Rag and multi-agent based automated penetration testing method and system

Abstract

This invention relates to the field of network security technology, and in particular to an automated penetration testing method and system based on RAG and multi-agent systems. The method involves: step S1, acquiring target intelligence files; step S2, precisely driving semantic retrieval of the RAG knowledge base based on the target intelligence files; step S3, planning and scheduling based on a penetration-related knowledge graph; step S4, using dynamic resource scheduling by a scheduling center and parallel execution by a multi-agent cluster; step S5, aggregating and standardizing preliminary test results and applying a predefined set of contradictory rules for consistency verification; and step S6, judging the value of the target task. This achieves precise and flexible allocation of limited testing resources, thereby improving the testing depth and vulnerability discovery efficiency of the core attack surface.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an automated penetration testing method and system based on RAG and multi-agent systems. Background Technology

[0002] Currently, automated penetration testing is a key technology for improving vulnerability discovery efficiency. Existing technologies mainly fall into two categories: one is traditional vulnerability scanners based on feature matching, which can quickly discover known vulnerabilities but are completely unable to handle business logic vulnerabilities without fixed features; the other is intelligent agents utilizing large language models, which, while possessing preliminary reasoning capabilities, lack systematic knowledge integration, resulting in a rigid testing process, inability to dynamically adjust strategies, and a lack of intelligent scheduling for task dependencies and conflicts when testing multiple types of vulnerabilities in parallel. Both of these methods have significant shortcomings: the former lacks systematic knowledge integration and cannot understand complex business logic; the latter lacks flexible strategy adjustment and a recursive optimization mechanism, leading to limitations in testing depth and adaptability.

[0003] Chinese patent application CN117725587A discloses a penetration testing method and a penetration testing system. The penetration testing method includes: generating a key for a penetration testing terminal; encrypting a data packet uploaded by a first terminal using the key to obtain a first ciphertext; encrypting a penetration target uploaded by a second terminal using the key to obtain a second ciphertext; obtaining a target ciphertext that meets the expected results based on the first ciphertext and the second ciphertext; and finally decrypting the target ciphertext using the key to obtain the penetration testing result. It is evident that this approach still suffers from problems such as a lack of knowledge base integration of vulnerability-related knowledge, and a lack of parallel detection by multiple agents and synchronous optimization of test results, leading to low vulnerability discovery efficiency and insufficient accuracy of test results. Summary of the Invention

[0004] To address this, the present invention provides an automated penetration testing method and system based on RAG and multi-agent systems, which overcomes the problems of low vulnerability discovery efficiency and insufficient accuracy of test results caused by the lack of a knowledge base to integrate vulnerability-related knowledge and the lack of parallel detection by multi-agent systems and synchronous optimization of test results.

[0005] To achieve the above objectives, on the one hand, the present invention provides an automated penetration testing method based on RAG and multi-agent systems, the method comprising:

[0006] Step S1: Scan the target system to obtain vulnerability intelligence files, and perform structured processing on the vulnerability intelligence files to obtain target intelligence files.

[0007] Step S2: Generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base;

[0008] Step S3: Generate a target penetration test plan based on the vulnerability-related knowledge set and the pre-built penetration-related knowledge graph;

[0009] Step S4: Perform parallel testing of the target penetration testing plan using multiple intelligent methods to obtain preliminary test results;

[0010] Step S5: Based on the preliminary test results, recursively optimize the target penetration test plan using a recursive optimization method.

[0011] Step S6: Obtain the target task value and iteratively optimize the recursive optimization process based on the target task value.

[0012] The recursive optimization method includes:

[0013] Step S51: Perform contradiction detection on the preliminary test results to obtain contradiction detection results, and optimize the scope of the generation process of the vulnerability-related knowledge set based on the contradiction detection results;

[0014] Step S52: Perform correlation analysis on the preliminary test results to obtain the correlation analysis results; and adjust the target penetration test plan based on the correlation analysis results.

[0015] Step S53: Obtain the number of iterations and perform convergence processing on the plan adjustment process based on the number of iterations.

[0016] Further, in step S2, a vulnerability-related knowledge set is generated based on the target intelligence file and the pre-built RAG knowledge base. Specifically, the search is constructed by querying the technology stack list and business function diagram in the target intelligence file to obtain a search instruction. The search instruction is then matched with vector similarity through the semantic search interface of the pre-built RAG knowledge base to obtain highly relevant original knowledge fragments. Finally, the highly relevant original knowledge fragments are aggregated to obtain a vulnerability-related knowledge set.

[0017] Furthermore, in step S3, the target penetration test plan is generated based on the vulnerability-related knowledge set and the pre-built penetration association knowledge graph. Specifically, atomic test actions are extracted and classified through the vulnerability-related knowledge set to obtain atomic actions. The execution path of the basic test task is obtained based on the atomic actions. The execution path of the basic test task is optimized through the pre-built penetration association knowledge graph to obtain a preliminary penetration test execution sequence. The task is sorted through a dynamic priority scheduling algorithm to obtain the target penetration test plan.

[0018] Furthermore, in step S4, the target penetration test plan is tested in parallel through a multi-agent cluster. Specifically, the target penetration test plan is dynamically scheduled through a scheduling center to obtain task dynamics. The tasks are dynamically allocated to the multi-agent cluster for parallel execution to obtain preliminary test results. The preliminary test results are collected in real time through a status monitor.

[0019] Furthermore, in step S5, the target penetration test plan is recursively optimized based on the preliminary test results using a recursive optimization method.

[0020] In step S51, contradiction detection is performed on the preliminary test results. Specifically, the preliminary test results are aggregated and standardized by the monitoring module to obtain execution result records. The execution result records are logically compared by a predefined set of contradiction rules to obtain contradiction detection results. The contradiction detection results include results that are contradictory and results that are not contradictory.

[0021] When the contradiction detection result is that there is no contradiction, the scope optimization is not performed on the generation process of the vulnerability-related knowledge set;

[0022] When the contradiction detection result indicates the existence of a contradiction, the generation process of the vulnerability-related knowledge set is optimized by performing multi-perspective retrieval on the pre-built RAG knowledge base.

[0023] Furthermore, in step S52, the preliminary test results are subjected to association analysis, specifically: entity relationships are extracted from the contradiction detection results through a penetration association knowledge graph to obtain a related entity subgraph network; pattern matching is performed on the related entity subgraph network through predefined logical rules to obtain preliminary analysis results; and then logical inference is performed on the preliminary analysis results through a rule inference engine to obtain association analysis results.

[0024] Furthermore, in step S52, the target penetration test plan is adjusted based on the correlation analysis results, specifically as follows:

[0025] If no potential attacks are found in the correlation analysis results, the target penetration test plan will not be adjusted.

[0026] When a potential attack is detected in the correlation analysis results, the target penetration test plan is adjusted: the atomic actions are updated according to the correlation analysis results to obtain new atomic actions, and new test tasks are generated based on the new atomic actions. The new test tasks are added to the initial penetration test execution sequence, and the tasks are reordered using a dynamic priority scheduling algorithm.

[0027] Further, in step S53, the iteration number CY is obtained, compared with the preset iteration number CY0, the state of the iteration number is judged based on the comparison result, and the process of adjusting the plan is converged based on the judgment result, wherein:

[0028] When CY < CY0, the iteration count is determined to be insufficient, and the process of adjusting the plan is not converged.

[0029] When CY≥CY0, the iteration count is determined to be met, and the process of adjusting the plan is converged: the current test task is marked as terminated.

[0030] Furthermore, in step S6, when obtaining the target task value sc, the number of executed tests and the estimated total number of test points are obtained, and the number of executed tests and the estimated total number of test points are normalized to obtain the normalized value of the number of executed tests mgy and the normalized value of the estimated total number of test points mky.

[0031] The target task value sc is calculated based on the normalized value of the number of executed tests (mcy), the normalized value of the estimated total number of test points (mky), the initial risk value (v0), and the value decay coefficient (k). The value of the target task sc is set as [1-k×(mcy / mky)]×v0.

[0032] The target task value sc is compared with the preset target task value sc0. Based on the comparison result, the state of the target task value is judged, and the recursive optimization process is iteratively optimized based on the judgment result, wherein:

[0033] When sc≤sc0, the target task value is determined to be low, and no iterative optimization is performed on the recursive optimization process.

[0034] When sc > sc0, the target task value is determined to be at a high level. The recursive optimization process is iteratively optimized: the preset iteration number CY0 is optimized by the iterative optimization coefficient dn to obtain the optimized preset iteration number CY01. CY01 is set as dn × CY0. The optimized preset iteration number CY01 is used as the preset iteration number CY0, and the iteration number CY is compared with the preset iteration number CY0 again.

[0035] On the other hand, the present invention also provides a system for an automated penetration testing method based on RAG and multi-agent systems, the system comprising:

[0036] The vulnerability profile scanning module is used to scan the target system to obtain vulnerability intelligence profiles, and to perform structured processing on the vulnerability intelligence profiles to obtain target intelligence profiles.

[0037] The test plan generation module is used to generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base, and to generate a target penetration test plan based on the set of vulnerability-related knowledge and the pre-built penetration association knowledge graph.

[0038] The test plan execution module is used to perform parallel testing of the target penetration test plan through multiple intelligences, obtain preliminary test results, and recursively optimize the target penetration test plan based on the preliminary test results using a recursive optimization method.

[0039] The task value optimization module is used to obtain the value of the target task and iteratively optimize the recursive optimization process based on the value of the target task.

[0040] Compared with existing technologies, the beneficial effects of this invention are as follows: the method acquires target intelligence files in step S1; the method further drives semantic retrieval of the RAG knowledge base precisely based on the target intelligence files in step S2, so as to integrate a highly relevant and structured set of vulnerability knowledge, thereby improving the targeting, coverage depth, and overall efficiency of subsequent penetration testing; the method further plans and schedules based on the penetration-related knowledge graph in step S3, so as to transform discrete vulnerability knowledge into a logically rigorous and parallel-executable target penetration test plan, thereby improving the path coverage of automated penetration testing; the method further utilizes dynamic resource scheduling of the scheduling center and parallel execution of multi-agent clusters in step S4, so as to efficiently transform the target penetration test plan into actual action and maximize the utilization of system resources, thereby improving the execution speed, overall throughput, and task coverage of penetration testing. In addition to improving coverage, the method further aggregates and standardizes preliminary test results in step S5 and applies a predefined set of contradiction rules for consistency verification. This facilitates the rapid identification of logical conflicts and environmental interference during the testing process. Furthermore, it performs correlation analysis on the preliminary test results using a penetration-related knowledge graph to help the system understand the potential combinations and root causes of contradictions among vulnerabilities, transforming surface contradictions into precise insights into related logic. The method also assesses the state of the iteration count to promptly terminate the deep recursive optimization of the current test task when the resource investment limit is reached, thereby releasing computing resources and improving the efficiency of the overall testing process. Finally, in step S6, the method assesses the state of the target task's value to identify high-value tasks and dynamically increase their recursion depth limit, achieving precise and flexible allocation of limited testing resources, thereby improving the accuracy of test results and the efficiency of vulnerability discovery. Attached Figure Description

[0041] Figure 1 This is a flowchart illustrating the automated penetration testing method based on RAG and multi-agent systems in this embodiment.

[0042] Figure 2 This is a flowchart illustrating the recursive optimization method in this embodiment;

[0043] Figure 3 This is a schematic diagram of the system structure of the automated penetration testing method based on RAG and multi-agent in this embodiment. Detailed Implementation

[0044] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0045] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0046] It should be noted that in the description of this invention, the terms "upper", "lower", "left", "right", "inner", "outer", etc., which indicate directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0047] Furthermore, it should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0048] Please see Figure 1 As shown, this is a flowchart illustrating the automated penetration testing method based on RAG and multi-agent systems in this embodiment. The method includes:

[0049] Step S1: Scan the target system to obtain vulnerability intelligence files, and perform structured processing on the vulnerability intelligence files to obtain target intelligence files.

[0050] Step S2: Generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base;

[0051] Step S3: Generate a target penetration test plan based on the vulnerability-related knowledge set and the pre-built penetration-related knowledge graph;

[0052] Step S4: Perform parallel testing of the target penetration test plan using a multi-agent cluster to obtain preliminary test results;

[0053] Step S5: Based on the preliminary test results, recursively optimize the target penetration test plan using a recursive optimization method.

[0054] Step S6: Obtain the target task value and iteratively optimize the recursive optimization process based on the target task value.

[0055] Specifically, the automated penetration testing method based on RAG and multi-agent systems is applied to core e-commerce transaction devices. The method uses a pre-built RAG knowledge base and a pre-built penetration-related knowledge graph to perform parallel testing and recursive optimization of the target penetration test plan. This facilitates the systematic integration of vulnerability knowledge for comprehensive vulnerability awareness and testing, thereby improving the task coverage and testing accuracy of vulnerability discovery. Specifically, the method acquires target intelligence files in step S1. Step S2 further drives semantic retrieval of the RAG knowledge base based on the target intelligence files, integrating highly relevant and structured vulnerability knowledge sets to improve the targeting, coverage depth, and overall efficiency of subsequent penetration tests. Step S3 utilizes the penetration-related knowledge graph for planning and scheduling, transforming discrete vulnerability knowledge into logically rigorous and parallel-executable target penetration test plans, thus improving the path coverage of automated penetration testing. Step S4 further utilizes dynamic resource scheduling by the scheduling center and the multi-agent cluster... Parallel execution is employed to efficiently translate the target penetration testing plan into actual action and maximize the utilization of system resources, thereby improving the execution speed, overall throughput, and task coverage of penetration testing. The method further aggregates and standardizes preliminary test results in step S5 and applies a predefined set of conflict rules for consistency verification, facilitating rapid identification of logical conflicts and environmental interference during the testing process. It also performs correlation analysis on the preliminary test results using a penetration knowledge graph, enabling the system to understand the potential combinations and root causes of vulnerabilities, transforming surface contradictions into precise logical insights. Furthermore, the method assesses the iteration count to promptly terminate deep recursive optimization of the current test task when the resource investment limit is reached, thereby releasing computing resources and improving the efficiency of the overall testing process. Finally, step S6 assesses the value of the target task to identify high-value tasks and dynamically increase their recursion depth limit, achieving precise and flexible allocation of limited testing resources, thus improving the accuracy of test results and the efficiency of vulnerability discovery.

[0056] Specifically, in step S1, the target system is scanned to obtain a vulnerability intelligence file, and the vulnerability intelligence file is structured to obtain a target intelligence file.

[0057] Specifically, the target system refers to the system used for vulnerability detection. The reconnaissance scanning refers to the process of systematically identifying and collecting vulnerability intelligence files through non-intrusive active detection and passive analysis techniques, such as ICMP Echo Request Scanning and DNS history lookup. ICMP Echo Request Scanning (Internet Control Message Protocol Echo Request Scanning) and DNS (Domain Name System) are also mentioned. The target intelligence files include a target identity card, asset atlas, technology stack list, business function diagram, and dependency and relationship diagram. The target identity card is a set of metadata used to uniquely identify and summarize the target system, such as the target name, main domain name, and IP range. The asset atlas is a list-style description of all accessible digital assets of the target system discovered through reconnaissance scanning, such as network hosts and open ports. The technology stack list is a detailed enumeration list of specific software, frameworks, components, protocols, and their version information used at different levels of the target system, such as the front-end, back-end, and data layers. The function diagram refers to the relationship between the entry points, parameters, and workflows of the business functions provided by the target system that are available for user interaction. The dependency and association diagram refers to the graph describing the data flow, calling relationships, and dependency networks between various components within the target system and between the system and external third-party services. The structured processing refers to the process of converting the vulnerability intelligence file into a standardized data format that can be recognized and analyzed by machines. This embodiment does not limit the specific method of structured processing. Those skilled in the art can freely choose according to actual needs, such as using regular expressions for structured processing. The target intelligence file refers to the structured data obtained after the vulnerability intelligence file has undergone structured processing.

[0058] Specifically, in step S2, a set of vulnerability-related knowledge is generated based on the target intelligence file and the pre-built RAG knowledge base. Specifically, the search is constructed by querying the technology stack list and business function diagram in the target intelligence file to obtain a search instruction. The search instruction is then matched with vector similarity through the semantic search interface of the pre-built RAG knowledge base to obtain highly relevant original knowledge fragments. Finally, the highly relevant original knowledge fragments are aggregated to obtain a set of vulnerability-related knowledge.

[0059] Specifically, the pre-built RAG knowledge base refers to a pre-constructed domain knowledge database that retrieves search commands and outputs highly relevant original knowledge fragments. This embodiment does not limit the specific construction method of the RAG knowledge base; those skilled in the art can freely choose according to actual needs. For example, the original knowledge document set can be acquired, tagged to obtain knowledge units, and then vectorized to obtain vectorized knowledge units. Furthermore, the vectorized knowledge units can be organized and stored using an approximate nearest neighbor search index to obtain the RAG knowledge base. The original knowledge document set refers to a data set of neighborhood knowledge related to the target system. This embodiment does not limit the specific acquisition method of the original knowledge document set; those skilled in the art can freely choose according to actual needs, such as through public vulnerability databases, security research papers, and penetration testing manuals. The process involves acquiring the original knowledge document set. The tagging process refers to parsing the original knowledge document set using a rule engine, such as regular expressions, to extract key entities, such as vulnerability types and attack vectors, and converting them into knowledge units. A knowledge unit is an indivisible, smallest-granularity domain knowledge entity formed after tagging. Vectorization refers to mapping knowledge units into numerical vectors. In this embodiment, the Paython library is used for vectorization representation of knowledge units. The approximate nearest neighbor search index is a data structure algorithm for organizing and storing vectorized knowledge units. This embodiment does not limit the type of approximate nearest neighbor search index; those skilled in the art can freely choose according to actual needs, such as an HNSW graph, which stands for Hierarchical Small World Graph. In Navigable Small World graphs, the organization and storage refers to the process of establishing a persistent association between vectorized knowledge units and their corresponding sets of original knowledge documents, and storing them in a vector database in a partitioned manner. The query construction refers to the process of generating a context-rich query statement for retrieval based on the target intelligence archive. In this embodiment, query construction is performed using string interpolation. The retrieval instruction refers to a formatted query statement generated by query construction from the technology stack list and business function diagram, used to initiate a retrieval to the RAG knowledge base. The semantic retrieval interface of the pre-built RAG knowledge base refers to the functional module provided by the pre-built RAG knowledge base, which can understand the deeper meaning of the retrieval instruction and return a set of original knowledge documents related to the retrieval instruction. The vector similarity matching refers to the process of calculating the distance between the retrieval instruction and the vectorized knowledge units in the RAG knowledge base to quantify their semantic relevance, and outputting the vectorized knowledge unit with the highest semantic relevance as a highly relevant original knowledge fragment. The highly relevant original knowledge fragment refers to the fragment selected from the RAG knowledge base through vector similarity matching.The aggregation process refers to the process of deduplicating, summarizing, sorting, and logically integrating highly relevant original knowledge fragments through reordering to form a well-structured, complete, and non-redundant set of vulnerability knowledge.

[0060] Specifically, in step S2, the semantic retrieval of the RAG knowledge base is precisely driven by the target intelligence file, so as to integrate a highly relevant and structured set of vulnerability knowledge, thereby improving the targeting, coverage depth and overall efficiency of subsequent penetration testing.

[0061] Specifically, in step S3, a target penetration test plan is generated based on a vulnerability-related knowledge set and a pre-built penetration-related knowledge graph. Specifically, atomic test actions are extracted and classified through the vulnerability-related knowledge set to obtain atomic actions. The execution path of the basic test task is obtained based on the atomic actions. The execution path of the basic test task is optimized through the pre-built penetration-related knowledge graph to obtain a preliminary penetration test execution sequence. The task is sorted through a dynamic priority scheduling algorithm to obtain the target penetration test plan.

[0062] Specifically, the atomic test action extraction and classification refers to the process of parsing and breaking down textual vulnerabilities in the vulnerability-related knowledge set into indivisible, directly executable minimum operation units. In this embodiment, natural language processing technology is used to identify the operation objects and actions in the vulnerability-related knowledge set to obtain atomic actions. The basic test task execution path refers to a linear execution chain formed by initially linking multiple atomic actions. In this embodiment, preliminary temporal edges are established for atomic actions using preset rules. These preset rules refer to pre-defined simple preconditions for vulnerability exploitation, such as access to a personal homepage only after successful login. The pre-constructed penetration testing knowledge graph refers to a domain knowledge base that systematically represents the complex logical relationships between entities such as vulnerabilities, attack techniques, system components, and defense measures in the penetration testing field in a graph structure. This embodiment does not elaborate on the specific construction method of the penetration testing knowledge graph. The scope is limited, and those skilled in the art can freely choose according to actual needs. For example, by integrating multi-source heterogeneous domain knowledge and performing ontology modeling, a structured set of entity relationship triples is obtained. Then, the set of triples is stored in a graph database, and the graph database's built-in graph algorithm and inference engine are used to perform relationship completion and consistency verification to obtain a penetration testing knowledge graph. The path optimization refers to the process of using the vulnerability logical relationships in the penetration testing knowledge graph, such as preconditions, conflicts, and combinations, to complete the dependencies and resolve conflicts in the execution path of the basic test tasks, thereby generating a preliminary penetration test execution sequence. The preliminary penetration test execution sequence refers to the logically complete task list output after path optimization. The task sorting refers to the process of using a dynamic priority scheduling algorithm to calculate the global importance of all tasks in the preliminary penetration test execution sequence and rearrange their execution order to obtain the target penetration test plan.

[0063] Specifically, in step S3, planning and scheduling based on the penetration-related knowledge graph are used to transform discrete vulnerability knowledge into a logically rigorous and parallel-executable target penetration test plan, thereby improving the path coverage, execution reliability, and resource utilization efficiency of automated penetration testing and reducing reliance on human experience.

[0064] Specifically, in step S4, the target penetration test plan is tested in parallel through a multi-agent cluster. Specifically, the target penetration test plan is dynamically scheduled through a scheduling center to obtain task dynamics. The tasks are dynamically allocated to the multi-agent cluster for parallel execution to obtain preliminary test results. The preliminary test results are collected in real time through a status monitor.

[0065] Specifically, the scheduling center refers to the core control module responsible for coordinating the testing work of multiple agents. Its function is to continuously receive the target penetration test plan, and based on the real-time system status, perform task decomposition, priority ranking, resource allocation, and execution monitoring. Dynamic resource scheduling refers to the decision-making process by which the scheduling center matches and binds the atomic actions in the target penetration test plan with the computational resources required for their execution in real time. This process must simultaneously satisfy the goals of task dependency, resource constraints, and optimal efficiency. In this embodiment, a directed acyclic graph parser is used to decompose task dependencies, and constraint satisfaction problem solving is applied for real-time matching to obtain task dynamics. Task dynamics refer to the executable task instances generated after dynamic resource scheduling, with clear resource bindings, such as which agent they are assigned to, as well as execution parameters and control instructions. Parallel execution refers to… Under the coordination of the scheduling center, a multi-agent cluster simultaneously executes its assigned tasks dynamically. The multi-agent cluster refers to a collection of multiple agents with specialized testing capabilities, such as vulnerability brute-force, protocol fuzzing, and logical privilege escalation detection, that work in parallel to dynamically execute tasks under the unified coordination of the scheduling center. The preliminary test results refer to the set of execution feedback data produced by the multi-agent cluster after completing a single task, such as error logs and system performance indicators. The state monitor is a system component responsible for real-time aggregation, lightweight filtering, and unified formatting of all preliminary test results. This embodiment does not limit the specific location of the state monitor; those skilled in the art can freely choose according to actual needs, such as building it on an event stream platform and collecting preliminary test results from the multi-agent cluster through a data collection agent.

[0066] Specifically, in step S4, the dynamic resource scheduling of the scheduling center and the parallel execution of the multi-agent cluster are used to efficiently transform the target penetration test plan into actual action and maximize the use of system resources, thereby improving the execution speed, overall throughput and task coverage of the penetration test.

[0067] Specifically, in step S5, the target penetration test plan is recursively optimized based on the preliminary test results using a recursive optimization method.

[0068] Specifically, in step S6, when obtaining the target task value sc, the number of executed tests and the estimated total number of test points are obtained, and the number of executed tests and the estimated total number of test points are normalized to obtain the normalized value of the number of executed tests mgy and the normalized value of the estimated total number of test points mky.

[0069] The target task value sc is calculated based on the normalized value of the number of executed tests (mcy), the normalized value of the estimated total number of test points (mky), the initial risk value (v0), and the value decay coefficient (k). The value of the target task sc is set as [1-k×(mcy / mky)]×v0.

[0070] The target task value sc is compared with the preset target task value sc0. Based on the comparison result, the state of the target task value is judged, and the recursive optimization process is iteratively optimized based on the judgment result, wherein:

[0071] When sc≤sc0, the target task value is determined to be low, and no iterative optimization is performed on the recursive optimization process.

[0072] When sc > sc0, the target task value is determined to be at a high level. The recursive optimization process is iteratively optimized: the preset iteration number CY0 is optimized by the iterative optimization coefficient dn to obtain the optimized preset iteration number CY01. CY01 is set as dn × CY0. The optimized preset iteration number CY01 is used as the preset iteration number CY0, and the iteration number CY is compared with the preset iteration number CY0 again.

[0073] Specifically, the number of executed tests refers to the cumulative number of atomic actions that have actually been initiated and completed during the recursive optimization process of the current test task. In this embodiment, the number of executed tests is read from the system operation log. The estimated total number of test points refers to the pre-estimation of the total number of atomic actions that the current test task theoretically needs to complete before the test begins. In this embodiment, the estimated total number of test points is obtained through a pre-built RAG knowledge base. The normalization process refers to the process of mapping the number of executed tests and the estimated total number of test points to the [0,1] interval respectively using the maximum-minimum normalization method. The initial risk value refers to the value allocated to the test task before the test begins and does not change during the test process. The baseline risk score, the initial risk value, ranges from [0,1]. In this embodiment, the initial risk value is assigned a value through a predefined risk value mapping table. This embodiment does not limit the specific settings of the risk value mapping table; those skilled in the art can freely choose according to actual needs. For example, according to internal security standards, the test task related to core payment functions can be assigned a value of 100, the test task related to password reset can be assigned a value of 90, and the test task related to public information query can be assigned a value of 30. The value decay coefficient refers to an adjustment parameter between 0 and 1, used to reflect the rate of decrease of the target task value sc. This embodiment does not specify the specific value decay coefficient k. The value is limited, and those skilled in the art can freely choose according to actual needs. For example, based on historical experience, k=0.5 can be set to balance the depth and breadth of penetration testing. If k<0.5, the system may become overly immersed in high-risk tasks and fail to effectively cover other attack surfaces. If k>0.5, the system may give up prematurely before the verification of complex vulnerabilities is completed. The preset target task value refers to a preset value for judging the state of the target task value. This embodiment does not limit the specific value setting of the preset target task value sc0. Those skilled in the art can freely choose according to actual needs. For example, based on historical risk-reward, sc0=0.7 can be set. If sc0<0.5, the system may become overly immersed in high-risk tasks and fail to effectively cover other attack surfaces. 7. Potential benefits are usually insufficient to support the marginal cost of multiple rounds of deep recursion. If sc0 > 0.7, the expected benefits of investing additional resources for deep mining will exceed the costs. The state of the target task value refers to the degree of the target task value, including low and high. This embodiment does not limit the specific value of the iterative optimization coefficient dn. Those skilled in the art can freely choose according to actual needs, as long as the requirement of 1 < dn < 2 is met. For example, dn = 1.2 can be set according to historical optimization experiments. The historical optimization experiments refer to the process of taking multiple values ​​of the iterative optimization coefficient dn in the past and comparing the iterative optimization effect to obtain the optimal value of the iterative optimization coefficient dn.

[0074] Specifically, in step S6, the value of the target task is judged to identify high-value tasks and dynamically increase their recursion depth limit, thereby achieving precise and flexible allocation of limited testing resources and improving the testing depth and vulnerability discovery efficiency of the core attack surface.

[0075] Please see Figure 2 As shown, this is a flowchart illustrating the recursive optimization method of this embodiment. The recursive optimization method includes:

[0076] Step S51: Perform contradiction detection on the preliminary test results to obtain contradiction detection results, and optimize the scope of the generation process of the vulnerability-related knowledge set based on the contradiction detection results;

[0077] Step S52: Perform correlation analysis on the preliminary test results to obtain the correlation analysis results; and adjust the target penetration test plan based on the correlation analysis results.

[0078] Step S53: Obtain the number of iterations and perform convergence processing on the plan adjustment process based on the number of iterations.

[0079] Specifically, in step S51, contradiction detection is performed on the preliminary test results, which involves: the preliminary test results are aggregated and standardized by the monitoring module to obtain execution result records; the execution result records are logically compared by a predefined set of contradiction rules to obtain contradiction detection results; the contradiction detection results include results that are contradictory and results that are not contradictory.

[0080] When the contradiction detection result is that there is no contradiction, the scope optimization is not performed on the generation process of the vulnerability-related knowledge set;

[0081] When the contradiction detection result indicates the existence of a contradiction, the generation process of the vulnerability-related knowledge set is optimized by performing multi-perspective retrieval on the pre-built RAG knowledge base.

[0082] Specifically, the monitoring module refers to a system component responsible for real-time collection, filtering, and preliminary integration of preliminary test results from multiple agents. The convergence standardization refers to the process by which the monitoring module extracts key fields, standardizes data formats and timestamps, and maps the preliminary test results into structured data units. This embodiment uses event standardization technology for convergence standardization. For example, an event standardization pipeline is executed on the preliminary test results, outputting execution result records. These execution result records are structured data units in a unified format generated after convergence standardization. The predefined set of conflict rules refers to a pre-defined set of rules used to determine whether there are logical conflicts in the execution result records, such as returning a refund upon confirmation of receipt and upon request for a refund. Successful response. The logical comparison refers to the process of scanning and matching execution result records according to a predefined set of contradictory rules to automatically identify execution result records that violate the rules. The contradiction detection result of "no contradiction" means that after logical comparison, the execution result record does not violate the predefined set of contradictory rules. The contradiction detection result of "contradictory" means that after logical comparison, at least one record in the execution result record violates the predefined set of contradictory rules. The multi-perspective retrieval refers to the process of expanding the retrieval scope of the pre-built RAG knowledge base and performing multiple retrievals of the RAG knowledge base from different dimensions, such as vulnerability type, exploitation stage, and bypass techniques, by constructing multiple query commands with different focuses.

[0083] Specifically, in step S51, the preliminary test results are aggregated and standardized, and a predefined set of conflict rules is applied for consistency verification. This facilitates the rapid identification of logical conflicts and environmental interference during the testing process, thereby improving the input quality of the recursive optimization stage and the reliability of the penetration test conclusions.

[0084] Specifically, in step S52, the preliminary test results are analyzed for correlation. Specifically, entity relationships are extracted from the contradiction detection results through a penetration correlation knowledge graph to obtain a related entity subgraph network. Pattern matching is performed on the related entity subgraph network through predefined logical rules to obtain preliminary analysis results. Then, logical inference is performed on the preliminary analysis results through a rule inference engine to obtain the correlation analysis results.

[0085] Specifically, entity relationship extraction refers to the process of retrieving and extracting all other key entities directly connected to the key entities in the contradiction detection results, along with their relationship types, from a pre-constructed penetration testing knowledge graph, using key entities in the contradiction detection results (such as specific vulnerability types, attacked API endpoints, and abnormal parameters) as indexes. The related entity subgraph network refers to a local graph structure obtained through entity relationship extraction, centered on the key entities in the contradiction detection results and with other entities in the penetration testing knowledge graph related to the key entities in the contradiction detection results as nodes. The predefined logical rules refer to a set of pre-defined conditional statements describing the inherent logical relationships between entities in the penetration testing domain, such as combination, dependency, and mutual exclusion. This embodiment does not limit the specific setting of the predefined logical rules; those skilled in the art can freely choose according to actual needs. For example, if there is both an SQL injection vulnerability and a file upload vulnerability, and both affect the same server component, it may constitute a combined attack chain: obtaining the absolute path of a file through SQL injection, and then writing a Webshell through the file upload vulnerability. SQL refers to Structured Query Language. In the context of language, "Webshell" refers to a webpage backdoor. "Pattern matching" refers to comparing the structure presented in the relevant entity subgraph network with predefined logical rules based on graph algorithms. The process involves: extracting all subgraph instances that conform to predefined logical patterns from the relevant entity subgraph network through structured queries driven by a rule engine; performing logical consistency verification and conflict resolution on the subgraph instances through an inference engine to obtain preliminary analysis results; "logical inference" refers to performing chain-like logical deduction on the preliminary analysis results based on the penetration association knowledge graph through a rule inference engine to obtain association analysis results; and "association analysis results" refers to a report reflecting whether there are potential attacks in the preliminary test results, and the attack scenario conclusion report when potential attacks exist, such as the type and path of association when potential attacks exist.

[0086] Specifically, in step S52, the preliminary test results are analyzed by penetration association knowledge graph so that the system can understand the potential combinations and root causes of contradictions between vulnerabilities, transforming surface contradictions into precise logical insights of associations, thereby improving the intelligence of recursive optimization, the pertinence of testing strategies and the depth of vulnerability discovery.

[0087] Specifically, in step S52, the target penetration test plan is adjusted based on the correlation analysis results, as follows:

[0088] If no potential attacks are found in the correlation analysis results, the target penetration test plan will not be adjusted.

[0089] When a potential attack is detected in the correlation analysis results, the target penetration test plan is adjusted: the atomic actions are updated according to the correlation analysis results to obtain new atomic actions, and new test tasks are generated based on the new atomic actions. The new test tasks are added to the initial penetration test execution sequence, and the tasks are reordered using a dynamic priority scheduling algorithm.

[0090] Specifically, the absence of potential attacks in the association analysis results means that the entity associations in the relevant entity subgraph network do not constitute an exploitable security risk. The presence of potential attacks in the association analysis results means that the entity associations in the relevant entity subgraph network point to an exploitable attack chain. The action update refers to the process of specifically adapting and instantiating the underlying operation logic and parameters required to generate the test task. In this embodiment, the template engine loads the atomic action template that matches the association analysis results and binds the parameters to obtain a new atomic action. The new test task refers to an independent verification instruction set obtained from the action update for verifying potential attack associations. In this embodiment, the new atomic action is encapsulated and metadata is appended through a task orchestrator. Dependency analysis and execution condition settings are performed to obtain a new test task. The encapsulation refers to the software engineering process of packaging the new atomic action into an independent, self-describing task object. The metadata appending refers to the process of adding auxiliary data to the task object during the encapsulation process to describe the task's own attributes and control the task's execution behavior.

[0091] Specifically, in step S52, the target penetration test plan is adjusted based on the correlation analysis results, so that the system can understand the potential combinations and attack chain relationships between vulnerabilities, thereby improving the targeting of recursive optimization test actions and the efficiency of vulnerability discovery.

[0092] Specifically, in step S53, the iteration number CY is obtained, compared with the preset iteration number CY0, the state of the iteration number is judged based on the comparison result, and the process of adjusting the plan is converged based on the judgment result, wherein:

[0093] When CY < CY0, the iteration count is determined to be insufficient, and the process of adjusting the plan is not converged.

[0094] When CY≥CY0, the iteration count is determined to be met, and the process of adjusting the plan is converged: the current test task is marked as terminated.

[0095] Specifically, the iteration count refers to the cumulative number of rounds of contradiction detection and correlation analysis performed by the system for the same test task during the recursive optimization process. In this embodiment, the iteration count is obtained through system logs. The preset iteration count refers to a preset value for judging the status of the iteration count. This embodiment does not limit the specific value of the preset iteration count CY0. Those skilled in the art can freely choose according to actual needs. For example, according to the mainstream attack framework, the core technical steps of a test task are usually between 3 and 5 steps. Therefore, CY0=5 is set to provide the system with sufficient depth to explore the test task while preventing infinite idle time. The status of the iteration count refers to the degree of achievement of the iteration count, including achievement and non-achievement. The current test task refers to the execution unit that is being processed by the intelligent agent during the recursive optimization process and is used to verify specific vulnerabilities.

[0096] Specifically, in step S53, the state of the iteration count is determined so that the deep recursive optimization of the current test task can be terminated in a timely manner when the resource input limit is reached, thereby releasing computing resources in a timely manner to improve the efficiency of the overall test process.

[0097] Please see Figure 3 As shown, this is a schematic diagram of the system structure of the automated penetration testing method based on RAG and multi-agent systems in this embodiment. The system includes:

[0098] The vulnerability profile scanning module is used to scan the target system to obtain vulnerability intelligence profiles, and to perform structured processing on the vulnerability intelligence profiles to obtain target intelligence profiles.

[0099] The test plan generation module is used to generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base, and to generate a target penetration test plan based on the set of vulnerability-related knowledge and the pre-built penetration association knowledge graph.

[0100] The test plan execution module is used to perform parallel testing of the target penetration test plan through multiple intelligences, obtain preliminary test results, and recursively optimize the target penetration test plan based on the preliminary test results using a recursive optimization method.

[0101] The task value optimization module is used to obtain the value of the target task and iteratively optimize the recursive optimization process based on the value of the target task.

[0102] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. An automated penetration testing method based on RAG and multi-agent systems, characterized in that, The method includes: Step S1: Scan the target system to obtain vulnerability intelligence files, and perform structured processing on the vulnerability intelligence files to obtain target intelligence files. Step S2: Generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base; Step S3: Generate a target penetration test plan based on the vulnerability-related knowledge set and the pre-built penetration-related knowledge graph; Step S4: Perform parallel testing of the target penetration testing plan using multiple intelligent methods to obtain preliminary test results; Step S5: Based on the preliminary test results, recursively optimize the target penetration test plan using a recursive optimization method. Step S6: Obtain the target task value and iteratively optimize the recursive optimization process based on the target task value. The recursive optimization method includes: Step S51: Perform contradiction detection on the preliminary test results to obtain contradiction detection results, and optimize the scope of the generation process of the vulnerability-related knowledge set based on the contradiction detection results; Step S52: Perform correlation analysis on the preliminary test results to obtain the correlation analysis results; and adjust the target penetration test plan based on the correlation analysis results. Step S53: Obtain the number of iterations and perform convergence processing on the plan adjustment process based on the number of iterations.

2. The automated penetration testing method based on RAG and multi-agent systems according to claim 1, characterized in that, In step S2, a set of vulnerability-related knowledge is generated based on the target intelligence file and the pre-built RAG knowledge base. Specifically, the search is constructed by querying the technology stack list and business function diagram in the target intelligence file to obtain a search instruction. The search instruction is then matched with vector similarity through the semantic search interface of the pre-built RAG knowledge base to obtain highly relevant original knowledge fragments. Finally, the highly relevant original knowledge fragments are aggregated to obtain a set of vulnerability-related knowledge.

3. The automated penetration testing method based on RAG and multi-agent systems according to claim 2, characterized in that, In step S3, a target penetration test plan is generated based on a vulnerability-related knowledge set and a pre-built penetration-related knowledge graph. Specifically, atomic test actions are extracted and classified using the vulnerability-related knowledge set to obtain atomic actions. The execution paths of basic test tasks are obtained based on the atomic actions. The execution paths of basic test tasks are optimized using the pre-built penetration-related knowledge graph to obtain a preliminary penetration test execution sequence. Finally, the tasks are sorted using a dynamic priority scheduling algorithm to obtain the target penetration test plan.

4. The automated penetration testing method based on RAG and multi-agent systems according to claim 3, characterized in that, In step S4, the target penetration test plan is tested in parallel by multiple intelligences. Specifically, the target penetration test plan is dynamically scheduled by the scheduling center to obtain task dynamics. The tasks are dynamically allocated to the multi-agent cluster for parallel execution to obtain preliminary test results. The preliminary test results are collected in real time by the status monitor.

5. The automated penetration testing method based on RAG and multi-agent systems according to claim 4, characterized in that, In step S5, the target penetration test plan is recursively optimized based on the preliminary test results using a recursive optimization method. In step S51, contradiction detection is performed on the preliminary test results. Specifically, the preliminary test results are aggregated and standardized by the monitoring module to obtain execution result records. The execution result records are logically compared by a predefined set of contradiction rules to obtain contradiction detection results. The contradiction detection results include results that are contradictory and results that are not contradictory. When the contradiction detection result is that there is no contradiction, the scope optimization is not performed on the generation process of the vulnerability-related knowledge set; When the contradiction detection result indicates the existence of a contradiction, the generation process of the vulnerability-related knowledge set is optimized by performing multi-perspective retrieval on the pre-built RAG knowledge base.

6. The automated penetration testing method based on RAG and multi-agent systems according to claim 5, characterized in that, In step S52, the preliminary test results are analyzed for correlation. Specifically, entity relationships are extracted from the contradiction detection results through a penetration correlation knowledge graph to obtain a related entity subgraph network. Pattern matching is performed on the related entity subgraph network through predefined logical rules to obtain preliminary analysis results. Then, logical inference is performed on the preliminary analysis results through a rule inference engine to obtain the correlation analysis results.

7. The automated penetration testing method based on RAG and multi-agent systems according to claim 6, characterized in that, In step S52, the target penetration test plan is adjusted based on the correlation analysis results, specifically as follows: If no potential attacks are found in the correlation analysis results, the target penetration test plan will not be adjusted. When a potential attack is detected in the correlation analysis results, the target penetration test plan is adjusted: the atomic actions are updated according to the correlation analysis results to obtain new atomic actions, and new test tasks are generated based on the new atomic actions. The new test tasks are added to the initial penetration test execution sequence, and the tasks are reordered using a dynamic priority scheduling algorithm.

8. The automated penetration testing method based on RAG and multi-agent systems according to claim 7, characterized in that, In step S53, the iteration number CY is obtained, compared with the preset iteration number CY0, the state of the iteration number is judged based on the comparison result, and the process of adjusting the plan is converged based on the judgment result, wherein: When CY < CY0, the iteration count is determined to be insufficient, and the process of adjusting the plan is not converged. When CY≥CY0, the iteration count is determined to be met, and the process of adjusting the plan is converged: the current test task is marked as terminated.

9. The automated penetration testing method based on RAG and multi-agent systems according to claim 8, characterized in that, In step S6, when obtaining the target task value sc, the number of executed tests and the estimated total number of test points are obtained, and the number of executed tests and the estimated total number of test points are normalized to obtain the normalized value of the number of executed tests mgy and the normalized value of the estimated total number of test points mky. The target task value sc is calculated based on the normalized value of the number of executed tests (mcy), the normalized value of the estimated total number of test points (mky), the initial risk value (v0), and the value decay coefficient (k). The value of the target task sc is set as [1-k×(mcy / mky)]×v0. The target task value sc is compared with the preset target task value sc0. Based on the comparison result, the state of the target task value is judged, and the recursive optimization process is iteratively optimized based on the judgment result, wherein: When sc≤sc0, the target task value is determined to be low, and no iterative optimization is performed on the recursive optimization process. When sc > sc0, the target task value is determined to be at a high level. The recursive optimization process is iteratively optimized: the preset iteration number CY0 is optimized by the iterative optimization coefficient dn to obtain the optimized preset iteration number CY01. CY01 is set as dn × CY0. The optimized preset iteration number CY01 is used as the preset iteration number CY0, and the iteration number CY is compared with the preset iteration number CY0 again.

10. A system for applying the automated penetration testing method based on RAG and multi-agent systems as described in any one of claims 1-9, the system comprising: The vulnerability profile scanning module is used to scan the target system to obtain vulnerability intelligence profiles, and to perform structured processing on the vulnerability intelligence profiles to obtain target intelligence profiles. The test plan generation module is used to generate a set of vulnerability-related knowledge based on the target intelligence file and the pre-built RAG knowledge base, and to generate a target penetration test plan based on the set of vulnerability-related knowledge and the pre-built penetration association knowledge graph. The test plan execution module is used to perform parallel testing of the target penetration test plan through multiple intelligences, obtain preliminary test results, and recursively optimize the target penetration test plan based on the preliminary test results using a recursive optimization method. The task value optimization module is used to obtain the value of the target task and iteratively optimize the recursive optimization process based on the value of the target task.

Images