Autonomous intelligent attack method based on agent application and related device

Abstract

Embodiments of the present application disclose an autonomous intelligent attack method based on agent application and related equipment, which is used to significantly improve the efficiency and accuracy of penetration testing, and can actively discover new security risks when the agent application is running. The method comprises the following steps: obtaining a penetration testing request, performing intent analysis and scene matching on the penetration testing request, generating a penetration testing work order, using the intelligent attack platform to call multiple penetration testing tools in a scripted manner to perform vulnerability scanning and injection attack testing on the target system according to the penetration testing work order, and / or using the intelligent attack platform to perform active simulation attack on the agent application based on an agent attack knowledge base, and arranging the original evidence into a structured scanning result, using an intelligent analysis engine to perform vulnerability semantic analysis, exploitability determination, false alarm elimination, risk classification and repair suggestion generation on the structured scanning result based on a preset scanning result analysis expert prompt, and generating a structured penetration testing report.

Description

Technical Field

[0001] This application relates to the field of autonomous intelligent attack methods, and more specifically, to autonomous intelligent attack methods based on intelligent agent applications, autonomous intelligent attack devices based on intelligent agent applications, electronic devices, computer-readable storage media, and computer program products containing instructions. Background Technology

[0002] With the digital transformation of financial services and the popularization of AI technology, bank internet systems face the dual threats of traditional network (target system) attacks and new security vulnerabilities of AI intelligent agents, making it urgent to conduct penetration testing on target systems and intelligent agent applications.

[0003] Existing penetration testing methods involve security personnel manually identifying test items for the target system and scanning them one by one using discrete penetration testing tools. Then, they manually interpret the raw logs, summarize the results, and write a report. For agent applications, open-source skills scanning tools are used to perform static malicious detection of third-party skills, and security fences based on sensitive keyword rules are deployed in the input and output links to achieve passive interception.

[0004] However, existing technologies employ manual testing and passive protection modes, which reduces the efficiency and accuracy of penetration testing. Furthermore, for agent applications, they can only achieve static skills access detection and passive security fence interception, and cannot proactively discover new security vulnerabilities during the operation of agent applications. Summary of the Invention

[0005] This application provides an autonomous intelligent attack method, an autonomous intelligent attack device, an electronic device, a computer-readable storage medium, and a computer program product containing instructions based on intelligent agent applications, which can significantly improve the efficiency and accuracy of penetration testing and proactively discover new security vulnerabilities in the operation of intelligent agent applications.

[0006] In a first aspect, embodiments of this application provide an autonomous intelligent attack method based on intelligent agent applications, including:

[0007] Obtain a penetration test request for the target system and / or intelligent agent application, wherein the penetration test request includes the target URL, test items, test time window and test depth parameters;

[0008] The penetration test request is subjected to intent parsing and scenario matching to generate a penetration test ticket containing the target URL, the test item, the test time window, the test depth parameter, and the scheduling strategy.

[0009] Based on the penetration testing work order, the intelligent attack platform is used to call multiple penetration testing tools in parallel in a scripted manner to perform vulnerability scanning and injection attack testing on the target system, and / or the intelligent attack platform is used to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base. The intelligent agent attack knowledge base includes prompt word injection attack templates and malicious skill behavior feature library, and the original evidence is organized into a structured scanning result in a unified format.

[0010] Using an intelligent analysis engine, based on preset expert tips for scanning results, the structured scanning results are subjected to vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions to generate a structured penetration test report.

[0011] Secondly, embodiments of this application provide an autonomous intelligent attack device based on intelligent agent applications, comprising:

[0012] The acquisition unit is used to acquire penetration testing requests for the target system and / or intelligent agent application, wherein the penetration testing request includes the target URL, test items, test time window and test depth parameters;

[0013] The generation unit is used to perform intent parsing and scenario matching on the penetration test request, and generate a penetration test work order containing the target URL, the test item, the test time window, the test depth parameter and the scheduling strategy;

[0014] The attack testing unit is used to perform vulnerability scanning and injection attack testing on the target system by using the intelligent attack platform in parallel with scripts, based on the penetration testing work order, and / or to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base, which includes prompt word injection attack templates and malicious skill behavior feature library, and organizes the original evidence into a structured scanning result in a unified format;

[0015] The generation unit is also used to utilize an intelligent analysis engine to perform vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the structured scan results based on preset expert prompts, in order to generate a structured penetration test report.

[0016] Thirdly, embodiments of this application provide an electronic device, including:

[0017] Central processing unit, memory, input / output interfaces, wired or wireless network interfaces, and power supply;

[0018] The memory is either a short-term storage memory or a persistent storage memory;

[0019] The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the aforementioned autonomous intelligent attack method based on intelligent agent applications.

[0020] Fourthly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the aforementioned autonomous intelligent attack method based on an intelligent agent application.

[0021] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the aforementioned autonomous intelligent attack method based on intelligent agent applications.

[0022] As can be seen from the above technical solutions, the embodiments of this application have the following advantages: This application can perform intent parsing and scenario matching for penetration testing requests. The intelligent attack platform, based on work orders, uses scripts to call multiple penetration testing tools in parallel to perform vulnerability scanning and injection attack testing on the target system, and / or performs proactive simulation attacks on intelligent agent applications based on an intelligent agent attack knowledge base containing prompt-word injection attack templates and malicious skill behavior feature libraries. The original evidence is organized into structured scan results, and then an intelligent analysis engine, combined with pre-set scan results analysis and expert prompt words, performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestion generation on the structured scan results, outputting a structured penetration test report. Therefore, by using AI intelligent agent automatic orchestration tools to efficiently penetrate the target system and proactively simulate attacks on intelligent agent applications, it replaces the traditional manual testing and passive protection mode, achieving full-coverage automated detection of the target system and / or intelligent agent applications, significantly improving penetration testing efficiency and accuracy, and proactively discovering new security vulnerabilities in the operation of intelligent agent applications.

[0023] Correspondingly, the autonomous intelligent attack device, electronic device, computer-readable storage medium, and computer program product containing instructions based on intelligent agent applications provided in this application also have the aforementioned technical effects. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating an autonomous intelligent attack method based on an intelligent agent application disclosed in an embodiment of this application.

[0025] Figure 2 This is a schematic diagram of a penetration testing table and a corresponding penetration testing tool disclosed in an embodiment of this application;

[0026] Figure 3 This is a flowchart illustrating another autonomous intelligent attack method based on intelligent agent applications disclosed in an embodiment of this application;

[0027] Figure 4 This is a schematic diagram of the structure of an autonomous intelligent attack device based on an intelligent agent application disclosed in an embodiment of this application;

[0028] Figure 5 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. Detailed Implementation

[0029] This application provides an autonomous intelligent attack method, an autonomous intelligent attack device, an electronic device, a computer-readable storage medium, and a computer program product containing instructions based on intelligent agent applications, which can significantly improve the efficiency and accuracy of penetration testing and proactively discover new security vulnerabilities in the operation of intelligent agent applications.

[0030] Please see Figure 1 , Figure 1 This is a flowchart illustrating an autonomous intelligent attack method based on an intelligent agent application disclosed in an embodiment of this application. The method includes:

[0031] 101. Obtain the penetration test request of the target system and / or intelligent agent application, wherein the penetration test request includes the target URL, test items, test time window and test depth parameters.

[0032] In one optional implementation, the target system refers to the traditional information system within the bank's internet business system that requires security testing, including but not limited to online banking portals and core business systems. The intelligent agent application refers to an AI agent application that interfaces with a large AI model, can autonomously plan steps, and invoke tools to complete tasks. A penetration test request refers to a user-submitted instruction through a front-end interactive page to initiate security testing; its submission format includes, but is not limited to, natural language descriptions or form parameters. The target URL refers to the network access address of the target to be tested. Test items refer to the specific security testing content to be covered in this test. The test time window refers to the start and end time range within which this test is allowed to be executed. The test depth parameter refers to the depth and intensity level of this scan.

[0033] 102. Perform intent parsing and scenario matching on the penetration test request to generate a penetration test work order containing the target URL, the test item, the test time window, the test depth parameter, and the scheduling strategy.

[0034] In one optional implementation, intent parsing and scenario matching refers to the process of semantically understanding the penetration testing request, identifying the user's detection intent, and matching it with the corresponding test scenario to generate a standardized test order. The scheduling strategy refers to the execution plan by which the intelligent attack platform allocates tasks, orchestrates timing, and schedules resources among multiple penetration testing tools or agent attack knowledge bases based on the penetration testing work order. A penetration testing work order is a standardized test task order generated by the AI ​​agent based on the intent parsing results, containing the target URL, test items, time window, depth parameters, and scheduling strategy. The multiple penetration testing tools include, but are not limited to, Nmap, Curl, SQLMap, Dirsearch, Hydra, XSStrike, sslscan, xsrfprobe, wfuzz, commix, nikto, fuxploider, ysoserial, ssrfmap, etc. For details, please refer to [link to relevant documentation]. Figure 2 , Figure 2 This is a schematic diagram of a penetration testing table and corresponding penetration testing tools disclosed in an embodiment of this application. Figure 2 It can be seen that each penetration testing tool corresponds one-to-one with specific penetration testing items according to categories such as configuration management security, identity management authentication, and input validation testing, forming a set of tool capabilities that can be uniformly scheduled by the intelligent attack platform.

[0035] 103. Based on the penetration testing work order, the intelligent attack platform is used to perform vulnerability scanning and injection attack testing on the target system by calling multiple penetration testing tools in parallel in a scripted manner, and / or the intelligent attack platform is used to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base, the intelligent agent attack knowledge base including prompt word injection attack templates and malicious skill behavior feature library, and the original evidence is organized into a structured scanning result in a unified format.

[0036] In one optional implementation, the intelligent attack platform refers to an intelligent execution engine that integrates multiple penetration testing tools, an agent attack knowledge base, and a task scheduling module. It is used to automatically initiate processes and task scheduling based on penetration testing work orders. Original evidence refers to logs, traffic, responses, and behavioral monitoring data collected during the execution of penetration testing tools or agent attack knowledge bases to prove the existence of vulnerabilities or security flaws. Prompt injection attack templates refer to a set of preset scripts used to send inducement input to the target agent application, including but not limited to role-playing, social engineering inducements, and jailbreak-related prompts. The malicious skill behavior feature library refers to a set of feature rules used to identify malicious behavior during the execution of third-party skills, including but not limited to abnormal external connections, unauthorized data access, and sensitive API call patterns. The intelligent attack platform can automatically schedule multiple penetration testing tools based on work orders to launch parallel scans of the target system's core business systems, API interfaces, web applications, and third-party services, collecting original evidence at the network layer, application layer, and business logic layer, and organizing it into a structured scan result in a unified format. The intelligent attack platform can also perform proactive simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base, which includes third-party skills, context, and prompt word links. The intelligent agent attack knowledge base includes prompt word injection attack templates and a malicious skill behavior feature library. It collects original evidence of network traffic, system calls, and data access information and organizes it into a structured scanning result in a unified format.

[0037] It is important to understand that existing technologies for security protection of intelligent agent applications mainly focus on two aspects: component risk management and input attack defense. Firstly, for third-party skills within the intelligent agent, static code-level malicious detection is primarily performed using open-source skills scanning tools. This detection only covers the static access control stage and cannot identify dynamic malicious behavior of third-party skills during actual operation. Secondly, for injection attacks such as prompt word injection, security fences deployed at the input and output links are mainly used for matching and interception based on manually maintained sensitive keywords, regular expression rules, and typical jailbreak templates. This method only achieves passive protection and is insufficient to deal with manipulative attacks that employ varying persuasive language. This application, based on the aforementioned penetration testing ticket, utilizes the intelligent attack platform to conduct proactive simulation attacks on the intelligent agent application using an intelligent agent attack knowledge base. By actively sending manipulative prompt words to the intelligent agent application and monitoring the runtime behavior of its third-party skills, it replaces the static detection and passive protection modes of existing technologies. This proactively discovers new security vulnerabilities in the intelligent agent application during operation, including but not limited to dynamic runtime risks, context leakage, and prompt word injection manipulation.

[0038] 104. Using an intelligent analysis engine, based on preset scan results and expert tips, perform vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the structured scan results to generate a structured penetration test report.

[0039] In one optional implementation, the intelligent analysis engine refers to an analysis component that interfaces with a large AI model, used to receive structured scan results and invoke the backend in-house AI model for in-depth analysis. Pre-configured expert prompts for scan result analysis refer to pre-configured expert instruction templates used to guide the AI ​​model in performing professional vulnerability analysis of the scan results. Vulnerability semantic analysis refers to the semantic identification and understanding of vulnerabilities in the scan results. Exploitability determination refers to assessing the likelihood and severity of actual exploitation of vulnerabilities. False alarm elimination refers to excluding distracting items that are not genuine vulnerabilities. Risk classification refers to classifying vulnerabilities into high-risk, medium-risk, or low-risk levels according to their severity. Remediation recommendations refer to providing specific remediation solutions for the identified vulnerabilities. The intelligent analysis engine can send structured scan results and pre-set expert tips for scan results into the AI-assisted analysis engine. The AI ​​big model performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the scan results. Finally, it produces a structured penetration test report and sends it back to the intelligent agent. The front end presents it to the user and archives it in the database, forming an end-to-end closed loop of "request - scan - analysis - report".

[0040] To facilitate understanding of the embodiments of this application, a specific example is given below. Please refer to [link / reference needed]. Figure 3 , Figure 3 This is a flowchart illustrating another autonomous intelligent attack method based on intelligent agent applications disclosed in an embodiment of this application. Figure 3 As can be seen, this application uses an intelligent analysis engine as the decision-making core and an intelligent attack platform as the execution carrier, enabling the intelligent agent to autonomously complete the entire penetration testing process. Users send penetration testing requests to the intelligent agent through a front-end interactive page. The intelligent agent parses the intent of the request, generates a penetration testing work order, and autonomously decides to schedule the intelligent attack platform. The platform, based on the work order, uses scripts to call multiple penetration testing tools in parallel to scan the target system, and / or performs proactive simulation attacks on the intelligent agent's application based on the agent's attack knowledge base. After the scan is completed, the intelligent agent sends the structured scan results and pre-set expert prompts for scan result analysis to the intelligent analysis engine. The AI ​​model then performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and generates remediation suggestions. After the analysis results are returned, the intelligent agent presents the final penetration testing report to the user and archives it, forming an end-to-end closed loop of "request—scan—analysis—report." The specific steps are as follows:

[0041] ① Penetration test request: Users submit parameters such as target URL, test items, test time window, and test depth to the agent through the front-end interactive page in natural language or form form, which serves as the starting point of the entire process.

[0042] ②③④AI Decision Analysis Intent: After receiving a request (penetration test request) from a user, the agent performs intent parsing and scenario matching on the request, generates a penetration test ticket containing the target URL (target system and / or agent application URL), test items, parameters, and scheduling strategy, and calls the AI ​​big model to perform decision analysis before sending the ticket to the intelligent attack platform.

[0043] ⑤ Call penetration testing tools to scan: After receiving the work order, the intelligent attack platform starts the task scheduling module and calls multiple penetration testing tools in parallel in a scripted manner to scan the network layer, application layer and business logic layer of the target system (online banking portal, Haifeng grid system), and / or conducts active simulation attacks on intelligent agent applications (intelligent data extraction assistant, intelligent question answering assistant) based on the intelligent agent attack knowledge base, collects original evidence and organizes it into a structured scan result in a unified format.

[0044] ⑥⑦ Call the AI ​​analysis module: The agent sends the structured scan results and the preset expert prompts for the scan results into the intelligent analysis engine (AI analysis engine). The AI ​​big model performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification and remediation suggestions on the scan results, and generates a structured penetration test report.

[0045] ⑧ Return the report to the user: The intelligent analysis engine sends the generated report back to the intelligent agent, which presents it to the user in an intuitive form at the front end; at the same time, the report is stored in the database for long-term storage, used for vulnerability remediation tracking and security trend analysis, and supports the closed-loop handling of high-risk vulnerabilities through work orders.

[0046] Therefore, this application can address the following shortcomings of existing technologies: 1. Regarding the issues of high labor costs and long testing cycles: This application uses an AI agent to automatically parse intent and generate standardized work orders. Multiple penetration testing tools are dynamically and concurrently orchestrated by an intelligent attack platform, and reports are automatically generated using an AI large-scale model, replacing the manual process of selecting tools, interpreting logs, and writing reports, significantly shortening the testing cycle and reducing labor input. 2. Regarding the issues of delayed result analysis and high false positive / false negative rates: This application utilizes an intelligent analysis engine combined with pre-set expert prompts for scanning result analysis. An AI large-scale model performs vulnerability semantic analysis and false positive elimination on structured scanning results, achieving intelligent real-time processing of scanning results and improving vulnerability identification accuracy. 3. Regarding the issues of insufficient coverage and poor dynamic adaptation capabilities: This application uses an intelligent agent to automatically schedule tools based on penetration testing work orders, dynamically adjusting testing strategies according to changes in the target environment, achieving high-frequency, routine coverage of massive heterogeneous assets, and avoiding blind spots when the attack surface expands. 4. Addressing the issues of high barriers to entry and limited collaboration: This application allows users to submit penetration testing requests via the front end in natural language or form format, enabling testing without requiring professional command-line experience, thus reducing reliance on highly skilled security experts. 5. Addressing the issue of limited scanning depth of open-source skills: This application monitors the runtime behavior of third-party skills invoked by intelligent agent applications based on a malicious skill behavior feature library, overcoming the limitation of static code detection only covering the access control stage, and can identify dynamic malicious behavior of skills during actual operation. 6. Addressing the issue of passive protection against injection attacks: This application proactively sends inducement prompts to intelligent agent applications using prompt word injection attack templates to conduct simulated attacks, replacing passive fence interception based on manually maintained keyword rules, and can proactively discover new security vulnerabilities such as prompt word injection manipulation.

[0047] In this way, this application can perform intent parsing and scenario matching on penetration testing requests. The intelligent attack platform, based on work orders, can concurrently invoke multiple penetration testing tools in a scripted manner to perform vulnerability scanning and injection attack testing on the target system, and / or conduct proactive simulation attacks on intelligent agent applications based on an intelligent agent attack knowledge base containing prompt-word injection attack templates and malicious skill behavior feature libraries. The raw evidence is organized into structured scan results, and then an intelligent analysis engine, combined with pre-set scan results and expert prompts, performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestion generation on the structured scan results, outputting a structured penetration test report. Therefore, by using AI intelligent agent automatic orchestration tools to efficiently penetrate the target system and proactively simulate attacks on intelligent agent applications, this replaces the traditional manual testing and passive protection mode, achieving full-coverage automated detection of the target system and / or intelligent agent applications. This significantly improves penetration testing efficiency and accuracy, and can proactively discover new security vulnerabilities in the operation of intelligent agent applications, including but not limited to dynamic operation risks, context leakage, and prompt-word injection manipulation. Secondly, an end-to-end autonomous closed-loop approach of "request-decision-scanning-analysis-reporting" is proposed, automatically parsing the user's natural language intent and generating standardized test work orders, replacing the traditional process of manually selecting test items and scheduling tools. Thirdly, the intelligent analysis engine, intelligent attack platform, and in-house AI large-scale model are deeply integrated to form an AI-centric intelligent attack closed loop. Through the intelligent agent's autonomous intent parsing, dynamic orchestration of nearly 20 penetration testing tools, and invocation of the large-scale model to complete intelligent analysis, periodic, scenario-based, and high-frequency coverage of the bank's internet assets is achieved, significantly improving vulnerability identification accuracy and coverage, shortening delivery cycles, and reducing reliance on highly skilled security experts. Finally, extending beyond traditional penetration testing to the AI ​​intelligent agent application side, by integrating malicious skill scanning tools and a prompt injection knowledge base, proactive detection of the intelligent agent's third-party skills, context, and prompt link is conducted. This compensates for the shortcomings of existing static access control and passive fence capabilities, promptly identifying new security risks such as excessive privileges, context leaks, and prompt injection manipulation.

[0048] In one optional implementation, the step of using the intelligent attack platform to conduct an active simulation attack on the agent application based on the agent attack knowledge base, according to the penetration testing work order, and organizing the original evidence into a structured scan result in a unified format, includes: according to the penetration testing work order, using the intelligent attack platform to send the inducement prompt words from the prompt word injection attack template to the agent application through the target agent application interface, so as to trigger the agent application to call a third-party skill; during the execution of the agent application, based on the malicious skill behavior feature library, performing runtime behavior monitoring on the third-party skill called, collecting runtime behavior monitoring data of the third-party skill, the runtime behavior monitoring data including network traffic, system calls and data access information, and summarizing the response result of the inducement prompt words and the runtime behavior monitoring data into the structured scan result.

[0049] Specifically, the target agent application interface refers to the application programming interface or access endpoint that the agent application provides interactive services to the outside world. The inducement prompt word refers to the carefully crafted input text in the prompt word injection attack template used to probe the security boundaries of the agent application. The third-party skill refers to the external functional module or application programming interface invoked by the agent application to complete a specific task. The network traffic refers to the network communication data generated by the third-party skill; the system call refers to the service requested by the third-party skill from the operating system; and the data access information refers to the read and write records of the third-party skill on the database or file system. The response result of the inducement prompt word refers to the output content returned by the agent application after receiving and processing the inducement prompt word.

[0050] In this way, by proactively sending suggestive prompts to intelligent agent applications and simultaneously monitoring the runtime behavior of their third-party skills, it is possible to proactively detect the risks of intelligent agent applications being manipulated and skills engaging in malicious activities during runtime, thus overcoming the detection limitations of existing static access control and passive fences.

[0051] In one optional implementation, when the penetration test ticket instructs the agent application to be tested, the intelligent analysis engine, based on preset scan results and expert prompts, performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestion generation on the structured scan results to generate a structured penetration test report. This includes: performing a first semantic analysis on the agent application's response to the prompt injection attack template to determine whether the agent application has been induced to perform unauthorized operations or leak sensitive information in the context or knowledge base; performing a second semantic analysis on the runtime behavior monitoring data of the third-party skills collected based on the malicious skill behavior feature library to determine whether the third-party skills have abnormal network connections, data transmission, or unauthorized access; and combining the first and second semantic analysis results to perform exploitability determination, false positive elimination, risk classification, and remediation suggestion generation to generate the structured penetration test report.

[0052] Specifically, the first semantic analysis characterization performs semantic parsing on the return results of the agent's application response to suggestive prompts to determine whether its large model inference layer has been manipulated to leak sensitive information or perform unauthorized operations. The second semantic analysis characterization performs semantic parsing on the runtime behavior monitoring data of third-party skills to determine whether its execution layer exhibits malicious runtime behavior such as abnormal network connections, data transmission, or unauthorized access.

[0053] In this way, by performing dual semantic analysis from the cognitive decision-making layer of intelligent agent applications and the execution behavior layer of third-party skills respectively, it is possible to comprehensively identify the security risks of intelligent agent applications being induced and manipulated and the malicious behavior during skill operation, thereby improving the detection accuracy and coverage of new security vulnerabilities of intelligent agent applications.

[0054] In one optional implementation, the first semantic analysis of the agent application's response to the prompt injection attack template to determine whether the agent application is induced to perform unauthorized operations or whether it leaks sensitive information in the context or knowledge base includes: detecting the prompt link of the agent application based on the response result of the prompt injection attack template, detecting whether the agent application is manipulated by social engineering rhetoric throughout the entire chain from user input to the agent application's understanding, tool invocation, and result output, to determine whether the agent application is induced to perform unauthorized operations; and detecting the context link of the agent application based on the response result of the prompt injection attack template, detecting whether the agent application leaks sensitive information in the conversation history, memory, or knowledge base in multi-turn dialogue, to determine whether the agent application leaks sensitive information in the context or knowledge base.

[0055] Specifically, the prompt word chain of the intelligent agent application refers to the complete processing chain from user input to the intelligent agent application's understanding, tool invocation, and result output. It can detect whether the intelligent agent application is manipulated by social engineering rhetoric throughout the entire process of receiving user input, performing semantic understanding, invoking third-party skills, and generating return results, to determine whether the intelligent agent application has been induced to perform unauthorized operations. The context chain of the intelligent agent application refers to the conversation history, memory, and knowledge base access paths accumulated by the intelligent agent application in multi-turn dialogues. It can detect whether the intelligent agent application leaks its internal conversation state, memory content, or sensitive data from the knowledge base into the return results during continuous interaction, to determine whether the intelligent agent application has leaked sensitive information from the context or knowledge base.

[0056] In this way, by detecting both the prompt word link and the context link separately, it is possible to comprehensively identify the risks of intelligent agent applications being induced and manipulated throughout the entire processing chain and the leakage of sensitive information in multi-turn dialogues, thereby improving the detection accuracy of security defects in the cognitive decision-making layer of intelligent agent applications.

[0057] In one optional implementation, the step of performing a second semantic analysis on the runtime behavior monitoring data of the third-party skills collected based on the malicious skill behavior feature database to determine whether the third-party skills have abnormal network connections, data transmission, or unauthorized access includes: detecting the third-party skill links of the intelligent agent application based on the runtime behavior monitoring data of the third-party skills, and detecting whether the external tools or application interfaces called by the intelligent agent application have abnormal network connections, data transmission, or unauthorized access.

[0058] Specifically, it can monitor whether the external tools or application interfaces called by the intelligent agent application have unauthorized network connections, sensitive data transmission, or data access beyond the authorized scope during operation.

[0059] In this way, by monitoring the runtime behavior of third-party skill chains, we can proactively discover hidden malicious behaviors of external tools or interfaces called by intelligent agents during actual execution, thus making up for the inability of static code scanning to identify runtime risks.

[0060] In one optional implementation, after performing vulnerability semantic analysis on the structured scan results, the method further includes: based on the semantic analysis results, determining the refined vulnerability types that the target system needs to be further tested, and calling the corresponding penetration testing tools to perform autonomous attack testing, and / or determining the refined vulnerability types that the agent application needs to be further tested, and calling the corresponding prompt word injection attack templates and malicious skill behavior characteristics from the agent attack knowledge base to perform autonomous attack testing, forming a multi-round autonomous attack testing chain.

[0061] Specifically, the intelligent analysis engine identifies the initial vulnerability direction based on the semantic analysis of the previous scan results, determines the detailed vulnerability types that need to be verified in depth, calls the corresponding penetration testing tools to perform deep scanning on the target system, matches more refined prompt words from the intelligent agent attack knowledge base to inject attack templates or malicious skill behavior characteristics for a second simulation attack on the intelligent agent application, and repeats the semantic analysis and tool scheduling based on the scan results obtained again, forming a multi-round iterative autonomous attack test link.

[0062] In this way, through a dynamic tool orchestration mechanism with an intelligent analysis engine at its core, multiple penetration testing tools and agent attack knowledge bases are uniformly encapsulated into a capability set that can be scheduled by a large model. Combined with dynamic backtracking of scan results, a multi-round autonomous attack test chain is formed, consisting of "decision calling tools - analysis tool scan results - calling tools again based on results". This enables in-depth mining and precise location of vulnerabilities in target systems and agent applications.

[0063] In one optional implementation, after generating the structured penetration test report, the method further includes: displaying and saving the structured penetration test report to support vulnerability remediation tracking, security trend analysis, and closed-loop handling of high-risk vulnerabilities through work orders.

[0064] Specifically, the structured penetration test report can be sent back to the front end to present vulnerability details, risk levels, and remediation suggestions to users in an intuitive way. At the same time, the report can be stored in the database for long-term storage to support vulnerability remediation tracking, security trend analysis, and closed-loop handling of high-risk vulnerabilities through work orders.

[0065] In this way, by combining intuitive front-end presentation with long-term back-end archiving, the results of penetration tests can be visualized in real time and managed throughout their entire lifecycle, providing data support for vulnerability remediation and continuous optimization of the security posture.

[0066] For further details, please refer to Figure 4 One embodiment of the autonomous intelligent attack device based on intelligent agent application in this application includes:

[0067] The acquisition unit is used to acquire penetration testing requests for the target system and / or intelligent agent application, wherein the penetration testing request includes the target URL, test items, test time window and test depth parameters;

[0068] The generation unit is used to perform intent parsing and scenario matching on the penetration test request, and generate a penetration test work order containing the target URL, the test item, the test time window, the test depth parameter and the scheduling strategy;

[0069] The attack testing unit is used to perform vulnerability scanning and injection attack testing on the target system by using the intelligent attack platform in parallel with scripts, based on the penetration testing work order, and / or to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base, which includes prompt word injection attack templates and malicious skill behavior feature library, and organizes the original evidence into a structured scanning result in a unified format;

[0070] The generation unit is also used to utilize an intelligent analysis engine to perform vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the structured scan results based on preset expert prompts, in order to generate a structured penetration test report.

[0071] In one alternative implementation, the attack testing unit can be used to:

[0072] According to the penetration test ticket, the intelligent attack platform sends the prompt words injected into the attack template to the intelligent agent application through the target intelligent agent application interface, so as to trigger the intelligent agent application to call third-party skills;

[0073] During the execution of the intelligent agent application, based on the malicious skill behavior feature library, runtime behavior monitoring is performed on the third-party skills it calls, and runtime behavior monitoring data of the third-party skills is collected. The runtime behavior monitoring data includes network traffic, system calls and data access information.

[0074] The response results of the suggestive prompts and the runtime behavior monitoring data are combined to form the structured scan results.

[0075] In one alternative implementation, the generating unit may be used for:

[0076] Perform a first semantic analysis on the response result of the intelligent agent application to the prompt word injection attack template to determine whether the intelligent agent application is induced to perform unauthorized operations or whether it leaks sensitive information in the context or knowledge base;

[0077] A second semantic analysis is performed on the runtime behavior monitoring data of the third-party skills collected based on the malicious skill behavior feature database to determine whether the third-party skills have abnormal network connections, data transmission, or unauthorized access.

[0078] The structured penetration test report is generated by combining the results of the first and second semantic analysis to perform availability determination, false positive elimination, risk classification, and remediation suggestions.

[0079] In one alternative implementation, the generating unit may be used for:

[0080] Based on the response results of the aforementioned prompt injection attack template, the prompt link of the intelligent agent application is detected. The entire chain from user input to the intelligent agent application's understanding, tool invocation, and result output is detected to determine whether the intelligent agent application is manipulated by social engineering rhetoric, so as to determine whether the intelligent agent application is induced to perform unauthorized operations.

[0081] Based on the response results of the aforementioned prompt injection attack template, the context link of the intelligent agent application is detected to determine whether the intelligent agent application leaks sensitive information in the conversation history, memory, or knowledge base during multi-turn dialogues, thereby determining whether the intelligent agent application leaks sensitive information in the context or knowledge base.

[0082] In one alternative implementation, the generating unit may be used for:

[0083] Based on the runtime behavior monitoring data of the third-party skills, the third-party skill links of the intelligent agent application are detected to detect whether the external tools or application interfaces called by the intelligent agent application have abnormal network connections, data transmissions, or unauthorized access.

[0084] In one alternative implementation, the attack testing unit can also be used for:

[0085] Based on the semantic analysis results, the detailed vulnerability types that need to be further tested in the target system are determined, and the corresponding penetration testing tools are called to conduct autonomous attack tests. And / or the detailed vulnerability types that need to be further tested in the agent application are determined, and the corresponding prompt words injection attack templates and malicious skill behavior characteristics are called from the agent attack knowledge base to conduct autonomous attack tests, forming a multi-round autonomous attack test chain.

[0086] In one optional implementation, the intelligent penetration testing device further includes a display unit for:

[0087] Display and save the structured penetration test report to support vulnerability remediation tracking, security trend analysis, and closed-loop handling of high-risk vulnerabilities through work orders.

[0088] For further details, please refer to Figure 5 One embodiment of the electronic device in this application includes:

[0089] Central processing unit 501, memory 505, input / output interface 504, wired or wireless network interface 503, and power supply 502;

[0090] Memory 505 is either a short-term storage memory or a persistent storage memory;

[0091] The central processing unit 501 is configured to communicate with the memory 505 and execute instructions stored in the memory 505 to perform the aforementioned operations. Figure 1 The method in the illustrated embodiment.

[0092] Furthermore, embodiments of this application also provide a computer-readable storage medium, which includes instructions that, when executed on a computer, cause the computer to perform the aforementioned... Figure 1 The method in the illustrated embodiment.

[0093] Furthermore, embodiments of this application also provide a computer program product containing instructions, which, when run on a computer, causes the computer to perform the aforementioned... Figure 1 The method in the illustrated embodiment.

[0094] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0095] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0096] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0097] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0098] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0099] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. An autonomous intelligent attack method based on intelligent agent applications, characterized in that, include: Obtain a penetration test request for the target system and / or intelligent agent application, wherein the penetration test request includes the target URL, test items, test time window and test depth parameters; The penetration test request is subjected to intent parsing and scenario matching to generate a penetration test ticket containing the target URL, the test item, the test time window, the test depth parameter, and the scheduling strategy. Based on the penetration testing work order, the intelligent attack platform is used to call multiple penetration testing tools in parallel in a scripted manner to perform vulnerability scanning and injection attack testing on the target system, and / or the intelligent attack platform is used to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base. The intelligent agent attack knowledge base includes prompt word injection attack templates and malicious skill behavior feature library, and the original evidence is organized into a structured scanning result in a unified format. Using an intelligent analysis engine, based on preset expert tips for scanning results, the structured scanning results are subjected to vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions to generate a structured penetration test report.

2. The method according to claim 1, characterized in that, Based on the penetration testing work order, the intelligent attack platform is used to conduct an active simulation attack on the agent application based on the agent attack knowledge base, and the original evidence is organized into a structured scanning result in a unified format, including: According to the penetration test ticket, the intelligent attack platform sends the prompt words injected into the attack template to the intelligent agent application through the target intelligent agent application interface, so as to trigger the intelligent agent application to call third-party skills; During the execution of the intelligent agent application, based on the malicious skill behavior feature library, runtime behavior monitoring is performed on the third-party skills it calls, and runtime behavior monitoring data of the third-party skills is collected. The runtime behavior monitoring data includes network traffic, system calls and data access information. The response results of the suggestive prompts and the runtime behavior monitoring data are combined to form the structured scan results.

3. The method according to claim 1, characterized in that, When the penetration test ticket instructs the agent application to be tested, the intelligent analysis engine, based on preset expert prompts for scanning results, performs vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the structured scan results to generate a structured penetration test report, including: Perform a first semantic analysis on the response result of the intelligent agent application to the prompt word injection attack template to determine whether the intelligent agent application is induced to perform unauthorized operations or whether it leaks sensitive information in the context or knowledge base; A second semantic analysis is performed on the runtime behavior monitoring data of the third-party skills collected based on the malicious skill behavior feature database to determine whether the third-party skills have abnormal network connections, data transmission, or unauthorized access. The structured penetration test report is generated by combining the results of the first and second semantic analysis to perform availability determination, false positive elimination, risk classification, and remediation suggestions.

4. The method according to claim 3, characterized in that, The first semantic analysis of the response result of the intelligent agent application to the prompt injection attack template, to determine whether the intelligent agent application has been induced to perform unauthorized operations or whether it has leaked sensitive information in the context or knowledge base, includes: Based on the response results of the aforementioned prompt injection attack template, the prompt link of the intelligent agent application is detected. The entire chain from user input to the intelligent agent application's understanding, tool invocation, and result output is detected to determine whether the intelligent agent application is manipulated by social engineering rhetoric, so as to determine whether the intelligent agent application is induced to perform unauthorized operations. Based on the response results of the aforementioned prompt injection attack template, the context link of the intelligent agent application is detected to determine whether the intelligent agent application leaks sensitive information in the conversation history, memory, or knowledge base during multi-turn dialogues, thereby determining whether the intelligent agent application leaks sensitive information in the context or knowledge base.

5. The method according to claim 3, characterized in that, The second semantic analysis of the runtime behavior monitoring data of the third-party skills collected based on the malicious skill behavior feature database to determine whether the third-party skills have abnormal network connections, data transmission, or unauthorized access includes: Based on the runtime behavior monitoring data of the third-party skills, the third-party skill links of the intelligent agent application are detected to detect whether the external tools or application interfaces called by the intelligent agent application have abnormal network connections, data transmissions, or unauthorized access.

6. The method according to claim 1, characterized in that, After performing vulnerability semantic analysis on the structured scan results, the method further includes: Based on the semantic analysis results, the detailed vulnerability types that need to be further tested in the target system are determined, and the corresponding penetration testing tools are called to conduct autonomous attack tests. And / or the detailed vulnerability types that need to be further tested in the agent application are determined, and the corresponding prompt words injection attack templates and malicious skill behavior characteristics are called from the agent attack knowledge base to conduct autonomous attack tests, forming a multi-round autonomous attack test chain.

7. The method according to claim 1, characterized in that, After generating the structured penetration test report, the method further includes: Display and save the structured penetration test report to support vulnerability remediation tracking, security trend analysis, and closed-loop handling of high-risk vulnerabilities through work orders.

8. An autonomous intelligent attack device based on intelligent agent applications, characterized in that, include: The acquisition unit is used to acquire penetration testing requests for the target system and / or intelligent agent application, wherein the penetration testing request includes the target URL, test items, test time window and test depth parameters; The generation unit is used to perform intent parsing and scenario matching on the penetration test request, and generate a penetration test work order containing the target URL, the test item, the test time window, the test depth parameter and the scheduling strategy; The attack testing unit is used to perform vulnerability scanning and injection attack testing on the target system by using the intelligent attack platform in parallel with scripts, based on the penetration testing work order, and / or to perform active simulation attacks on the intelligent agent application based on the intelligent agent attack knowledge base, which includes prompt word injection attack templates and malicious skill behavior feature library, and organizes the original evidence into a structured scanning result in a unified format; The generation unit is also used to utilize an intelligent analysis engine to perform vulnerability semantic analysis, exploitability determination, false positive elimination, risk classification, and remediation suggestions on the structured scan results based on preset expert prompts, in order to generate a structured penetration test report.

9. An electronic device, characterized in that, include: Central processing unit and memory; The memory is either a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory and execute instructions in the memory to perform the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 7.

Images