A CT type multi-agent attack path decision and risk fusion method and system

Abstract

The application relates to a CT type multi-agent attack path decision and risk fusion method and system. The system comprises a task arrangement and constraint module, a planning agent, a dynamic decision module, a tool execution agent, a verification and homologous checking agent, a clue extraction agent, an experience memory and recursive generalization module, a post-penetration information fusion module, a risk view construction module and a report output module. Through multi-agent cooperation, the penetration testing task is divided into attack hypothesis generation, candidate action scoring, dynamic priority sorting, tool execution, result verification, clue extraction, experience recall, information fusion and risk graph construction. The degree of automation of penetration testing, the flexibility of path decision and the visualization and traceability of risk results are improved.

Description

Technical Field

[0001] This application relates to the field of automated penetration testing technology, and in particular to a CT-style multi-agent attack path decision-making and risk fusion method and system. Background Technology

[0002] Automated penetration testing requires completing target identification, attack surface mapping, vulnerability verification, path adjustment, post-exploitation information processing, and risk report generation within authorized boundaries. Existing path planning techniques typically use attack graphs, vulnerability scoring, game theory models, incident response, or similar scenario matching to select paths. While these techniques can improve the automation efficiency of some steps, they still have the following drawbacks: First, the task breakdown is too coarse-grained. Existing technologies cannot break down complex penetration tasks into sub-task units that can be executed collaboratively, resulting in a lack of fine control over complex scenarios in attack path planning and an easy oversight of key attack surfaces.

[0003] Second, the separation of the tool execution phase from the analysis and verification phase makes it difficult to provide timely feedback to the decision-making level and affect subsequent path adjustments. This results in a fragmented penetration process, reducing the real-time nature and accuracy of closed-loop decision-making.

[0004] Third, failure experiences are difficult to record and transfer effectively. When an attack path fails, the system cannot structure and store the failure conditions, bypass conditions, and scenario characteristics as reusable knowledge, leading to repeated resource consumption in similar scenarios and making it difficult to improve efficiency.

[0005] Fourth, the multi-source heterogeneous information generated in the post-penetration phase, including command echoes, credential information, configuration files, network connections, and permission data, lacks a unified structured fusion mechanism, making it difficult to aggregate and form a global risk view. This makes it impossible for security analysts to intuitively understand the attack chain, the scope of impact, and the source of evidence.

[0006] Therefore, there is an urgent need for a penetration testing method that can achieve fine task breakdown, dynamic path adjustment, effective reuse of experience, and global fusion of post-penetration information. Summary of the Invention

[0007] Based on this, the present invention aims to solve the problems of difficulty in coordinating attack path planning and execution, inability to dynamically adjust path decisions based on new clues, and difficulty in aggregating multi-source information in post-penetration. By constructing a multi-agent collaborative framework, the penetration task is decomposed into a planning agent, a tool execution agent, a verification agent, a clue extraction agent, an experience memory agent, and a risk fusion agent. Combining large-scale model reasoning, recursive generalization algorithms, and a risk view construction mechanism, the attack chain can be autonomously deduced, dynamically adjusted, and the results can be presented globally.

[0008] Firstly, this application provides a CT-style multi-agent attack path decision-making and risk fusion system. It includes: The task orchestration and constraint module is used to receive target information, authorization scope, task preferences, prohibited operations, available tool sets and output format requirements, and generate task context data objects. The planning agent is used to generate a set of attack hypotheses and a set of candidate actions based on the task context. Each attack hypothesis includes an attack surface, vulnerability type, preconditions, expected evidence, risk impact, and confidence level. Each candidate action includes a tool, parameter template, boundary, timeout, expected output, and rollback rules. The dynamic decision-making module is used to update the priority of the to-do list based on new clues, task benefits, execution costs, risk levels, number of failures, similar experiences, and authorization constraints, and to calculate a priority value for each task. The calculation of the priority value involves new clue gain, vulnerability impact, hypothesis confidence, expected evidence completeness, experience similarity, cost, operational risk, number of consecutive failures, and penalties for exceeding boundaries or policy conflicts. The tool execution agent is used to invoke various security tools to perform actions based on the priority and output an action result data object. The action result data object includes action identifier, status, original evidence path, normalized observation, error type and cost. The verification and same-origin check agent is used to perform fact verification on the action result, extract entity information and generate verified discovery data objects. The verified discovery data objects include source action, entity identifier set, same-origin flag, confidence level, evidence identifier set and rejection reason. A clue extraction agent is used to transform the verified findings into a clue set data object, which includes entities, relationships, risk tags, optional next steps, and fields requiring manual confirmation. The experience memory and recursive generalization module is used to write verified attack steps, failure conditions, bypass conditions, tool parameters, scenario features and risk conclusions into the experience base, and to calculate scenario similarity based on new scenarios to recall historical strategies. The scenario similarity is obtained by weighted calculation of topological feature similarity, vulnerability feature similarity and action sequence similarity. The post-penetration information fusion module is used to structurally merge command echoes, credentials, permissions, host information, processes, configuration files, database connections, callback platform results, and vulnerability verification results to generate entity, relation, and evidence triples. The risk view construction module is used to transform the triples into a risk graph. The risk graph includes asset nodes, service nodes, vulnerability nodes, credential nodes, permission nodes, task nodes, step nodes, evidence nodes, and remediation suggestion nodes, as well as edges representing execution order, dependency relationships, impact relationships, and evidence source relationships. Each node and edge is associated with risk level, confidence level, timestamp, and handling status. The report output module is used to generate risk profiles, verification evidence, scope of impact, remediation suggestions, and retesting suggestions according to the attack chain, and to accumulate reusable experience into the experience library.

[0009] Optionally, in one embodiment of this application, the planning agent further includes a scoring matrix decision unit, used to calculate a score value for each attack hypothesis and each candidate action. The score value is calculated based on the hypothesis target benefit, hypothesis confidence, expected evidence gain, tool matching degree, operational risk, execution cost, and the penalty for the most recent failure on the same path. The system selects a predetermined number of candidate actions with the highest score values ​​that do not conflict with each other to enter the to-do list.

[0010] Optionally, in one embodiment of this application, the dynamic decision-making module is further configured to update the task status after each round of execution: When the result of the action generates incremental clues or highly credible evidence, the priority value of the same attack hypothesis and its dependent actions is increased. When there is no increment in the predetermined number of consecutive attempts and the error type is the same, mark the path as blocked and record the reason for the blockage. When other paths generate new credentials, entry points, or configuration evidence that render the blocking cause invalid, the path is reactivated and enters the candidate queue with a lower initial priority.

[0011] Optionally, in one embodiment of this application, in the experience memory and recursive generalization module, the topological feature similarity is related to the number of assets, entry depth, port and protocol set, network partition, service dependency and access boundary; the vulnerability feature similarity is related to the vulnerability category, weak configuration type, severity, exploitation preconditions, evidence type and patch status; and the action sequence similarity is related to the action type sequence, tool parameters, success and failure transition, and evidence generation order.

[0012] Optionally, in one embodiment of this application, the verification and homology check agent is further configured to write the result to the intelligence pool without triggering further execution when the verified homology flag is false.

[0013] Optionally, in one embodiment of this application, the clue extraction agent is further configured to mark a clue as an incremental clue when it satisfies one of the following: new asset, new interface, new credentials, new permissions, or new vulnerability evidence; and to serve as failure feedback or low-gain feedback for path scoring when the clue merely repeats known facts.

[0014] Optionally, in one embodiment of this application, the risk view construction module is further configured to generate an interactive graph by receiving incremental graph events via WebSocket at the front end, supporting filtering by asset, vulnerability type, evidence credibility, authorization scope and remediation status, and displaying the corresponding original evidence path, execution steps, verification results and remediation suggestions when a node is clicked.

[0015] Optionally, in one embodiment of this application, the task orchestration and constraint module is further configured to determine the same-source boundary based on protocol, host, port, path prefix and organization authorization record, and to record the boundary crossing discovery only as intelligence record and not add it to the attack plan.

[0016] Optionally, in one embodiment of this application, the triplet format generated by the post-penetration information fusion module is subject, predicate, object, evidence identifier, confidence level, and timestamp, wherein the predicate includes discovery relationship, verification relationship, dependency relationship, cause relationship, influence relationship, use credential relationship, and mitigation relationship.

[0017] Secondly, this application also provides a CT-style multi-agent attack path decision-making and risk fusion method. The method includes: Obtain target information, authorization scope, task preferences, prohibited operations, available toolset and output format requirements, and generate a task context data object; A set of attack hypotheses and a set of candidate actions are generated based on the task context. Each attack hypothesis includes the attack surface, vulnerability type, preconditions, expected evidence, risk impact, and confidence level. Each candidate action includes the tool, parameter template, boundary, timeout, expected output, and rollback rules. The priority of the to-do list is updated based on new clues, task benefits, execution costs, risk levels, number of failures, similar experiences, and authorization constraints. A priority value is calculated for each task. The calculation of the priority value involves new clue gain, vulnerability impact, hypothesis confidence, expected evidence completeness, experience similarity, cost, operational risk, number of consecutive failures, and penalties for going out of bounds or policy conflicts. Multiple security tools are invoked to perform actions based on the priority, and an action result data object is output. The action result data object includes action identifier, status, original evidence path, normalized observation, error type, and cost. The results of the actions are verified, entity information is extracted, and a verified discovery data object is generated. The verified discovery data object includes the source action, entity identifier set, same-origin flag, confidence level, evidence identifier set, and rejection reason. The verified findings are transformed into clue set data objects, which contain entities, relationships, risk tags, optional next steps, and fields requiring manual confirmation. Verified attack steps, failure conditions, bypass conditions, tool parameters, scenario features, and risk conclusions are written into the experience base. Scenario similarity is calculated based on new scenarios to recall historical strategies. The scenario similarity is obtained by weighted calculation of topological feature similarity, vulnerability feature similarity, and action sequence similarity. The command echoes, credentials, permissions, host information, processes, configuration files, database connections, callback platform results, and vulnerability verification results are structured and merged to generate entity, relation, and evidence triples. The triples are transformed into a risk graph, which includes asset nodes, service nodes, vulnerability nodes, credential nodes, permission nodes, task nodes, step nodes, evidence nodes, and remediation suggestion nodes, as well as edges representing execution order, dependency relationships, impact relationships, and evidence source relationships. Each node and edge is associated with risk level, confidence level, timestamp, and handling status. Based on the attack chain, risk profiles, verification evidence, scope of impact, remediation suggestions, and retesting suggestions are generated, and reusable experiences are accumulated in the experience library.

[0018] The above-mentioned CT-based multi-agent attack path decision-making and risk fusion method and system have the following advantages compared with existing technologies: First, it can break down complex penetration tasks into multiple specialized intelligent agents that work together, reducing the probability of missing key clues with a single model or process.

[0019] Second, it can dynamically adjust the attack path based on new discoveries, failure feedback, similar experiences, and common source boundaries, enabling the path planning to have interpretable closed-loop decision-making capabilities.

[0020] Third, it can reuse experience from similar scenarios through recursive generalization algorithms based on topological feature similarity, vulnerability feature similarity, and action sequence similarity, thereby improving the efficiency and success rate of path planning.

[0021] Fourth, it can structure and integrate multi-source information from the post-penetration phase into a risk map, enabling security personnel to quickly understand the attack chain, scope of impact, sources of evidence, and remediation priorities.

[0022] Fifth, it can retain the traceability of risk conclusions using evidenceId, stable entity bonds, and graph relationships, facilitating verification, retesting, and the formation of a precipitable experience base. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the structure of a CT-type multi-agent attack path decision and risk fusion system in one embodiment; Figure 2 This is a flowchart illustrating a CT-based multi-agent attack path decision-making and risk fusion method in one embodiment. Figure 3 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0025] In one embodiment, such as Figure 1 As shown, a CT-style multi-agent attack path decision-making and risk fusion system is provided, including: The task orchestration and constraint module receives target information, authorization scope, task preferences, prohibited operations, available tool sets, and output format requirements, and generates a task context data object, TaskContext. The TaskContext contains at least the fields target, scope, policy, toolSet, timeLimit, evidenceStore, and reportProfile. This module determines the same-origin boundary based on protocol, host, port, path prefix, and organization authorization records, and only records boundary violations as intelligence, not directly adding them to the attack plan.

[0026] A planning agent is used to generate a set of attack hypotheses based on the TaskContext. and candidate action set Each attack hypothesis includes the fields attackSurface, vulnType, precondition, expectedEvidence, riskImpact, and confidence. Each candidate action includes the fields tool, paramTemplate, boundary, timeout, expectedOutput, and rollbackRule. The planning agent first filters actions that do not meet the authorization boundary or precondition, and then forms parallelizable atomic actions based on hypothesis confidence, evidence gaps, and tool capabilities.

[0027] The decision-making algorithm of the planning agent uses a candidate action scoring matrix M. For the i-th hypothesis and the j-th candidate action, the score value is calculated as follows:

[0028] in, Assuming a target return, To establish the reliability of the hypothesis, For the expected gain of evidence, For tool matching degree, To mitigate operational risks, For execution costs, Penalty for the most recent failure along the same path. All variables are normalized to the interval between 0 and 1. The weights are configurable, and both positive and penalty weights are normalized. The system selects... The highest-scoring and non-conflicting Top-K actions are added to the to-do list, and the scoring criteria for each action are recorded.

[0029] The dynamic decision-making module updates the priority of the to-do list based on new leads, task benefits, execution costs, risk levels, number of failures, similar experiences, and authorization constraints, and calculates a priority value for each task. For candidate task t, the priority value calculation formula is:

[0030] in, To enhance new clues, Due to the vulnerability, To establish the reliability of the hypothesis, For the expected completeness of evidence, For experience similarity, For cost, To mitigate operational risks, The number of consecutive failures. Penalties for exceeding boundaries or policy conflicts. When At that time, the task is filtered or downgraded to the manual review queue. Configurable weights.

[0031] The tool execution agent is used to invoke various security tools to perform actions based on the stated priority and output an action result data object, ActionResult. The ActionResult includes at least the fields actionId, status, rawEvidencePath, normalizedObservation, errorType, cost, startedAt, and finishedAt. Raw evidence only enters the evidence repository; subsequent modules only consume the normalized results and evidence index.

[0032] The validation and same-origin check agent is used to perform fact verification on the ActionResult, extract entity information, and generate a validated discovery data object, ValidatedFinding. ValidatedFinding includes the fields sourceAction, entityIds, sameOriginFlag, confidence, evidenceIds, and rejectionReason. When sameOriginFlag is false, the result is only written to the intelligence pool and does not trigger further execution.

[0033] A lead extraction agent is used to transform the ValidatedFinding into a lead set data object ClueSet. The ClueSet contains entities, relationships, risk tags, optional next steps, and fields requiring manual confirmation. If a lead meets one of the criteria of a new asset, new interface, new credentials, new permissions, or new vulnerability evidence, it is marked as an incremental lead; if it only repeats known facts, it is treated as a failure or low-gain feedback in path scoring.

[0034] The experience memory and recursive generalization module is used to write verified attack steps, failure conditions, bypass conditions, tool parameters, scenario features, and risk conclusions into the experience base. It then calculates scenario similarity based on new scenarios to recall historical strategies and outputs an ExperienceHint data object, containing fields such as caseId, S, recommendedAction, knownFailure, requiredEvidence, and riskPattern. The scenario similarity calculation formula is as follows:

[0035] in, For topological feature similarity, For vulnerability feature similarity, For action sequence similarity, As weight and .

[0036] Topological feature similarity Similarity to vulnerability features is related to the number of assets, entry point depth, port and protocol set, network partitions, service dependencies, and access boundaries. It can be calculated using set Jaccard coefficients, graph edit distance, or vector cosine similarity. Similarity to vulnerability categories, CVE or CWE numbers, weak configuration types, severity, exploitation preconditions, evidence types, and patch status can be calculated using a combination of weighted label matching and semantic vectors. Action sequence similarity. It is related to the action type sequence, tool parameters, success and failure transitions, and the order of evidence generation, and can be calculated using the longest common subsequence ratio or dynamic time warping.

[0037] The post-penetration information fusion module is used to structurally merge command echoes, credentials, permissions, host information, processes, configuration files, database connections, C2 callback platform results, and vulnerability verification results to generate entity, relation, and evidence triples (RiskTriples). The triple format is as follows:

[0038] Among them, the predicate includes at least discovered_by, validates, depends_on, leads_to, impacts, uses_credential, and mitigated_by.

[0039] The risk view building module is used to transform the RiskTriple into a risk graph:

[0040] in, This represents asset nodes, service nodes, vulnerability nodes, credential nodes, permission nodes, task nodes, step nodes, evidence nodes, and remediation suggestion nodes. This represents execution order edges, dependency edges, influence edges, and evidence source edges. It represents the risk level, confidence level, timestamp, and handling status of nodes and edges.

[0041] During construction, the system uses assetId, serviceId, findingId, credentialHash, and evidenceHash as stable keys for deduplication and merging. Node color, edge thickness, and sorting weight are calculated based on risk level, reachability, evidence credibility, and impact scope. The frontend receives incremental graph events (GraphPatch) via WebSocket, supporting filtering by asset, vulnerability type, evidence credibility, authorization scope, and remediation status. When a node is clicked, the corresponding original evidence path, execution steps, verification results, and remediation suggestions are displayed.

[0042] The risk view building module transforms the RiskTriple stream into an interactive graph. The front end receives incremental graph events (GraphPatch) via WebSocket. Users can filter by asset, vulnerability type, evidence credibility, authorization scope, and remediation status. Clicking on a node displays the corresponding original evidence path, execution steps, verification results, and remediation suggestions. The report output module generates risk profiles, verification evidence, impact scope, remediation suggestions, and retesting suggestions according to the attack chain, and stores reusable experiences in an experience library.

[0043] The report output module generates risk profiles, verification evidence, impact scope, remediation suggestions, and retesting suggestions according to the attack chain, and stores reusable experiences in an experience library. Each risk in the report references nodes, edges, and evidenceIds in the risk graph, enabling the report's conclusions to be traced back to the actions taken, verification results, and original evidence.

[0044] The task orchestration and constraint module outputs TaskContext to the planning agent; the planning agent outputs HypothesisSet and ActionRequest to the dynamic decision-making module; the dynamic decision-making module outputs PrioritizedTodo to the tool execution agent; the tool execution agent outputs ActionResult to the validation and homology check agent; the validation and homology check agent outputs ValidatedFinding to the clue extraction agent; the clue extraction agent outputs ClueSet to the experience memory and recursive generalization module, the dynamic decision-making module, and the post-penetration information fusion module; the post-penetration information fusion module outputs RiskTriple to the risk view construction module; the risk view construction module outputs RiskGraph and GraphPatch to the front-end and report output module.

[0045] In engineering implementation, the above modules can be deployed as a front-end visual interface, a back-end task orchestration service, a tool execution service, a vector retrieval service, a graph database service, and a report output service. The modules communicate with each other via REST, WebSocket, message queues, or database tables. REST is used for task creation and result querying, WebSocket for incremental graph push, message queues for asynchronous tool execution and verification, and database tables for task status, evidence indexing, and experience base persistence.

[0046] In this embodiment, the system draws on the perspective logic of computed tomography (CT) scans, abstracting the multi-agent collaborative attack path decision-making and risk fusion process into a chain of "multi-view hypothesis scanning—local clue projection—global map reconstruction—risk situation presentation": First, the task orchestration and constraint module receives target information, authorized scope, and preference constraints, delineates the scanning boundary, and the planning agent generates attack hypotheses covering multiple angles such as attack surface, vulnerability type, and preconditions. The tool execution agent calls various security tools to perform detection actions from different dimensions, completing multi-view security perception and evidence collection of the target system, much like a CT scan of the human body from multiple angles. Next, the verification and homology check agent performs fact verification on the action results, and the clue extraction agent further transforms the verified findings into local clue projections containing entities, relationships, risk labels, and optional next actions, identifying potential threats. The attack path is fragmented evidence; subsequently, the post-penetration information fusion module structures and consolidates scattered command echoes, credentials, permissions, host information, etc., into entity-relationship-evidence triples. The risk view construction module uses these triples to reconstruct a global three-dimensional risk map containing nodes such as assets, vulnerabilities, credentials, and permissions, as well as relationship edges such as execution, dependency, and impact. The dynamic decision-making module continuously updates task priorities based on new clues, and the experience memory and recursive generalization module recalls strategies for similar historical scenarios, so that the map dynamically evolves in the cycle of "scanning-projection-reconstruction", restoring a complete panorama of the attack path and risk propagation network. Finally, the report output module generates risk profiles, verification evidence, impact scope, and remediation suggestions according to the attack chain based on this transparent and visible three-dimensional risk map, and accumulates reusable experience into the experience library, forming a closed-loop risk fusion system from perception and modeling to decision-making and continuous optimization.

[0047] In one embodiment of this application, such as Figure 2 The diagram shows a flowchart of the multi-agent attack path dynamic decision-making and risk fusion method of the present invention. The process includes, in sequence, task input and authorization constraint verification, attack hypothesis generation, candidate action scoring, dynamic priority ranking, tool execution, result verification and homology check, clue extraction, similar experience recall, post-penetration information fusion, risk map construction, and report output. If a path has no continuous increments, it enters a blocked state; if subsequent clues eliminate the cause of the blockage, it is reactivated and enters the next round of dynamic ranking.

[0048] In one embodiment of this application, in an authorized Web asset testing scenario, TaskContext records the target domain name, allowed ports, prohibited destructive operations, and available tools. The planning agent formulates three hypotheses based on open ports and fingerprint recognition results: "weak configuration of the management entry point," "interface authentication flaws," and "directory exposure." The dynamic decision-making module prioritizes "weak configuration of the management entry point" due to its high expected evidence gain and low cost. The tool execution agent completes page probing and response feature collection. The verification agent confirms that the entry point originates from the target and extracts the login page, response headers, and evidence screenshots. The clue extraction agent discovers the backend interface path. The experience memory module recalls similar backend path testing experience and outputs ExperienceHint. The post-penetration information fusion module writes the asset, interface, weak configuration evidence, and remediation suggestions into a RiskTriple. The risk view displays the evidence chain from the entry point asset to the weak configuration risk and then to the remediation suggestion.

[0049] In one embodiment of this application, in an authorized intranet host risk assessment scenario, the system discovers multiple hosts sharing similar service topologies. The experience memory and recursive generalization module calculates... When considering host groups, port sets, and service dependencies, calculate... When considering weak passwords, expired components, and configuration defects, calculate... When considering the action sequence of "service identification—configuration verification—evidence extraction—remediation suggestion generation," the similarity of the scene should be taken into account. When the threshold is exceeded, the module returns historical policies to the planning agent, but the dynamic decision-making module still filters out unexecutable actions based on the current authorization scope and source verification. This embodiment demonstrates the operation mode of similar scenario experience transfer, authorization constraint filtering, and risk graph merging.

[0050] In one embodiment of this application, during the authorization test, if a certain path generates only duplicate responses for two consecutive rounds without any new evidence, the dynamic decision module marks it as blocked and transfers resources to another interface enumeration path. Subsequently, the other path discovers new credential clues, the clue extraction agent writes them into the ClueSet, and the dynamic decision module determines that the credential may unblock the blockedReason. Therefore, it reactivates the original path and lowers its initial priority. After the verification agent confirms the new evidence, the post-penetration information fusion module associates "credentials—interfaces—permissions—affected assets" into a RiskTriple, and the risk view synchronously adds dependency edges and impact edges. This embodiment covers the closed loop of failure blocking, clue-triggered reactivation, evidence verification, and risk fusion.

[0051] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0052] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 3 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a CT-style multi-agent attack path decision-making and risk fusion method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0053] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0054] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0055] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0056] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0057] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0058] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A CT-style multi-agent attack path decision-making and risk fusion system, characterized in that, include: The task orchestration and constraint module is used to receive target information, authorization scope, task preferences, prohibited operations, available tool sets and output format requirements, and generate task context data objects. The planning agent is used to generate a set of attack hypotheses and a set of candidate actions based on the task context. Each attack hypothesis includes an attack surface, vulnerability type, preconditions, expected evidence, risk impact, and confidence level. Each candidate action includes a tool, parameter template, boundary, timeout, expected output, and rollback rules. The dynamic decision-making module is used to update the priority of the to-do list based on new clues, task benefits, execution costs, risk levels, number of failures, similar experiences, and authorization constraints, and to calculate a priority value for each task. The calculation of the priority value involves new clue gain, vulnerability impact, hypothesis confidence, expected evidence completeness, experience similarity, cost, operational risk, number of consecutive failures, and penalties for exceeding boundaries or policy conflicts. The tool execution agent is used to invoke various security tools to perform actions based on the priority and output an action result data object. The action result data object includes action identifier, status, original evidence path, normalized observation, error type and cost. The verification and same-origin check agent is used to perform fact verification on the action result, extract entity information and generate verified discovery data objects. The verified discovery data objects include source action, entity identifier set, same-origin flag, confidence level, evidence identifier set and rejection reason. A clue extraction agent is used to transform the verified findings into a clue set data object, which includes entities, relationships, risk tags, optional next steps, and fields requiring manual confirmation. The experience memory and recursive generalization module is used to write verified attack steps, failure conditions, bypass conditions, tool parameters, scenario features and risk conclusions into the experience base, and to calculate scenario similarity based on new scenarios to recall historical strategies. The scenario similarity is obtained by weighted calculation of topological feature similarity, vulnerability feature similarity and action sequence similarity. The post-penetration information fusion module is used to structurally merge command echoes, credentials, permissions, host information, processes, configuration files, database connections, callback platform results, and vulnerability verification results to generate entity, relation, and evidence triples. The risk view construction module is used to transform the triples into a risk graph. The risk graph includes asset nodes, service nodes, vulnerability nodes, credential nodes, permission nodes, task nodes, step nodes, evidence nodes, and remediation suggestion nodes, as well as edges representing execution order, dependency relationships, impact relationships, and evidence source relationships. Each node and edge is associated with risk level, confidence level, timestamp, and handling status. The report output module is used to generate risk profiles, verification evidence, scope of impact, remediation suggestions, and retesting suggestions according to the attack chain, and to accumulate reusable experience into the experience library.

2. The system according to claim 1, characterized in that, The planning agent also includes a scoring matrix decision unit, which is used to calculate a score for each attack hypothesis and each candidate action. The score is calculated based on the hypothetical target benefit, hypothesis confidence, expected evidence gain, tool matching degree, operational risk, execution cost, and the penalty for the most recent failure on the same path. The system selects a predetermined number of candidate actions with the highest scores that do not conflict with each other and adds them to the to-do list.

3. The system according to claim 1, characterized in that, The dynamic decision-making module is also used to update the task status after each round of execution: When the result of the action generates incremental clues or highly credible evidence, the priority value of the same attack hypothesis and its dependent actions is increased. When there is no increment in the predetermined number of consecutive attempts and the error type is the same, mark the path as blocked and record the reason for the blockage. When other paths generate new credentials, entry points, or configuration evidence that render the blocking cause invalid, the path is reactivated and enters the candidate queue with a lower initial priority.

4. The system according to claim 1, characterized in that, In the aforementioned experience memory and recursive generalization module, topological feature similarity is related to the number of assets, entry depth, port and protocol set, network partition, service dependency relationship and access boundary; vulnerability feature similarity is related to vulnerability category, weak configuration type, severity, exploitation preconditions, evidence type and patch status; and action sequence similarity is related to action type sequence, tool parameters, success and failure transfer, and evidence generation order.

5. The system according to claim 1, characterized in that, The verification and homology check agent is also used to write the result to the intelligence pool without triggering further execution when the verified homology flag is false.

6. The system according to claim 1, characterized in that, The clue extraction agent is also used to mark a clue as an incremental clue when it meets one of the following criteria: new asset, new interface, new credentials, new permissions, or new vulnerability evidence; and to serve as failure feedback or low-gain feedback for path scoring when a clue only repeats known facts.

7. The system according to claim 1, characterized in that, The risk view building module is also used to generate an interactive graph by receiving incremental graph events via WebSocket from the front end. It supports filtering by asset, vulnerability type, evidence credibility, authorization scope and remediation status, and displays the corresponding original evidence path, execution steps, verification results and remediation suggestions when a node is clicked.

8. The system according to claim 1, characterized in that, The task orchestration and constraint module is also used to determine the same-source boundary based on protocol, host, port, path prefix and organization authorization record, and to record boundary crossings only as intelligence records and not add them to the attack plan.

9. The system according to claim 1, characterized in that, The triplet format generated by the post-penetration information fusion module is subject, predicate, object, evidence identifier, confidence level, and timestamp, wherein the predicate includes discovery relation, verification relation, dependency relation, cause relation, influence relation, credential use relation, and mitigation relation.

10. A CT-style multi-agent attack path decision-making and risk fusion method, characterized in that, include: Obtain target information, authorization scope, task preferences, prohibited operations, available toolset and output format requirements, and generate a task context data object; A set of attack hypotheses and a set of candidate actions are generated based on the task context. Each attack hypothesis includes an attack surface, vulnerability type, preconditions, expected evidence, risk impact, and confidence level. Each candidate action includes a tool, parameter template, boundary, timeout, expected output, and rollback rules. The priority of the to-do list is updated based on new clues, task benefits, execution costs, risk levels, number of failures, similar experiences, and authorization constraints. A priority value is calculated for each task. The calculation of the priority value involves new clue gain, vulnerability impact, hypothesis confidence, expected evidence completeness, experience similarity, cost, operational risk, number of consecutive failures, and penalties for going out of bounds or policy conflicts. Multiple security tools are invoked to perform actions based on the priority, and an action result data object is output. The action result data object includes action identifier, status, original evidence path, normalized observation, error type, and cost. The results of the actions are verified, entity information is extracted, and a verified discovery data object is generated. The verified discovery data object includes the source action, entity identifier set, same-origin flag, confidence level, evidence identifier set, and rejection reason. The verified findings are transformed into clue set data objects, which contain entities, relationships, risk tags, optional next steps, and fields requiring manual confirmation. Verified attack steps, failure conditions, bypass conditions, tool parameters, scenario features, and risk conclusions are written into the experience base. Scenario similarity is calculated based on new scenarios to recall historical strategies. The scenario similarity is obtained by weighted calculation of topological feature similarity, vulnerability feature similarity, and action sequence similarity. The command echoes, credentials, permissions, host information, processes, configuration files, database connections, callback platform results, and vulnerability verification results are structured and merged to generate entity, relation, and evidence triples. The triples are transformed into a risk graph, which includes asset nodes, service nodes, vulnerability nodes, credential nodes, permission nodes, task nodes, step nodes, evidence nodes, and remediation suggestion nodes, as well as edges representing execution order, dependency relationships, impact relationships, and evidence source relationships. Each node and edge is associated with risk level, confidence level, timestamp, and handling status. Based on the attack chain, risk profiles, verification evidence, scope of impact, remediation suggestions, and retesting suggestions are generated, and reusable experiences are accumulated in the experience library.

Images