A penetration testing phase admission control method and system

Abstract

The present application belongs to the technical field of network information security, and provides a penetration testing phase access control method and system. The method comprises: obtaining target test object information; generating an original penetration testing task set, dividing the original penetration testing task set into sub-tasks corresponding to each task phase according to the task phase, and constructing a phase task graph; determining an executable task set of the current phase, forming a to-be-executed queue and executing the sub-tasks according to the to-be-executed queue, and collecting execution data; obtaining a multi-dimensional score, and obtaining a comprehensive evaluation value of the current phase according to the multi-dimensional score; and executing a differentiated strategy according to whether the comprehensive evaluation value of the current phase meets a preset threshold. The present application comprehensively processes data in the execution process to obtain a comprehensive evaluation value as a basis for promotion, so that the phase switching no longer depends on a single rule or manual experience; and the to-be-executed queue is dynamically updated through a control instruction, thereby improving the scheduling efficiency and result interpretability.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to an access control method and system for the penetration testing phase. Background Technology

[0002] Penetration testing is a common method for identifying security vulnerabilities in a target system, verifying potential risks, and assessing the overall security level. It typically involves manual operation, automated scanning tools, or pre-set scripts to sequentially complete steps such as information collection, vulnerability scanning, result analysis, and verification.

[0003] However, existing penetration testing methods have significant shortcomings in controlling phase transitions. On the one hand, most processes rely on a fixed sequence or the testers' subjective experience to advance each phase, lacking a quantitative assessment of the current phase's execution status. This can lead to prematurely moving to the next phase even when evidence is insufficient, results are unreliable, risks are high, or resource consumption is excessive, impacting both efficiency and reliability. On the other hand, existing task splitting and scheduling primarily focus on the execution order, lacking dynamic responsiveness to task status, phase results, and constraints. It's difficult to adjust the priority, dependencies, and execution paths of subsequent tasks based on the output of the current phase. Furthermore, when results are uncertain, there's a lack of clear mechanisms for supplementary reconnaissance, result verification, task rollback, or rescheduling, resulting in insufficient process controllability, low resource utilization, and poor result interpretability.

[0004] In view of this, there is a need for a phased access control scheme that can comprehensively and quantitatively assess the execution status of each stage and automatically decide whether to grant access or how to handle it. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a penetration testing phase access control method and system to improve the controllability of phase advancement, the reliability of results, and the flexibility of task scheduling. In a first aspect, the present invention provides an access control method for the penetration testing phase, comprising: S1. Obtain target asset information, test authorization constraint information, test task information, and historical test records of the target test object; S2. Generate an original set of penetration testing tasks based on target asset information, test authorization constraint information, and test task information. Divide the original set of penetration testing tasks into sub-tasks corresponding to each task stage according to the task stage, and construct a stage task graph. In the stage task graph, the nodes are sub-tasks, and the edges are dependencies. S3. Based on the phase task diagram, determine the set of executable tasks for the current phase, form a queue to be executed, execute sub-tasks according to the queue to be executed, and collect execution data; S4. Based on historical test records and execution data, obtain multi-dimensional scores, and obtain the comprehensive evaluation value for the current stage based on the multi-dimensional scores; S5. Based on whether the comprehensive evaluation value of the current stage meets the preset threshold, implement a differentiated strategy; including: When the overall evaluation value does not meet the preset threshold, control instructions are generated based on the corresponding low-scoring dimension, the current stage subtask is updated according to the control instructions, and S3 is returned. When the comprehensive evaluation value meets the preset threshold, the next stage release instruction is output, and the next task stage is entered; when the termination condition is met, the penetration test result is output, otherwise it returns to S3.

[0006] Optionally, the mission phases include the reconnaissance phase, scanning phase, analysis phase, verification phase, and information fusion phase, which are executed sequentially.

[0007] Optionally, dependencies, including pre-dependencies, parallelism, and post-triggering, are executed according to the following rules for dependencies of subtasks in any task phase: If a current subtask has a preceding subtask that it depends on, the current subtask will be added to the set of executable tasks after the preceding subtask is completed. If the current subtask has no unmet prerequisites, the current subtask is added to the set of executable tasks for the current stage; subtasks in the current set of executable tasks that do not have dependency conflicts or resource conflicts with each other form a set of parallel execution tasks. If the current subtask has a subsequent subtask that will be triggered, the subsequent subtask will be added to the set of executable tasks after the current subtask produces a preset result or meets a preset triggering condition.

[0008] Optionally, S4 includes: Based on historical test records and execution data, obtain multi-dimensional scores; Based on multi-dimensional scoring, a stage status evaluation vector is constructed, and cost-type indicators are homogenized to obtain a standardized evaluation vector. The combined weights of the standardized evaluation vector are determined by using the AHP-entropy weight combination, resulting in a weighted evaluation vector. The comprehensive evaluation value for the current stage is determined based on the TOPSIS model.

[0009] Optionally, multi-dimensional scoring includes: Completeness of evidence score , These represent the number of pieces of evidence already obtained and the expected number of pieces of evidence. These represent the number of key pieces of evidence obtained and the expected number, respectively. For evidence type coverage, For component weights; Confidence score of results , The stability score corresponds to the frequency of recurrence of abnormal results. To score the consistency of multi-source results, Score the matching degree of historical similar results. Scoring the degree of false alarm elimination. For component weights; Goal Achievement Score , , These represent the number of tasks completed and the number of planned tasks, respectively. For key target coverage, To achieve the stage target satisfaction rate, For component weights; Authorization Consistency Score , The scores are based on consistency with the authorized scope, time window, and test boundaries. For component weights; Risk Impact Score , These are service impact, anomaly triggering, and risk scores for contact with sensitive targets. For component weights; Resource consumption rating , The scores are based on processing time, network request volume, computing resource consumption, and number of task retries. For component weights.

[0010] Optionally, control commands include supplementary reconnaissance commands, result verification commands, mission rollback commands, and rescheduling commands. When the evidence completeness score does not meet the corresponding sub-threshold, a supplementary reconnaissance instruction is generated to generate a supplementary reconnaissance sub-task and write it into the queue to be executed. When the confidence score of the result does not meet the corresponding sub-threshold, a result review instruction is generated to increase the priority of the review sub-task and restrict the current candidate abnormal result from entering the next task stage. When the authorization consistency score or risk impact score does not meet the corresponding sub-threshold, a task rollback instruction is generated to pause the sub-tasks of the current task stage and restore the task status of the corresponding sub-tasks of the previous task stage that met the advancement conditions. When the resource consumption score or target achievement score does not meet the corresponding sub-threshold, a rescheduling instruction is generated to reorder the priority of the unexecuted sub-tasks in the current stage or adjust the dependencies of the sub-tasks.

[0011] Optionally, for parallel subtasks in the set of executable tasks, the concurrency parameter is adjusted based on the risk impact score or resource consumption score; The concurrency parameter limits the maximum number of concurrent tasks, request rate, or number of threads in the current task phase.

[0012] Optionally, the termination condition includes at least one of the following conditions: all subtasks have been completed, the maximum test duration has been reached, the maximum resource consumption limit has been reached, and penetration test results that meet the preset integrity requirements have been output. Penetration test results shall include at least one of the following: phase execution record, test evidence results, summary of abnormal results, verification results, comprehensive evaluation value results, access determination results, control command record, and task update record.

[0013] Secondly, the present invention provides an access control system for the penetration testing phase, comprising: The information acquisition module is used to acquire target asset information, test authorization constraint information, test task information, and historical test records of the target test object; The task construction module is used to generate an original set of penetration testing tasks based on target asset information, test authorization constraint information, and test task information. It divides the original set of penetration testing tasks into sub-tasks corresponding to each task stage according to the task stage, and then constructs a stage task graph according to task type, dependency relationship, target asset type, risk level, and resource consumption level. In the stage task graph, the nodes are sub-tasks, and the edges are dependencies. The task scheduling module is used to determine the set of executable tasks for the current stage based on the stage task graph, form a queue to be executed, execute sub-tasks according to the queue to be executed, and collect execution data. The scoring calculation module is used to obtain multi-dimensional scores based on historical test records and execution data, and to obtain the comprehensive evaluation value for the current stage based on the multi-dimensional scores. The access control module is used to execute differentiated strategies based on whether the comprehensive evaluation value of the current stage meets the preset threshold; it includes: When the comprehensive evaluation value does not meet the preset threshold, a control instruction is generated based on the corresponding low score dimension, the current stage sub-task is updated according to the control instruction, and the task scheduling module is returned. When the comprehensive evaluation value meets the preset threshold, the next stage release instruction is output, and the next task stage is entered; when the termination condition is met, the penetration test result is output, otherwise the task scheduling module is returned.

[0014] By adopting the above technical solution, this application has the following beneficial effects: This invention comprehensively processes data such as test evidence, request responses, authorization verification, risk status, and resource consumption during the execution process, using the comprehensive evaluation value of stage admission as the basis for advancement, so that stage switching no longer depends on a single rule or human experience; and dynamically updates task status, priority, dependencies, concurrency, and pending queue through instructions such as supplementary reconnaissance, result verification, task rollback, or rescheduling, thereby reducing out-of-bounds requests, reducing invalid verification, and improving scheduling efficiency and result interpretability. Attached Figure Description

[0015] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0016] Figure 1 This illustration shows one of the flowcharts of an access control method for the penetration testing phase provided by an embodiment of the present invention; Figure 2 This illustrates a second flowchart of an access control method for the penetration testing phase provided by an embodiment of the present invention; Figure 3 A schematic diagram of the original penetration testing task set provided in an embodiment of the present invention is shown; Figure 4 The diagram shows a structural block diagram of an access control system for the penetration testing phase provided by an embodiment of the present invention. Detailed Implementation

[0017] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of the present invention and are therefore merely examples, and should not be construed as limiting the scope of protection of the present invention.

[0018] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application should have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0019] In one embodiment, such as Figure 1-2 As shown, a penetration testing phase access control method is provided, including: S1. Obtain target asset information, test authorization constraint information, test task information, and historical test records of the target test object.

[0020] The penetration testing control server first obtains the target asset information, test authorization constraint information, test task information, and historical test records of the target test object. The target asset information describes the asset composition and access points, and may include domain names, subdomains, IP addresses, ports, page entry points, interface addresses, request methods, parameter locations, service fingerprints, and account roles. The test authorization constraint information defines the execution boundaries, such as limiting the authorization scope to a controlled target area address or a specified business system, limiting the time window to a preset period, prohibiting high-impact verification operations due to risk restrictions, and specifying the maximum request volume or maximum CPU utilization and execution time per phase for resource restrictions. The test task information represents the objectives, phase requirements, and expected outputs of this test. Historical test records cover past execution records, abnormal results, verification conclusions, false positive records, resource consumption, and phase progress records, which are used for subsequent scoring, threshold determination, and scheduling optimization.

[0021] The above information, after being organized into a unified input data structure, is used in the task graph of the S2 construction phase.

[0022] S2. Generate an original set of penetration testing tasks based on target asset information, test authorization constraint information, and test task information. Divide the original set of penetration testing tasks into sub-tasks corresponding to each task stage according to the task stage, and construct a stage task graph. In the stage task graph, the nodes are sub-tasks, and the edges are dependencies.

[0023] The following example uses an authorization penetration test of a web application to illustrate this step. Figure 3 As shown, the original set of penetration testing tasks may include: page entry identification task, parameter identification task, request method identification task, abnormal response detection task, candidate anomaly extraction task, multi-source result consistency analysis task, false alarm elimination task, read-only verification task, duplicate confirmation task, and result summary task, etc.

[0024] The task phases include the reconnaissance phase, scanning phase, analysis phase, verification phase, and information fusion phase, executed sequentially. The subtasks in the original penetration testing task set are then divided according to the task phase. The page entry point identification, parameter identification, and request method identification tasks belong to the reconnaissance phase; the anomaly response detection and candidate anomaly extraction tasks belong to the scanning phase; the multi-source result consistency analysis and false alarm elimination tasks belong to the analysis phase; the read-only verification and duplicate confirmation tasks belong to the verification phase; and the result summarization task belongs to the information fusion phase.

[0025] The reconnaissance phase involves tasks such as acquiring basic asset information, page entry points, parameter locations, request methods, and service fingerprints; the scanning phase involves tasks such as identifying candidate abnormal responses or suspicious input points; the analysis phase involves tasks such as attributing, filtering, and assessing the confidence level of candidate anomalies; the verification phase involves tasks such as tasks such as further confirming high-value candidate issues; and the information fusion phase involves tasks such as integrating results from multiple phases and sources.

[0026] Finally, a phase task graph is constructed, represented by a directed graph. Nodes represent subtasks, and edges represent dependencies. Dependencies include three types: prerequisite dependencies, parallel dependencies, and post-triggered dependencies. If a subtask has a prerequisite dependency, it means the current subtask will only be executed after the prerequisite subtask is completed. If a subtask has a parallel dependency, it means the two subtasks will be executed in parallel. If a subtask has a post-triggered dependency, it means the subtask with the post-triggered dependency will be executed after the current subtask produces a preset result or meets a preset triggering condition.

[0027] S3. Based on the phase task diagram, determine the set of executable tasks for the current phase, execute subtasks according to the queue to be executed, and collect execution data.

[0028] The queue to be executed is used to store subtasks that have not yet been completed in the current stage or the next stage after being released; the set of executable tasks for the current task stage is the set of subtasks selected from the queue to be executed, whose task status is pending execution and whose dependency conditions have been met; the set of parallel execution is the set of subtasks in the current set of executable tasks that do not have any pre-dependencies, post-trigger waiting relationships or resource conflicts with each other and can be scheduled to be executed simultaneously, where the subtasks are executed in parallel.

[0029] Based on the phase task diagram, determine the current set of executable subtasks, specifically: If a current subtask has a preceding subtask that it depends on, the current subtask will be added to the set of executable tasks after the preceding subtask is completed. If the current subtask has no unmet prerequisites, the current subtask is added to the set of executable tasks for the current stage; subtasks in the current set of executable tasks that do not have dependency conflicts or resource conflicts with each other form a set of parallel execution tasks. If the current subtask has a subsequent subtask that will be triggered, the subsequent subtask will be added to the set of executable tasks after the current subtask produces a preset result or meets a preset triggering condition.

[0030] The system performs parallel scheduling according to preset concurrency parameters, which limit the number of tasks, request rate or number of threads that can be executed simultaneously in the current stage, in order to control the impact on the target; at the same time, it maintains a task status table, which includes five statuses: pending execution, in execution, completed, suspended and rolled back.

[0031] During subtask execution, current-stage execution data is also collected, including at least one of the following: test evidence, request / response, exception results, task completion, authorization verification, risk status, resource consumption data, and task execution logs. Test evidence data may include page entry point, parameter location, request method, response status code, interface, service fingerprint, and account role information; request / response data may include the number of requests, response content, response latency, repeated trigger results, and retries; authorization verification data may include whether the execution address is within the authorized range, whether the execution time is within the authorized window, and whether the accessed object is out of bounds; resource consumption data may include processing time, network request volume, CPU and memory usage, and retries. These various execution data are used to obtain multi-dimensional scores in S4.

[0032] S4. Based on historical test records and execution data, obtain multi-dimensional scores, and derive a comprehensive evaluation value for stage-based admission based on these scores. Step S4 includes: S41. Obtain multi-dimensional scores based on historical test records and execution data.

[0033] The meanings of each dimension's score are as follows: Evidence Completeness Score represents the completeness of the acquired test evidence; Result Confidence Score represents the credibility of the output result; Goal Achievement Score represents the degree of completion of the preset goal; Authorization Consistency Score represents the degree of conformity between the execution process and the authorized scope, time window, and test boundaries; Risk Impact Score represents the potential business impact or anomaly triggering risk that may result from continued implementation; and Resource Consumption Score represents the degree of time, computing, and network resource consumption. Each score, after normalization, takes a value between 0 and 1 and can be calculated using the following formula.

[0034] Completeness of evidence score , These represent the number of pieces of evidence already obtained and the expected number of pieces of evidence. These represent the number of key pieces of evidence obtained and the expected number, respectively. For evidence type coverage, The component weights are 1; Confidence score of results , The stability score corresponds to the frequency of recurrence of abnormal results. To score the consistency of multi-source results, Score the matching degree of historical similar results. Scoring the degree of false alarm elimination. The component weights are 1; Goal Achievement Score , , These represent the number of tasks completed and the number of planned tasks, respectively. For key target coverage, To achieve the stage target satisfaction rate, The component weights are 1; Authorization Consistency Score , The scores are based on consistency with the authorized scope, time window, and test boundaries, respectively. The component weights are 1; Risk Impact Score , These are service impact, anomaly triggering, and risk scores for contact with sensitive targets. The component weights are 1; Resource consumption rating , The scores are based on processing time, network request volume, computing resource consumption, and number of task retries. The component weights are 1; The above parameters are all derived from the execution data collected by S3 or the expected baseline data determined by S1 and S2: , This data was obtained by statistically analyzing the valid evidence and key evidence items within the test evidence data. , The expected evidence items and key evidence list for the current task phase, as determined by S2, are established. The ratio of the number of evidence types collected to the total number of expected types; key evidence must contain at least one of the following: target entry point, parameters, request method, and key response characteristics. The number of times the abnormal result is repeated and the number of repeated triggers and retries in the request and response data are determined. Determined by the degree of consistency of anomalous results obtained from different tasks, strategies, or time periods. Determined by the degree of matching between the current abnormal result and similar results in the historical record. The proportion of candidate anomalies that were excluded or reviewed after false alarms was determined in conjunction with historical false alarm records. This data is obtained from the task completion data and the statistics of completed tasks in the status table. The number of subtask nodes in phase S2 is determined by the number of nodes in this phase. The ratio of the number of achieved key objectives to the number of preset key objectives is determined by the degree to which the task completion data is satisfied relative to the stage objectives. The proportions of compliant execution addresses, times, and objects in the authorization verification data are determined respectively. The risk status data is used to determine the degree of service anomalies and latency increases. Determined by the number of high-impact anomalies or alarm triggers. Determined by the number of times access is restricted or sensitive targets, and in accordance with S1 risk limits and test boundaries; These are determined by the processing time, network request volume, and CPU and memory usage rates in the resource consumption data. The number of retries is determined by the request and response data and the execution log.

[0035] Among them, abnormal results are candidate abnormal results identified during the execution of subtasks based on request-response data, abnormal status codes, abnormal response content, repeated triggering results, retry results, and task execution logs; key objectives are determined by the expected output of the current task stage, including entry point identification, parameter identification, candidate abnormal identification, abnormal verification, or result summary objectives; the degree of satisfaction of stage objectives is determined based on the number of completed key objectives, the number of completed subtasks, and the achievement of the expected output of the stage; risk status data includes service anomalies, increased response latency, alarm triggering, out-of-bounds access, sensitive target contact, and abnormal resource usage data.

[0036] It is important to understand that all the parameters mentioned above have been normalized before being substituted into the corresponding formulas, so that each score value falls between 0 and 1.

[0037] S42. Based on the multi-dimensional scoring, construct a stage status evaluation vector and perform homogenization processing on cost-type indicators to obtain a standardized evaluation vector.

[0038] Construction phase state evaluation vector The first four items are benefit-type indicators, and the last two are cost-type indicators; after homogenizing the cost-type indicators, a standardized evaluation vector is obtained. .

[0039] S43. Use AHP-entropy weight combination to determine the combined weights of the standardized evaluation vector to obtain the weighted evaluation vector.

[0040] Specifically, a judgment matrix is ​​constructed based on the test phase type, target asset sensitivity level, authorization restriction level, and preset security policy, and subjective weights are obtained using the Analytic Hierarchy Process (AHP). Then, based on historical test data, a sample evaluation matrix is ​​constructed, and the information entropy and difference coefficient of each indicator are calculated using the entropy weight method to obtain the objective weight. .

[0041] Both according to Combination, in the formula Subjective and objective adjustment coefficients and When historical samples are scarce, a larger value is chosen to highlight the pre-set security strategy; when samples are abundant, a smaller value is chosen to enhance data-driven approaches. This is based on combined weights. right The weighted evaluation vector is obtained by weighting. .

[0042] S44. The positive and negative ideal solutions for each scoring dimension are determined using the TOPSIS model to obtain the comprehensive evaluation value for stage admission.

[0043] Determining the positive ideal solution using the TOPSIS model With negative ideal solution According to and Calculate the distance from the current stage to the two ideal solutions. Corresponding weighted evaluation vector , Calculate the corresponding combination weights and the comprehensive evaluation value for stage-based admission. , The value ranges from 0 to 1, with a larger value indicating a closer approximation to the ideal admission state.

[0044] It's important to understand that the weighting of the combined values ​​can be dynamically adjusted based on the type of testing phase, the sensitivity level of the target asset, the level of authorization restrictions, and historical test data. For example, in the reconnaissance phase, it's advisable to increase the weighting of evidence completeness and authorization consistency; in the verification phase, it's advisable to increase the weighting of result confidence and risk impact. If most entry points, parameters, and request methods have been identified in a certain task phase, the evidence completeness score will be higher; if candidate anomalies are repeated in multiple controlled tests and are consistent across multiple sources, the result confidence score will be higher, and vice versa.

[0045] S5. Implement differentiated strategies based on whether the comprehensive evaluation value for stage-based access meets the preset threshold; including: S51. When the comprehensive evaluation value of the stage admission does not meet the preset threshold, generate control instructions based on the corresponding low-scoring dimension, update the set of executable subtasks according to the control instructions, and return to S3.

[0046] If the overall evaluation value for a stage's entry does not meet the preset threshold, then the current stage does not meet the conditions for advancement. The process will be differentiated based on the scoring dimensions that do not meet the preset threshold, specifically as follows: Completeness of evidence score When the threshold is below its sub-threshold, a supplementary reconnaissance instruction is generated to add a supplementary reconnaissance task and written into the pending execution queue. Confidence score of results When the result is below its sub-threshold, a result review instruction is generated to increase the priority of the review task and restrict candidate anomalies from directly entering the next stage; Authorization Consistency Score Below its sub-threshold or risk impact score When the threshold is higher than its sub-threshold, a task rollback instruction is generated to pause the current task stage and restore the sub-task state of the previous task stage that met the advancement conditions; the sub-task state includes five types: pending execution, in execution, completed, suspended, and rollback.

[0047] Resource consumption rating Above its sub-threshold or target achievement score When the threshold falls below its sub-threshold, a rescheduling instruction is generated to rearrange the priorities of unexecuted tasks or adjust dependencies. The system also records the triggered instruction type, corresponding dimension, trigger time, and associated task identifier for subsequent updates and traceability.

[0048] The following provides a detailed explanation of the control commands mentioned above, including supplementary reconnaissance commands, result verification commands, mission rollback commands, and rescheduling commands.

[0049] Under the supplementary reconnaissance command, a new supplementary reconnaissance task node is created and inserted into the corresponding or preceding position of the phase task graph, and simultaneously written to the queue; under the result verification command, the priority of the verification task in the queue is increased, and candidate anomalies are marked "pending verification" to prevent them from directly entering verification; under the task rollback command, the relevant nodes of the current phase are set to a suspended or rollback state, and the executable attributes of the relevant nodes of the previous qualified phase are restored; under the rescheduling command, the priority of unexecuted tasks is rearranged, dependency edges are added, deleted, or modified, and the concurrency is adjusted according to the risk impact or resource consumption.

[0050] In one embodiment, for parallel subtasks within the executable task set, the concurrency parameter is adjusted based on a risk impact score or a resource consumption score; the concurrency parameter limits the maximum number of concurrent tasks, request rate, or number of threads in the current task phase. The concurrency adjustment operation performed by the rescheduling instruction can manifest as reducing the maximum number of concurrent tasks, reducing the request rate, or reducing the number of candidates for simultaneous verification, in order to mitigate the impact of high-risk phases on the target.

[0051] S52. When the comprehensive evaluation value of the stage access meets the preset threshold, output the release instruction for the next task stage and write the corresponding sub-task of the next task stage into the execution queue; output the penetration test result when the termination condition is met, otherwise return to S3.

[0052] If the comprehensive evaluation value meets the preset threshold, it means that the current stage meets the requirements for advancement in terms of evidence sufficiency, result credibility, goal completion, authorization compliance, risk controllability, and resource consumption. Therefore, the next stage release instruction is output, and the corresponding sub-task of the next stage is written into the execution queue.

[0053] The updated set of executable tasks continues to be scheduled, collected, evaluated, judged, and updated. Preset termination conditions include at least one of the following: all subtasks completed, maximum test duration reached, maximum resource consumption limit reached, or penetration test results meeting preset integrity requirements are output. The final output penetration test results include at least one of the following: phase execution record, test evidence results, anomaly result summary, verification results, comprehensive evaluation value results, access determination results, control command records, and task update records.

[0054] To verify the effectiveness of the above method, an implementation verification was conducted in a locally authorized DVWA testbed. The test targets included SQL injection pages and reflected XSS pages, run at low and medium security levels respectively, corresponding to five control paths: allowing access, supplementary reconnaissance, result verification, task rollback, and rescheduling. The preset stage access threshold was set to 0.75, and the following are the comprehensive evaluation values ​​for access at each stage. All results were calculated using the aforementioned AHP-Entropy Weight-TOPSIS model under the same criteria, with the consistency ratio (CR) of the AHP judgment matrix at each stage being less than 0.1.

[0055] Example 1 (Continuous Release): Targeting an SQL injection page, with a low security level and a normal_release runtime flag. During the reconnaissance phase, evidence is obtained including the page entry point, request method, parameter names, response status codes, form structure, and login status, all falling within the authorized scope and time window. The overall evaluation value is... =0.9223, indicating release. The comprehensive evaluation values ​​for the subsequent scanning, analysis, and verification stages were 0.9305, 0.9041, and 0.9652 respectively, with the information fusion stage value being 0.9548. =1.0、 =0.95、 =0.97、 =1.0、 =0.0181、 =0.1281, all stages met the admission requirements. This demonstrates that when evidence is sufficient, results are stable, and risks and resources are controllable, the system can continuously release subsequent staged sub-test tasks according to the stage task graph sequence.

[0056] Example 2 (Supplementary Reconnaissance): Targeting SQL injection pages, with a low security level and low_evidence runtime flag. Under this limited reconnaissance configuration (skipping parameter location and request method identification), the number of valid evidence items actually collected during the reconnaissance phase is relatively small, resulting in low evidence completeness. Only 0.4229, while =0.95、 =0.5267、 =1.0、 =0.0179、 =0.1274, comprehensive evaluation value =0.6942, which is below the threshold. The low score is concentrated on the completeness of evidence. The system outputs "hold" and routes "supplementary reconnaissance", and does not directly enter the scanning stage. This indicates that when the entry point, parameters, or request method information is insufficient, the system can prioritize identifying insufficient evidence and trigger supplementary reconnaissance to supplement key evidence.

[0057] Example 3 (Result Verification): Using a reflected XSS page as the target, with a security level of medium and a runtime flag of low_confidence. Because the medium level filters script tags, candidate anomaly reflections are unstable and inconsistent across multiple sources, resulting in a lower confidence level. Only 0.35. Reconnaissance phase. =0.7763, reaching the threshold for release; after entering the scanning phase... =0.7422 is lower than the threshold, where =1.0、 =0.7、 =1.0、 =0.0179、 =0.1252, low scores are concentrated in the result confidence level, the system outputs review and route "result verification", restricting low confidence candidate results from directly entering the subsequent verification stage.

[0058] Example 4 (Task Rollback): Targeting an SQL injection page, with a low security level and a high_risk_or_resource runtime flag. The comprehensive evaluation values ​​for the reconnaissance, scanning, and analysis phases are 0.9191, 0.9299, and 0.9039, respectively, all released. After initiating an out-of-bounds / restricted path access during the verification phase, authorization consistency is ensured. Reduced to 0.769, risk impact level It rose to 0.4312, while =1.0、 =0.95、 =1.0、 =0.1123, comprehensive evaluation value =0.6291 is lower than the threshold. The system outputs "rollback" and routes "task rollback", suspending the high-risk task in the current stage and restoring the task status of the previous stage that met the progress conditions.

[0059] Example 5 (Rescheduling): Targeting the SQL injection page, with a low security level and a high_resource_reschedule runtime flag. The comprehensive evaluation values ​​for the reconnaissance and scanning phases are 0.9212 and 0.9300 respectively, both released. After entering the analysis phase, the network request volume and processing time increase due to high concurrency candidates, leading to increased resource consumption. It rose to 0.3646, but the failure to complete some planning and analysis tasks resulted in a decrease in the target achievement rate. It dropped to 0.47, while =1.0、 =0.8、 =1.0、 =0.0182, comprehensive evaluation value If the value is 0.5568, which is below the threshold, the system outputs "reschedule" and "routes rescheduled," rearranging the priorities of unexecuted analysis tasks, adjusting their dependencies, and reducing task concurrency. This demonstrates that when resource consumption is too high or the goal is not achieved sufficiently, the system can resume progress through priority and dependency adjustments without rolling back to previous stages.

[0060] As can be seen from the above five examples, the phased access control of this invention does not rely on a single rule, but rather on differentiated handling after comprehensively evaluating six scores based on the AHP-Entropy Weight-TOPSIS model: Example 1 continuously allows access to all stages from reconnaissance to verification; Example 2 triggers supplementary reconnaissance due to insufficient evidence completeness; Example 3 triggers result review due to insufficient result confidence; Example 4 triggers task rollback due to decreased authorization consistency and increased risk impact; Example 5 triggers rescheduling due to low target achievement and increased resource consumption. Furthermore, for the same reflective XSS page, under the low security level, all stages are continuously allowed (the comprehensive evaluation values ​​from reconnaissance to information fusion are 0.8960, 0.9329, 0.8284, 0.9251, and 0.9250 respectively), while under the medium security level, due to script filtering causing a decrease in result confidence, the comprehensive evaluation value in the scanning stage drops to 0.7469 and is transferred to result review, indicating that the score can change accordingly with the enhancement of target protection. The above process is consistent with the control logic of "if the evaluation value meets the standard, it is released; if it does not meet the standard, supplementary reconnaissance, result review, task rollback or rescheduling instructions are generated according to the low score dimension". The evaluation results of each scenario stage can be summarized into the following stage test effect table.

[0061] Table 1. Phase Test Results

[0062] As shown in Table 1, the present invention can trigger release, supplementary reconnaissance, result verification, task rollback and rescheduling path according to the changes in the comprehensive evaluation value and sub-item scores at each stage, so as to avoid blindly advancing when there is insufficient evidence, unstable results, excessive risk or resource overload.

[0063] As can be seen, this embodiment achieves differentiated access control for different stages of penetration testing through comprehensive judgment of six scores, and automatically switches the corresponding control path in cases of insufficient evidence, low confidence, high risk or high resource consumption, thereby improving the controllability of stage advancement, the reliability of results and the flexibility of task scheduling.

[0064] In one embodiment, such as Figure 4 As shown, a penetration testing phase access control system 60 is provided, including: The information acquisition module 601 is used to acquire target asset information, test authorization constraint information, test task information, and historical test records of the target test object; The task construction module 602 is used to generate an original set of penetration testing tasks based on target asset information, test authorization constraint information, and test task information. The original set of penetration testing tasks is divided into sub-tasks corresponding to each task stage according to the task stage. Then, a stage task graph is constructed according to task type, dependency relationship, target asset type, risk level, and resource consumption level. The nodes of the stage task graph are sub-tasks, and the edges are dependencies. The task scheduling module 603 is used to determine the set of executable tasks for the current stage based on the stage task diagram, execute sub-tasks according to the queue to be executed, and collect execution data. The scoring calculation module 604 is used to obtain multi-dimensional scores based on historical test records and execution data, and to obtain the comprehensive evaluation value of the current stage based on the multi-dimensional scores. Access control module 605 is used to execute differentiated strategies based on whether the comprehensive evaluation value of the current stage meets a preset threshold; including: When the comprehensive evaluation value does not meet the preset threshold, a control instruction is generated based on the corresponding low score dimension, the current stage sub-task is updated according to the control instruction, and the task scheduling module is returned. When the comprehensive evaluation value meets the preset threshold, the next stage release instruction is output, and the next task stage is entered; when the termination condition is met, the penetration test result is output, otherwise the task scheduling module is returned.

[0065] The penetration testing phase access control system 60 provided in this application embodiment adopts the same inventive concept as the above-described penetration testing phase access control method and can achieve the same beneficial effects, which will not be repeated here.

[0066] The above embodiments are only used to provide a detailed description of the technical solutions of this application. However, the descriptions of the above embodiments are only for the purpose of helping to understand the methods of the embodiments of the present invention and should not be construed as limiting the embodiments of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art should be covered within the protection scope of the embodiments of the present invention.

Claims

1. A penetration testing phase access control method, characterized in that, include: S1. Obtain target asset information, test authorization constraint information, test task information, and historical test records of the target test object; S2. Generate an original set of penetration testing tasks based on target asset information, test authorization constraint information, and test task information. Divide the original set of penetration testing tasks into sub-tasks corresponding to each task stage according to the task stage, and construct a stage task graph. In the stage task graph, the nodes are sub-tasks, and the edges are dependencies. S3. Based on the phase task diagram, determine the set of executable tasks for the current phase, form a queue to be executed, execute sub-tasks according to the queue to be executed, and collect execution data; S4. Based on historical test records and execution data, obtain multi-dimensional scores, and obtain the comprehensive evaluation value for the current stage based on the multi-dimensional scores; S5. Based on whether the comprehensive evaluation value of the current stage meets the preset threshold, implement a differentiated strategy; including: When the overall evaluation value does not meet the preset threshold, control instructions are generated based on the corresponding low-scoring dimension, the current stage subtask is updated according to the control instructions, and S3 is returned. When the comprehensive evaluation value meets the preset threshold, the next stage release instruction is output, and the next task stage is entered; when the termination condition is met, the penetration test result is output, otherwise it returns to S3.

2. The method according to claim 1, characterized in that, The mission phases consist of the reconnaissance phase, scanning phase, analysis phase, verification phase, and information fusion phase, which are executed sequentially.

3. The method according to claim 2, characterized in that, Dependencies include pre-dependencies, parallelism, and post-triggering. For dependencies of subtasks in any task phase, the following rules apply: If a current subtask has a preceding subtask that it depends on, the current subtask will be added to the set of executable tasks after the preceding subtask is completed. If the current subtask has no unmet prerequisites, the current subtask is added to the set of executable tasks for the current stage. Subtasks that do not have dependencies or resource conflicts with each other in the current set of executable tasks form a set of tasks to be executed in parallel. If a subtask is triggered later, the subsequent subtask will be added to the set of executable tasks in the current stage after the current subtask produces a preset result or meets a preset triggering condition.

4. The method according to claim 1, characterized in that, S4 include: Based on historical test records and execution data, obtain multi-dimensional scores; Based on multi-dimensional scoring, a stage status evaluation vector is constructed, and cost-type indicators are homogenized to obtain a standardized evaluation vector. The combined weights of the standardized evaluation vector are determined by using the AHP-entropy weight combination, resulting in a weighted evaluation vector. The comprehensive evaluation value for the current stage is determined based on the TOPSIS model.

5. The method according to claim 1 or 4, characterized in that, Multi-dimensional scoring includes: Completeness of evidence score , These represent the number of pieces of evidence already obtained and the expected number of pieces of evidence. These represent the number of key pieces of evidence obtained and the expected number, respectively. For evidence type coverage, For component weights; Confidence score of results , The stability score corresponds to the frequency of recurrence of abnormal results. To score the consistency of multi-source results, Score the matching degree of historical similar results. Scoring the degree of false alarm elimination. For component weights; Goal Achievement Score , , These represent the number of tasks completed and the number of planned tasks, respectively. For key target coverage, To achieve the stage target satisfaction rate, For component weights; Authorization Consistency Score , The scores are based on consistency with the authorized scope, time window, and test boundaries. For component weights; Risk Impact Score , These are service impact, anomaly triggering, and risk scores for contact with sensitive targets. For component weights; Resource consumption rating , The scores are based on processing time, network request volume, computing resource consumption, and number of task retries. For component weights.

6. The method according to claim 5, characterized in that, Control commands include supplementary reconnaissance commands, result verification commands, mission rollback commands, and rescheduling commands. When the evidence completeness score does not meet the corresponding sub-threshold, a supplementary reconnaissance instruction is generated to generate a supplementary reconnaissance sub-task and write it into the queue to be executed. When the confidence score of the result does not meet the corresponding sub-threshold, a result review instruction is generated to increase the priority of the review sub-task and restrict the current candidate abnormal result from entering the next task stage. When the authorization consistency score or risk impact score does not meet the corresponding sub-threshold, a task rollback instruction is generated to pause the sub-tasks of the current task stage and restore the task status of the corresponding sub-tasks of the previous task stage that met the advancement conditions. When the resource consumption score or target achievement score does not meet the corresponding sub-threshold, a rescheduling instruction is generated to reorder the priority of the unexecuted sub-tasks in the current stage or adjust the dependencies of the sub-tasks.

7. The method according to claim 5, characterized in that, For parallel subtasks in the set of executable tasks, the concurrency parameter is adjusted based on the risk impact score or resource consumption score; The concurrency parameter limits the maximum number of concurrent tasks, request rate, or number of threads in the current task phase.

8. The method according to claim 1, characterized in that, The termination conditions must include at least one of the following: all subtasks have been completed, the maximum test duration has been reached, the maximum resource consumption limit has been reached, or the penetration test results that meet the preset integrity requirements have been output. Penetration test results shall include at least one of the following: phase execution record, test evidence results, summary of abnormal results, verification results, comprehensive evaluation value results, access determination results, control command record, and task update record.

9. An access control system for the penetration testing phase, characterized in that, include: The information acquisition module is used to acquire target asset information, test authorization constraint information, test task information, and historical test records of the target test object; The task construction module is used to generate an original set of penetration testing tasks based on target asset information, test authorization constraints, and test task information. It divides the original set of penetration testing tasks into sub-tasks corresponding to each task stage, and then constructs a stage task graph based on task type, dependency relationship, target asset type, risk level, and resource consumption level. In the stage task graph, the nodes are sub-tasks, and the edges are dependencies. The task scheduling module is used to determine the set of executable tasks for the current stage based on the stage task graph, form an execution queue, execute the subtasks in the execution queue, and collect execution data. The scoring calculation module is used to obtain multi-dimensional scores based on historical test records and execution data, and to obtain the comprehensive evaluation value for the current stage based on the multi-dimensional scores. The access control module is used to execute differentiated strategies based on whether the comprehensive evaluation value of the current stage meets the preset threshold; it includes: When the comprehensive evaluation value does not meet the preset threshold, a control instruction is generated based on the corresponding low score dimension, the current stage sub-task is updated according to the control instruction, and the task scheduling module is returned. When the comprehensive evaluation value meets the preset threshold, the next stage release instruction is output, and the next task stage is entered; when the termination condition is met, the penetration test result is output, otherwise the task scheduling module is returned.

Images