale intelligent agent model, characterized in that, include: Step 1: Input user commands. The core control node receives and establishes a gRPC connection with the worker node, and initializes the task context. Step 2: The environmental perception module scans the target environment according to the perception instructions, collects information to build an environmental status snapshot and feeds it back to the core control node; Step 3: The intelligent planning module receives an environmental state snapshot, combines the perceived data and vulnerability knowledge, and generates a penetration testing task. Step 4: The task execution module generates attack instructions based on the penetration testing task and performs high-risk rule matching. After passing the verification or obtaining authorization, the attack instructions are executed and the execution results are captured. Step 5: The intelligent planning module receives and analyzes the execution results. If the goal is not achieved, the penetration testing task is modified and Step 4 is executed. If the preset goal is achieved, the test is stopped.

9. The automated container penetration testing method based on a large-scale intelligent agent as described in claim 8, characterized in that, Also includes: Step 6: Once the goal is achieved or all paths have been tried, stop the test and generate a test report containing the complete attack path, exploit code, and hardening suggestions. In step five, the execution result of the task execution module is sent back to the LLM of the intelligent planning module. If the execution fails, the LLM analyzes the reason for the failure, generates an alternative solution, and executes step four. If the execution is successful, the LLM updates the status, the task execution module captures the standard output and error log of the execution and sends them back, the intelligent planning module analyzes the returned results, evaluates the achievement of the goal, and if the preset goal is achieved, it enters the next attack instruction of the penetration testing task. If the preset goal is not achieved, the reasoning logic is corrected based on the execution feedback, the next attack instruction is regenerated, and step three is executed until the preset goal is achieved or the maximum number of iterations is reached. The execution feedback-based correction inference logic includes: When the returned result contains a permission denial error, the intelligent planning module infers the privilege escalation path or replaces it with a low-privilege compatible scanning tool; When the feedback result indicates that the current path is not feasible, the intelligent planning module discards the current node, backtracks to the previous node, selects an alternative branch, and generates a new attack command.

10. The automated container penetration testing method based on a large-scale intelligent agent according to claim 8, characterized in that, In step one, the user interaction module of the core control node receives the target cluster information and test scope, parses the target address, verifies the validity of the credentials, actively establishes a heartbeat connection with all working nodes in the cluster, and initializes the global context of the penetration test task. In step two, the intelligent planning module sends a perception command to the environment perception module, which in turn calls the Kubernetes API and Docker container runtime interface to collect metadata and real-time status of the target environment, build an environment status snapshot, scan the target environment, and collect statistics on node topology, service dependencies, and configuration baseline information, which are then fed back to the core control node. In step three, the large language model configured by the intelligent planning module receives an environmental state snapshot and analyzes potential attack surfaces. Combined with vulnerability knowledge retrieved from the vector database, it uses the thinking chain reasoning to plan one or more attack paths containing specific tool call parameters, and generates a penetration testing task. In step four, an attack command is generated based on the penetration testing task. After receiving the attack command, the task execution module performs risk verification and matches it with the local high-risk operation rule library. If the attack command does not match, the security toolset is directly invoked to execute the attack command, and the standard output and error log are captured after execution and asynchronously sent back to the core control node. If the attack command matches and is successful, the test task corresponding to the command to be executed is suspended, and a confirmation request containing the risk level, operation intent and original command is sent through the user interaction module. Based on the confirmation result, if the task execution module receives the confirmation authorization signal, it continues to execute; if it does not receive the confirmation authorization signal, it refuses to execute and returns a rejection feedback message to the intelligent planning module, terminating the task.

Images