A multi-penetration vulnerability cooperative testing method, device, equipment and medium

Abstract

Embodiments of the present application disclose a kind of multi-permeation vulnerability cooperative testing method, device, equipment and medium.The method comprises: based on automatic crawler engine traversal target network space real-time collection vulnerability information, determine the combination label of vulnerability information, the vulnerability information of vulnerability and combination label are stored to dynamic vulnerability feature library;Combination label includes the classification label obtained by classifying vulnerability information according to different types;For the vulnerability in dynamic vulnerability feature library, according to vulnerability information and combination label, the vulnerability is detected based on vulnerability correlation analysis model, and potential vulnerability exploit chain is obtained;According to the correlation coefficient between two vulnerabilities in potential vulnerability exploit chain, and the significant annotation result of vulnerability, effective vulnerability exploit chain is screened from potential vulnerability exploit chain;According to effective vulnerability exploit chain, adaptive attack script is generated to carry out attack test.The above scheme can learn vulnerability correlation relationship by reinforcement learning model autonomously, unknown dynamic dependence can be identified.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a collaborative testing method, apparatus, device, and medium for multiple penetration vulnerabilities. Background Technology

[0002] In current cybersecurity penetration testing techniques, known technologies primarily revolve around a single vulnerability detection and exploitation model. Core techniques and tools include: vulnerability scanning tools such as Nessus and OpenVAS, which scan target networks using pre-defined vulnerability signature databases to identify single vulnerabilities (e.g., SQL injection, buffer overflow, weak passwords), but can only output a list of independent vulnerabilities and cannot analyze the relationships between them; single vulnerability exploitation tools such as the basic modules of the Metasploit framework, which require manual selection of target vulnerabilities and configuration of attack parameters (e.g., target IP, port, attack payload type) to launch an attack against a single vulnerability, lacking support for combined exploitation of multiple vulnerabilities; and static vulnerability chain generation methods, where some techniques construct fixed exploit chains by manually analyzing vulnerability dependencies (e.g., Web injection vulnerability → low-privilege acquisition → system configuration vulnerability → privilege escalation), but rely on human experience and cannot dynamically adapt to changes in the target network environment (e.g., target system patch updates, network topology adjustments). The core logic of known technologies is identifying a single vulnerability → manually configuring exploit parameters → single attack verification, primarily focusing on the discovery and exploitation of independent vulnerabilities, without forming an automated system for the collaborative exploitation of multiple vulnerabilities. Summary of the Invention

[0003] This application provides a method, apparatus, device, and medium for collaborative testing of multiple penetration vulnerabilities, so as to achieve collaborative exploitation of multiple penetration vulnerabilities.

[0004] According to one aspect of this application, a collaborative testing method for multiple penetration vulnerabilities is provided, the method comprising:

[0005] Based on an automated crawler engine, vulnerability information is collected in real time by traversing the target network space, and combined tags of the vulnerability information are determined. The vulnerability information and combined tags are then stored in a dynamic vulnerability feature database. The combined tags include classification tags obtained by classifying the vulnerability information according to different types.

[0006] For vulnerabilities in the dynamic vulnerability feature library, the vulnerability is detected based on the vulnerability information and the combined label using a vulnerability association analysis model to obtain potential vulnerability exploitation chains; wherein, the vulnerability association analysis model is a reinforcement learning-based model;

[0007] Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, effective vulnerability exploitation chains are selected from the potential vulnerability exploitation chains.

[0008] An adaptive attack script is generated based on the effective vulnerability exploit chain for attack testing.

[0009] According to one aspect of this application, a collaborative testing apparatus for multiple penetration vulnerabilities is provided, the apparatus comprising:

[0010] The vulnerability identification module is used to collect vulnerability information in real time by traversing the target network space based on an automated crawler engine, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature database; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types;

[0011] The potential vulnerability exploitation chain determination module is used to detect vulnerabilities in the dynamic vulnerability feature library based on the vulnerability information and the combined label according to the vulnerability association analysis model, and obtain potential vulnerability exploitation chains; wherein, the vulnerability association analysis model is a reinforcement learning-based model;

[0012] The effective vulnerability exploit chain determination module is used to filter effective vulnerability exploit chains from the potential vulnerability exploit chains based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploit chain and the vulnerability saliency labeling results.

[0013] An adaptive attack script determination module is used to generate an adaptive attack script based on the effective vulnerability exploit chain for attack testing.

[0014] According to another aspect of this application, an electronic device is provided, the electronic device comprising:

[0015] At least one processor; and,

[0016] A memory that is communicatively connected to at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to execute the collaborative testing method for multiple penetration vulnerabilities according to any embodiment of this application.

[0018] According to another aspect of this application, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute and implement a collaborative testing method for multiple penetration vulnerabilities according to any embodiment of this application.

[0019] According to another aspect of this application, a computer program product is provided, comprising a computer program that, when executed by a processor, implements a collaborative testing method for multiple penetration vulnerabilities according to any embodiment of this application.

[0020] The technical solution of this application embodiment is based on an automated crawler engine that traverses the target network space in real time to collect vulnerability information and determines the combined tags of the vulnerability information. The vulnerability information and combined tags are stored in a dynamic vulnerability feature library. The combined tags include classification tags obtained by categorizing the vulnerability information according to different types. For vulnerabilities in the dynamic vulnerability feature library, a vulnerability association analysis model is used to detect the vulnerabilities based on the vulnerability information and the combined tags to obtain potential vulnerability exploitation chains. The vulnerability association analysis model is a reinforcement learning-based model. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the saliency labeling results of the vulnerabilities, effective vulnerability exploitation chains are selected from the potential vulnerability exploitation chains. An adaptive attack script is generated based on the effective vulnerability exploitation chain for attack testing. The above solution achieves real-time collection and dynamic updating of vulnerability information, constructs a dynamic feature library covering all vulnerabilities in the target network, and provides basic data support for multi-vulnerability association. It uses intelligent algorithms to achieve automated vulnerability association analysis, generating potential vulnerability exploitation chains that conform to actual attack logic. Effective exploitation chains are selected through simulated attack testing, and an attack script with environmental adaptability is generated, improving the attack success rate and environmental adaptability.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a collaborative testing method for multiple penetration vulnerabilities provided in an embodiment of this application;

[0024] Figure 2 A flowchart illustrating a collaborative testing method for multiple penetration vulnerabilities, provided as another embodiment of this application;

[0025] Figure 3 A flowchart illustrating a collaborative testing method for multiple penetration vulnerabilities, provided as another embodiment of this application;

[0026] Figure 4 A schematic diagram of the structure of a collaborative testing device for multiple penetration vulnerabilities provided in an embodiment of this application;

[0027] Figure 5This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," "third," "fourth," "actual," "preset," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] The acquisition, storage, use, and processing of data in this application comply with relevant national laws and regulations. The acquired data is obtained with authorization and will not be disclosed without permission, used for illegal purposes, purposes detrimental to the interests of others, or for personalized analysis or product promotion. It should be noted that certain software, components, models, and other existing industry solutions may be mentioned in the embodiments of this application. These should be considered exemplary and intended only to illustrate the feasibility of implementing the technical solution of this application, but do not imply that the applicant has already used or necessarily used the relevant content of such solutions.

[0031] Figure 1 This flowchart illustrates a collaborative testing method for multiple vulnerabilities provided in this application. This application is applicable to situations where multiple vulnerabilities are linked to form an effective exploit chain for testing. The method can be executed by a collaborative testing device for multiple vulnerabilities, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0032] S110. Based on an automated crawler engine, traverse the target network space to collect vulnerability information in real time, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature database; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types.

[0033] Among them, the automated crawler engine is an automated data collection program framework that can automatically and in batches crawl web page data and perform structured processing. Its core function is to replace manual copying and downloading of web page content, and efficiently obtain publicly available data on the Internet in batches. In the embodiments of this application, the automated crawler engine can be, for example, the Scrapy engine. The target cyberspace is the specific network range that the action ultimately targets in network activities (attacks, mapping, defense, resource deployment, etc.). It is a comprehensive target domain that combines physical infrastructure, virtual information environment, and human network activities. For example, it includes servers, terminal devices, network devices, and application systems in the target subnet. The target subnet refers to the specific subnet that the action ultimately targets in various network operations (migration, routing, attack, deployment). It is a clear concept relative to the source network / existing network, and its core function is to define the target network location of the operation. Vulnerability information reflects the characteristics of a vulnerability, including, for example, vulnerability type (such as SQL injection, buffer overflow, weak password, misconfiguration, etc.); triggering conditions (such as specific user input, specific open ports, specific application versions, etc.); scope of impact (such as single-node impact, cross-subnet impact, core business system impact, etc.); and associated target entities (such as the server IP, application name, subnet identifier, etc.). Combined tags include classification tags obtained by categorizing the vulnerability information according to different types.

[0034] In this embodiment, an automated web crawler engine can traverse the target network space in real time to collect vulnerability information, and determine combined tags for the vulnerability information to reflect different dimensions of vulnerability classification. The vulnerabilities, vulnerability information, and combined tags are stored in a dynamic vulnerability signature database for subsequent analysis.

[0035] In this embodiment of the application, determining the combined tags of the vulnerability information includes:

[0036] The vulnerability information is classified according to at least two preset classification methods to obtain classification results in at least two dimensions; wherein, the at least two preset classification methods include classification by vulnerability type, classification by triggering conditions and scope of impact, and classification by associated target entities;

[0037] Based on the classification results of at least two dimensions, determine the combined tags of the vulnerability information.

[0038] For example, each vulnerability information is classified into three levels and a combined tag is set, specifically including:

[0039] First category: Classified by vulnerability type (such as SQL injection, buffer overflow);

[0040] The second category is based on the triggering condition and the scope of impact (e.g., user input triggering - single node impact, port open triggering - cross-subnet impact).

[0041] The third category: categorized by associated target entities (e.g., associated web server 192.168.1.100, associated database server 192.168.2.200);

[0042] Combined tag format: First category result - Second category result - Third category result (e.g., SQL injection - user input trigger - single node impact - associated web server 192.168.1.100).

[0043] Dynamic Feature Library Construction: Vulnerability information with combined tags is stored in a graph database (such as Neo4j) to form a dynamic vulnerability feature library. The data in the library is updated in real time (the crawler engine traverses the target network every 30 minutes to update newly added vulnerabilities, patched vulnerabilities, and changes in vulnerability attributes). Vulnerability information is collected in real time through automated crawlers, and combined tags are set according to a three-level classification system: vulnerability type, triggering conditions, impact scope, and associated target entities. This achieves dynamic updating and accurate identification of vulnerability information, solving the problem of incomplete coverage in traditional static libraries.

[0044] S120. For the vulnerabilities in the dynamic vulnerability feature library, the vulnerability is detected based on the vulnerability information and the combined label according to the vulnerability association analysis model to obtain the potential vulnerability exploitation chain; wherein, the vulnerability association analysis model is a reinforcement learning-based model.

[0045] The vulnerability association analysis model is a reinforcement learning-based model. In this embodiment, for vulnerabilities in graph data, the vulnerability association analysis model can detect vulnerabilities based on vulnerability information and combined tags. Taking vulnerabilities in a dynamic vulnerability feature library as input, the association strategy is optimized through iterative learning to automatically perform association analysis on all vulnerabilities and generate potential vulnerability exploitation chains.

[0046] In the process of correlation detection based on vulnerability correlation analysis models, the action space, state space, and reward function in the reinforcement learning process can be determined based on vulnerability information and combined labels. Reinforcement learning iterations are then performed based on the action space, state space, and reward function. For example, in this embodiment, the main focus is on analyzing the correlations between vulnerabilities; therefore, the action space can be determined based on these correlations. Combined labels are static features, and the state space can be determined based on these labels. The reward function is determined based on the vulnerability exploitation success rate and attack path length.

[0047] In this embodiment of the application, the vulnerability is detected based on the vulnerability information and the combined tag using a vulnerability association analysis model, and the potential vulnerability exploitation chain is obtained as follows:

[0048] The reinforcement learning algorithm is used to define the state space based on the combined labels, the action space based on the associated operations of the vulnerability, and the reward function based on the vulnerability exploitation success rate and the attack path length.

[0049] Based on the state space, the action space, and the reward function, model training and correlation analysis are performed to determine potential vulnerability exploitation chains.

[0050] For example, a reinforcement learning-based vulnerability association analysis model (RL-VCAM) enables automated vulnerability association, specifically including:

[0051] Model Construction: Q-learning reinforcement learning algorithm is adopted, defined as follows:

[0052] State space: Combination tags of vulnerabilities in the dynamic vulnerability signature database (such as "SQL injection - ... - Web server A" "weak password - ... - Database server B");

[0053] Action space: the associated operations between vulnerabilities (e.g., "vulnerability X → vulnerability Y" means that the attack result of exploiting vulnerability X can trigger vulnerability Y);

[0054] Reward function: Using the exploit success rate (P) and attack path length (L) as parameters, the formula is: ,in, 0.7 The weighting coefficient is 0.3. Set the maximum path length (e.g., 10). The higher, The shorter the length, the higher the reward.

[0055] Model training and correlation analysis: Taking vulnerabilities in the dynamic vulnerability feature library as input, the model optimizes the correlation strategy through iterative learning (the training samples are historical vulnerability exploitation chain data, including 1000+ real attack cases). Finally, it performs automated correlation analysis on all vulnerabilities and generates potential vulnerability exploitation chains (such as "SQL injection vulnerability of Web server A → weak password vulnerability of database server B → privilege escalation vulnerability of core server C").

[0056] S130. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, select effective vulnerability exploitation chains from the potential vulnerability exploitation chains.

[0057] For each potential vulnerability exploitation chain, the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain can be determined, as well as the salience labeling results of the vulnerabilities. Based on the correlation coefficient and salience labeling results, effective vulnerability exploitation chains can be screened from the potential vulnerability exploitation chains.

[0058] The correlation coefficient reflects the relationship between two vulnerabilities in a potential exploit chain, such as the impact of an attack on one vulnerability on another. In exploit chain analysis and program analysis scenarios, the saliency labeling result is a quantitative score of the importance of each link in the exploit chain, used to distinguish which links are the core key to advancing the attack and which are irrelevant and redundant.

[0059] For example, a typical approach is to select potential exploit chains with high correlation coefficients and significant annotation results indicating that the vulnerability is a key element as effective exploit chains. A comprehensive score can be determined based on the quantified correlation coefficients and significant annotation results, and effective exploit chains can be selected from the potential exploit chains based on this comprehensive score.

[0060] S140. Generate an adaptive attack script based on the effective vulnerability exploit chain for attack testing.

[0061] For example, adaptive attack scripts can be generated based on effective vulnerability exploit chains, and the attack payload can be automatically adjusted (e.g., MSFvenom payload for Windows systems, PayloadLinux payload for Linux systems).

[0062] The technical solution of this application embodiment is based on an automated crawler engine that traverses the target network space in real time to collect vulnerability information and determines the combined tags of the vulnerability information. The vulnerability information and combined tags are stored in a dynamic vulnerability feature library. The combined tags include classification tags obtained by categorizing the vulnerability information according to different types. For vulnerabilities in the dynamic vulnerability feature library, a vulnerability association analysis model is used to detect the vulnerabilities based on the vulnerability information and the combined tags to obtain potential vulnerability exploitation chains. The vulnerability association analysis model is a reinforcement learning-based model. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the saliency labeling results of the vulnerabilities, effective vulnerability exploitation chains are selected from the potential vulnerability exploitation chains. An adaptive attack script is generated based on the effective vulnerability exploitation chain for attack testing. The above solution achieves real-time collection and dynamic updating of vulnerability information, constructs a dynamic feature library covering all vulnerabilities in the target network, and provides basic data support for multi-vulnerability association. It uses intelligent algorithms to achieve automated vulnerability association analysis, generating potential vulnerability exploitation chains that conform to actual attack logic. Effective exploitation chains are selected through simulated attack testing, and an attack script with environmental adaptability is generated, improving the attack success rate and environmental adaptability.

[0063] Figure 2 This is a flowchart illustrating a collaborative testing method for multiple penetration vulnerabilities, provided as another embodiment of this application. This embodiment is an optimization based on the above embodiment; solutions not described in detail in this embodiment are found in the above embodiment. Figure 2 As shown, the method in this embodiment of the application specifically includes the following steps:

[0064] S210. Based on an automated crawler engine, traverse the target network space to collect vulnerability information in real time, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature database; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types.

[0065] S220. For each potential vulnerability exploitation chain, test the potential vulnerability exploitation chain and determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain.

[0066] For example, test cases are used to test each potential vulnerability exploitation chain to determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain, reflecting the relationship between the two vulnerabilities.

[0067] In this embodiment of the application, the potential vulnerability exploitation chain is tested to determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain, including:

[0068] For the vulnerabilities in the potential exploit chain, based on the scenario in which the vulnerabilities occur, the vulnerabilities in the potential exploit chain are tested according to the set test cases and defense test cases to determine the normal working saturation attribute value and the maximum working saturation attribute value of the vulnerabilities; wherein, the normal working saturation attribute value is the value when the attack success rate tends to be stable under normal attack intensity, and the maximum working saturation attribute is set to the value when the attack success rate tends to be stable under extreme attack intensity.

[0069] The set test cases and the defense test cases are sorted according to the historical attack success rate, and the threshold for the number of test cases is determined based on the normal workload saturation attribute value and the maximum workload saturation attribute value.

[0070] Based on the threshold for the number of test cases, the test case with the highest historical attack success rate is selected as the target test case.

[0071] Based on the target test cases, other vulnerabilities in the potential vulnerability exploitation chain are tested, and the correlation coefficient between the vulnerability and the other vulnerabilities is determined based on the test results of the vulnerability and the other vulnerabilities.

[0072] For example, in determining the correlation coefficient between vulnerabilities in a potential exploit chain, the test results of each vulnerability are determined based on test cases. Specifically, for any vulnerability in a potential exploit chain, based on the vulnerability's occurrence scenario, the vulnerability in the potential exploit chain is tested according to the set test cases and defense test cases to determine the vulnerability's normal workload saturation attribute value and maximum workload saturation attribute value. The normal workload saturation attribute value refers to the value when the attack success rate tends to stabilize under normal attack intensity. In the field of network vulnerability testing, normal attack intensity refers to a standardized test intensity that simulates the methods commonly used by real attackers and conforms to the average attack capability. It is the benchmark for classifying test levels and comparing test results. The attack success rate tending to stabilize can mean that the announcement and success rate no longer change within a certain period of time, or the change range is less than a preset range. The maximum workload saturation attribute is set to the value when the attack success rate tends to stabilize under extreme attack intensity. Extreme attack intensity is a test level relative to normal attack intensity, referring to the highest test intensity that uses extreme resources and methods beyond the capabilities of a normal attacker to trigger as many exploitable vulnerabilities as possible. The core objective is to uncover all potential risks.

[0073] Test cases and defense test cases can be sorted according to their historical attack success rates. A threshold for the number of test cases can be determined based on the normal workload saturation value and the maximum workload saturation value. This threshold reflects the number of target test cases to be selected. The test case with the highest historical attack success rate is selected as the target test case based on this threshold. If the total number of test cases exceeds the threshold, then the test case with the highest historical attack rate is selected as the threshold number of target test cases; otherwise, all test cases are selected as target test cases.

[0074] Based on the target test cases, other vulnerabilities in the potential vulnerability exploitation chain are tested, and the correlation coefficient between the vulnerability and other vulnerabilities is determined based on the test results of the vulnerability and other vulnerabilities.

[0075] In this embodiment of the application, determining the threshold for the number of test cases based on the normal workload saturation attribute value and the maximum workload saturation attribute value includes:

[0076] The difference coefficient is determined based on the relative deviation between the normal working saturation attribute value and the maximum working saturation attribute value corresponding to the vulnerability;

[0077] The balance coefficient is determined based on the historical actual number of times the vulnerability has been exploited and the predicted number of times it has been exploited.

[0078] The threshold for the number of test cases is determined based on the difference coefficient, the balance coefficient, the attack intensity correction coefficient, and the maximum number of successful attacks.

[0079] For example, the specific process for determining the threshold number of test cases is as follows: A difference coefficient is determined based on the relative deviation between the regular work saturation attribute value and the maximum work saturation attribute value corresponding to the vulnerability, expressed as: ;in, This is the normal working saturation attribute value. This represents the maximum operational saturation attribute value. The balance coefficient is determined based on the historical actual exploit count and the predicted exploit count of the vulnerability, expressed as: ; This represents the balance coefficient of the i-th vulnerability. This represents the historical number of times the i-th vulnerability has been actually exploited. This represents the predicted number of exploits for the i-th vulnerability; This indicates the quantity threshold, and max represents the maximum value symbol. The notation for the logarithmic function is used. Based on the difference coefficient, the balance coefficient, the attack intensity correction coefficient, and the maximum number of successful attacks, a threshold for the number of test cases is determined, expressed as: ;in, This represents the maximum number of successful attacks on the i-th vulnerability; This represents the attack strength correction factor for the i-th vulnerability; The symbol indicates rounding up.

[0080] In this embodiment of the application, determining the correlation coefficient between the vulnerability and the other vulnerabilities based on the test results of the vulnerability and other vulnerabilities includes:

[0081] Based on the test results obtained by testing the vulnerabilities in the potential vulnerability exploitation chain using each target test case, determine the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate.

[0082] For each target test case, the correlation coefficient is determined by the ratio of the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate, to the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities and the test weight of the target test case.

[0083] For example, in determining the correlation coefficient between a vulnerability and other vulnerabilities, the test results are determined by testing other vulnerabilities based on the target test case. Based on the test results for the vulnerability and other vulnerabilities, the path weight, attack overlap, test weight of the target test case, and cross-vulnerability exploitation success rate of the attack path formed by the vulnerability and other vulnerabilities are determined. The correlation coefficient is determined based on the above items and is expressed as:

[0084] Where Mj represents the number of target test cases in the final test case set for the j-th other vulnerability; This represents the correlation coefficient between the j-th other vulnerability and the i-th corresponding vulnerability; This represents the test weight of the k-th target test case in the final test case set; This represents the path weight of the attack path formed by the k-th target test case in the final test case set for the i-th corresponding vulnerability and the j-th other vulnerability; This indicates the degree of attack overlap between the k-th target test case in the final test case set and the attack path formed by the i-th corresponding vulnerability and the j-th other vulnerabilities. This represents the cross-vulnerability exploit success rate of the k-th target test case in the final test case set; The total number of target test cases for the i-th vulnerability after being divided based on the sorting results.

[0085] S230. Determine the salience labeling result of the vulnerability based on the number of paths where the vulnerability is located and the penetration depth.

[0086] For example, the salience of a vulnerability can be determined based on the number of paths leading to the vulnerability and the depth of penetration, reflecting whether the vulnerability is a critical link. Generally, the degree of criticality reflected by the salience description is positively correlated with the number of paths and the depth of penetration.

[0087] In this embodiment of the application, the salience labeling result of the vulnerability is determined based on the number of paths where the vulnerability is located and the penetration depth, including:

[0088] A vulnerability map is constructed based on directly related target entities to determine the penetration depth; wherein, the related target entities are the hardware and software to which the vulnerability belongs;

[0089] The first weight of the vulnerability is determined based on the number of paths where the vulnerability is located and the penetration depth.

[0090] The second weights of other vulnerabilities are determined based on the first weight of the aforementioned vulnerability.

[0091] Based on the first weight and the second weight, the saliency labeling results of the vulnerability and the other vulnerabilities are determined.

[0092] This involves associating the hardware and software associated with the vulnerability in the target entity, such as the server IP address, application name, and subnet identifier. A vulnerability map is constructed based on the directly associated target entities to determine the penetration depth. A first weight for each vulnerability is determined based on the number of paths leading to it and the penetration depth. Generally, the first weight is positively correlated with both the number of paths and the penetration depth. A second weight for other vulnerabilities is determined based on the first weight of the vulnerability, specifically: (1 - sum of all first weights of vulnerabilities) / number of other vulnerabilities. The saliency of the vulnerability and other vulnerabilities is then determined based on the first and second weights. In other words, the first weight directly reflects the saliency of the vulnerability, and the second weight reflects the saliency of other vulnerabilities. If the first weight is greater than a preset weight threshold, the vulnerability is considered a critical link; otherwise, it is not. Similarly, if the second weight is greater than a preset weight threshold, other vulnerabilities are considered critical links; otherwise, they are not.

[0093] S240. Based on the correlation coefficient and the saliency labeling results, determine the effective vulnerability exploitation chain in the potential vulnerability exploitation chain.

[0094] S250. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, select effective vulnerability exploitation chains from the potential vulnerability exploitation chains.

[0095] S260. Generate an adaptive attack script based on the effective vulnerability exploit chain for attack testing.

[0096] The solution in this application embodiment tests each potential vulnerability exploitation chain to determine the correlation coefficient between two vulnerabilities in the chain; it then determines the saliency labeling result of the vulnerability based on the number of paths and penetration depth of the vulnerability; finally, it identifies the effective exploitation chains within the potential vulnerability exploitation chains based on the correlation coefficient and the saliency labeling result. This solution improves the effectiveness of exploitation chains by constructing a mining test matrix, calculating correlation coefficients, and saliency labeling data flow / control flow to filter out effective exploitation chains that are "closely related and have significant key links."

[0097] Figure 3 This is a flowchart illustrating a collaborative testing method for multiple penetration vulnerabilities, provided as another embodiment of this application. This embodiment is an optimization based on the above embodiments; solutions not described in detail in this embodiment are found in the above embodiments. Figure 3 As shown, the method in this embodiment of the application specifically includes the following steps:

[0098] S310. Based on an automated crawler engine, traverse the target network space to collect vulnerability information in real time, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature database; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types.

[0099] S320. For the vulnerabilities in the dynamic vulnerability feature library, the vulnerability is detected based on the vulnerability information and the combined label according to the vulnerability association analysis model to obtain the potential vulnerability exploitation chain; wherein, the vulnerability association analysis model is a reinforcement learning-based model.

[0100] S330. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, select effective vulnerability exploitation chains from the potential vulnerability exploitation chains.

[0101] S340. Construct an augmentation set based on the effective vulnerability exploitation chain.

[0102] For example, the vulnerability sequence of an effective exploit chain (e.g., V001→V002), attack path nodes (e.g., 192.168.1.100), and node permissions (e.g., administrator permission P03) are converted into string chains (e.g., V001-I100-P03-V002). These chains are then projected onto a string blank table (rows: vulnerability type, columns: node permissions), and the frequency and distribution of each string are statistically analyzed (preset frequency = 5, strings exceeding this are considered high-frequency). The adjacent strings of high-frequency strings are identified, and a static vulnerability array is extracted (e.g., the buffer overflow vulnerability array corresponding to the adjacent string I100). Boundaries are constructed: the maximum boundary (containing all strings) and the minimum boundary (containing high-frequency strings) are determined based on the string distribution. Arrays are divided: the static vulnerabilities at the minimum boundary form the first array, and those between the maximum and minimum boundaries form the second array. Vulnerability importance is determined by 0.6 × frequency percentage + 0.4 × distance normalization value, forming an augmented set.

[0103] S350. Select a vulnerability combination from the augmented set, merge it with the effective vulnerability exploit chain, and obtain the initial script corresponding to the merged vulnerability from the attack script database.

[0104] Vulnerability combinations are filtered by augmentation set type order / 2 and integrated with effective vulnerability exploitation chains to obtain corresponding initial scripts from the attack script database (storing 1000+ scripts).

[0105] S360. Randomly select a vulnerability combination from the minimum boundary of the effective vulnerability exploitation chain, and obtain the first script corresponding to the selected vulnerability combination from the attack script database.

[0106] Randomly select vulnerability combinations from the minimum boundary of the effective vulnerability exploit chain, and obtain the corresponding first script from the attack script database.

[0107] S370. Aggregate the string chains of the effective vulnerability exploit chain, and obtain the second script corresponding to the aggregation result from the attack script database.

[0108] For string chain aggregation analysis of effective exploit chains (e.g., K-means clustering), obtain the second script corresponding to the aggregation results from the attack script database.

[0109] S380. Determine the adaptive attack script based on the initial script, the first script, and the second script.

[0110] Subscript overlap analysis: Identify overlapping subscripts (such as data encryption subscripts) of the initial / first / second scripts; Construct a collaborative graph: Combine the historical update curves of subscripts (subscripts with ≥3 updates in the last 6 months are considered active) to construct a collaborative utilization graph of subscripts; Dynamic adaptation generation: Combine real-time collected target system environment parameters (operating system version, application configuration, network topology) to select active subscripts from the collaborative graph and generate adaptive attack scripts (AAS), which can automatically adjust the attack payload (e.g., MSFvenom payload for Windows systems, PayloadLinux payload for Linux systems).

[0111] In this embodiment of the application, the method further includes:

[0112] Penetration testing was conducted based on adaptive attack scripts to determine the scope of impact index and the severity level index.

[0113] The priority level of the effective vulnerability exploit chain is determined based on the impact scope index and the hazard level index. The chain is then optimized based on the priority level and the effective vulnerability exploit chain. Subsequent penetration tests are then conducted based on the optimized effective vulnerability exploit chain.

[0114] Optimize the effective exploit chain based on attack feedback, and conduct continuous penetration testing, specifically including:

[0115] Quantitative evaluation indicators:

[0116] Impact Scope Index (IRI):

[0117] (For example, if the target weight is 0.8, the affected percentage is 0.5, and the subnet coverage / total subnets are 0.6, then the IRI is 0.8 × 0.5 + 0.6 × 0.3 = 0.58).

[0118] Hazard Level Index (HLI): HLI = Level of Privilege Escalation 0.5+ data leakage amount 0.3+ service interruption duration 0.2 (If privilege escalation is 0.8, data leakage is 0.5, and service interruption is 0.3, then HLI = 0.5 × 0.8 + 0.3 × 0.5 + 0.2 × 0.3 = 0.59).

[0119] Utilizing chain optimization strategies:

[0120] High-priority chain marking: If IRI > first threshold (e.g., 0.6) and HLI > second threshold (e.g., 0.5), it is marked as a high-priority chain and given priority for subsequent penetration testing;

[0121] Exploitation chain update: If the threshold is not met, update the vulnerability combination label (e.g., adjust the scope of associated targets in the third category) and re-execute step 2 to generate a new exploit chain;

[0122] Utilize chain deletion: If the threshold is not met for n0 consecutive times (n0=3), delete the valid utilization chain to avoid resource waste.

[0123] Continuous penetration testing: Based on the optimized effective exploit chain (including the high-priority chain and newly generated chains), steps 3-5 are re-executed to form a test-feedback-optimization closed loop, continuously improving penetration testing effectiveness. The attack effect is quantified based on the impact scope index and the severity index. The exploit chain is optimized through a high-priority chain marking-update-deletion strategy, forming a test-feedback-optimization closed loop to achieve continuous iterative improvement in penetration testing.

[0124] The solution in this application embodiment constructs an augmentation set based on the effective vulnerability exploitation chain; selects vulnerability combinations from the augmentation set, merges them with the effective vulnerability exploitation chain, and obtains the initial script corresponding to the merged vulnerability from an attack script database; randomly selects vulnerability combinations from the minimum boundary of the effective vulnerability exploitation chain, and obtains the first script corresponding to the selected vulnerability combination from the attack script database; aggregates the string chains of the effective vulnerability exploitation chain, and obtains the second script corresponding to the aggregation result from the attack script database; and determines the adaptive attack script based on the initial script, the first script, and the second script. Through string chain processing, augmentation set construction, multi-source script fusion, and sub-script collaborative mapping, a script that can dynamically adjust the attack payload according to the target system environment (operating system version, application configuration, network topology) is generated, solving the problem of poor environment adaptability of traditional scripts.

[0125] This application provides a specific implementation method, including:

[0126] Step 1: Build a dynamic vulnerability signature database

[0127] Real-time vulnerability information collection: Based on an automated web crawler engine (such as the Scrapy framework), the target network space (including servers, terminal devices, network devices, and application systems in the target subnet) is traversed to collect vulnerability information in real time; collection dimensions include:

[0128] Vulnerability types (such as SQL injection, buffer overflow, weak password, misconfiguration, etc.);

[0129] Triggering conditions (such as specific user input, specific port opening, specific application version, etc.);

[0130] Scope of impact (e.g., impact on a single node, impact across subnets, impact on core business systems, etc.);

[0131] Associate the target entity (such as the server IP, application name, subnet identifier, etc. to which the vulnerability belongs).

[0132] Combined Tag Generation: Each vulnerability information is categorized into three levels and combined tags are set, specifically including:

[0133] First category: Classified by vulnerability type (such as SQL injection, buffer overflow);

[0134] The second category is based on the triggering condition and the scope of impact (e.g., user input triggering - single node impact, port open triggering - cross-subnet impact).

[0135] The third category: categorized by associated target entities (e.g., associated web server 192.168.1.100, associated database server 192.168.2.200);

[0136] Combined tag format: First category result - Second category result - Third category result (e.g., SQL injection - user input trigger - single node impact - associated web server 192.168.1.100).

[0137] Dynamic feature library construction: Vulnerability information with combined tags is stored in a graph database (such as Neo4j) to form a dynamic vulnerability feature library. The data in the library is updated in real time (the crawler engine traverses the target network every 30 minutes to update newly added vulnerabilities, fixed vulnerabilities, and changes in vulnerability attributes).

[0138] Step 2: Generate a potential exploit chain

[0139] The Reinforcement Learning-based Vulnerability Association Analysis Model (RL-VCAM) enables automated vulnerability association, specifically including:

[0140] Model Construction: Q-learning reinforcement learning algorithm is adopted, defined as follows:

[0141] State space: Combination tags of vulnerabilities in the dynamic vulnerability signature database (such as "SQL injection - ... - Web server A" "weak password - ... - Database server B");

[0142] Action space: the associated operations between vulnerabilities (e.g., "vulnerability X → vulnerability Y" means that the attack result of exploiting vulnerability X can trigger vulnerability Y);

[0143] Reward function: Using the exploit success rate (P) and attack path length (L) as parameters, the formula is: ,in, 0.7 The weighting coefficient is 0.3. Set the maximum path length (e.g., 10). The higher, The shorter the length, the higher the reward.

[0144] Model training and correlation analysis: Taking vulnerabilities in the dynamic vulnerability feature library as input, the model optimizes the correlation strategy through iterative learning (the training samples are historical vulnerability exploitation chain data, including 1000+ real attack cases). Finally, it performs automated correlation analysis on all vulnerabilities and generates potential vulnerability exploitation chains (such as "SQL injection vulnerability of Web server A → weak password vulnerability of database server B → privilege escalation vulnerability of core server C").

[0145] Step 3: Filter and utilize chain sets effectively

[0146] Simulated attack tests were conducted on potential exploit chains to screen for effective exploit chains, specifically including:

[0147] Construct a mining test matrix:

[0148] For each vulnerability in a potential exploit chain, identify the scenario in which it occurs (e.g., an SQL injection vulnerability arises from the lack of filtering of user input in the web login function), set test cases (e.g., username input 'or1=1--'), and defense test cases (e.g., inputting complex SQL statements after setting input filters).

[0149] Construct a matrix: the horizontal axis represents setting test cases and defense test cases, and the vertical axis represents vulnerability occurrence scenarios and expected results; fill in the corresponding content.

[0150] Determine saturation attribute values: Through simulation testing (building a virtual environment identical to the target environment in VMware), statistically analyze the typical working saturation attribute values ​​of the vulnerability under normal attack intensity. (e.g., 0.6 represents the value when the attack success rate tends to stabilize) and the maximum workload saturation attribute value under extreme attack intensity. (e.g., 0.9).

[0151] Filtering target test cases:

[0152] Sorting: Sort the test cases and defense test cases from highest to lowest based on their historical attack success rate;

[0153] Calculate the partition threshold:

[0154] Coefficient of difference: ;

[0155] Balance coefficient:

[0156] ;

[0157] Test case partitioning threshold: ;

[0158] in, This represents the maximum number of successful attacks on the i-th vulnerability; This represents the attack strength correction factor for the i-th vulnerability; This represents the balance coefficient of the i-th vulnerability; The weight coefficient represents the vulnerability type of the i-th vulnerability; This represents the historical number of times the i-th vulnerability has been actually exploited. This represents the predicted number of exploits for the i-th vulnerability; Indicates the quantity threshold; max indicates the maximum value sign; Represents the symbol for a logarithmic function; Indicates the rounding up symbol;

[0159] Determine the target use case: If > Total number of test cases, take all test cases; otherwise, take the top Ti test cases.

[0160] Establish correlation coefficients:

[0161] For each target test case, retest other vulnerabilities and record the response results (e.g., a test case attacking vulnerability X can trigger vulnerability Y) to form the final test case set.

[0162] Calculate the correlation coefficient Where Mj represents the number of target test cases in the final test case set for the j-th other vulnerability; This represents the correlation coefficient between the j-th other vulnerability and the i-th corresponding vulnerability; This represents the test weight of the k-th target test case in the final test case set; This represents the path weight of the attack path formed by the k-th target test case in the final test case set for the i-th corresponding vulnerability and the j-th other vulnerability; This indicates the degree of attack overlap between the k-th target test case in the final test case set and the attack path formed by the i-th corresponding vulnerability and the j-th other vulnerabilities. This represents the cross-vulnerability exploit success rate of the k-th target test case in the final test case set; The total number of target test cases for the i-th vulnerability after being divided based on the sorting results.

[0163] Significance Marking and Filtering:

[0164] Construct a vulnerability map: Construct a map based on the first vulnerability of the associated target (vulnerability directly associated with the target) to determine the penetration depth (e.g., obtaining administrator privileges is 0.8).

[0165] Labeling weight calculation: Assign an initial reference path to the first vulnerability, and determine the labeling weight by combining the number of paths and the overall penetration depth; calculate the average weight of the second vulnerability (not the first vulnerability) by (1 - the sum of the labeling weights of all first vulnerabilities) / the number of second vulnerabilities;

[0166] Screening effective chains: combining the correlation coefficients of potential exploitation chains ( The results of the labeling of data flow / control flow (with a labeling weight of ≥0.6 indicating close correlation) and the significant labeling of the data flow / control flow (with the labeling weight ≥0.5 indicating key links) are used to select the exploit chains that are closely related and whose key links are significant, forming an effective exploit chain set (EECS).

[0167] Step 4: Generate an adaptive attack script

[0168] The effective use of chain sets is coordinated to generate attack scripts with environment adaptability, specifically including:

[0169] String chaining:

[0170] Convert the vulnerability sequence of the effective exploit chain (e.g., V001→V002), attack path nodes (e.g., 192.168.1.100), and node permissions (e.g., administrator privileges P03) into a string chain (e.g., V001-I100-P03-V002).

[0171] Project to a string blank table (rows: vulnerability type, columns: node permissions), and count the frequency of occurrence of the string (preset frequency = 5, strings exceeding this are high-frequency strings) and string distribution.

[0172] Constructing the amplified set:

[0173] Locate the nearest strings of high-frequency strings and extract the static vulnerability array (such as the buffer overflow vulnerability array corresponding to the nearest string I100).

[0174] Constructing boundaries: Determine the maximum boundary (including all strings) and the minimum boundary (including high-frequency strings) based on the string distribution;

[0175] Divide the data into arrays: the static vulnerabilities with the smallest boundary are in the first array, and those between the largest and smallest boundaries are in the second array; determine the importance of vulnerabilities by using 0.6 × frequency percentage + 0.4 × distance normalization value, and form an augmented set.

[0176] Script Acquisition and Fusion:

[0177] Initial script: Filter vulnerability combinations by augmentation set type order / 2, merge with valid chains, and obtain the corresponding initial script from the attack script database (stores 1000+ scripts);

[0178] First script: Randomly select vulnerability combinations from the minimum boundary of the valid chain and retrieve the corresponding script from the database;

[0179] The second script: performs string chain aggregation analysis (K-means clustering), and retrieves the corresponding script from the database.

[0180] Generate adaptive scripts:

[0181] Subscript overlap analysis: Identify overlapping subscripts (such as data encryption subscripts) between the initial / first / second script;

[0182] Constructing a collaborative graph: Combining the historical update curves of sub-scripts (sub-scripts with ≥3 updates in the last 6 months are considered active), construct a collaborative utilization graph of sub-scripts;

[0183] Dynamic adaptation generation: Combining real-time collected target system environment parameters (operating system version, application configuration, network topology), active sub-scripts are selected from the collaborative graph to generate adaptive attack scripts (AAS), which can automatically adjust the attack payload (e.g., MSFvenom payload for Windows systems, PayloadLinux payload for Linux systems).

[0184] Step 5: Utilize chain dynamics optimization

[0185] Optimize the effective exploit chain based on attack feedback, and conduct continuous penetration testing, specifically including:

[0186] Quantitative evaluation indicators:

[0187] Impact Scope Index (IRI):

[0188] (For example, if the target weight is 0.8, the affected percentage is 0.5, and the subnet coverage / total subnets are 0.6, then the IRI is 0.8 × 0.5 + 0.6 × 0.3 = 0.58).

[0189] Hazard Level Index (HLI): HLI = Level of Privilege Escalation 0.5+ data leakage amount 0.3+ service interruption duration 0.2 (If privilege escalation is 0.8, data leakage is 0.5, and service interruption is 0.3, then HLI = 0.5 × 0.8 + 0.3 × 0.5 + 0.2 × 0.3 = 0.59).

[0190] Utilizing chain optimization strategies:

[0191] High-priority chain marking: If IRI > first threshold (e.g., 0.6) and HLI > second threshold (e.g., 0.5), it is marked as a high-priority chain and given priority for subsequent penetration testing;

[0192] Exploitation chain update: If the threshold is not met, update the vulnerability combination label (e.g., adjust the scope of associated targets in the third category) and re-execute step 2 to generate a new exploit chain;

[0193] Utilize chain deletion: If the threshold is not met for n0 consecutive times (n0=3), delete the valid utilization chain to avoid resource waste.

[0194] Continuous penetration testing: Based on the optimized effective exploit chain (including the advanced priority chain and the newly generated chain), re-execute steps 3-5 to form a test-feedback-optimization closed loop and continuously improve the penetration testing effect.

[0195] Figure 4 This is a schematic diagram of a collaborative testing device for multiple penetration vulnerabilities provided in an embodiment of this application. This device can execute the collaborative testing method for multiple penetration vulnerabilities provided in any embodiment of this application, and possesses the corresponding functional modules and beneficial effects for executing the method. Figure 4 As shown, the device includes:

[0196] The vulnerability identification module 410 is used to collect vulnerability information in real time by traversing the target network space based on an automated crawler engine, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature library; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types;

[0197] The potential vulnerability exploitation chain determination module 420 is used to detect vulnerabilities in the dynamic vulnerability feature library based on the vulnerability information and the combined label according to the vulnerability association analysis model to obtain potential vulnerability exploitation chains; wherein, the vulnerability association analysis model is a reinforcement learning-based model.

[0198] The effective vulnerability exploit chain determination module 430 is used to filter effective vulnerability exploit chains from the potential vulnerability exploit chains based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploit chain and the vulnerability saliency labeling results.

[0199] The adaptive attack script determination module 440 is used to generate an adaptive attack script based on the effective vulnerability exploit chain for attack testing.

[0200] In this embodiment of the application, the vulnerability determination module 410 determines the combined tags of the vulnerability information, including:

[0201] The vulnerability information is classified according to at least two preset classification methods to obtain classification results in at least two dimensions; wherein, the at least two preset classification methods include classification by vulnerability type, classification by triggering conditions and scope of impact, and classification by associated target entities;

[0202] Based on the classification results of at least two dimensions, determine the combined tags of the vulnerability information.

[0203] In this embodiment, the potential vulnerability exploitation chain determination module 420 detects the vulnerability based on the vulnerability information and the combined tag using a vulnerability association analysis model, and obtains the potential vulnerability exploitation chain, including:

[0204] The reinforcement learning algorithm is used to define the state space based on the combined labels, the action space based on the associated operations of the vulnerability, and the reward function based on the vulnerability exploitation success rate and the attack path length.

[0205] Based on the state space, the action space, and the reward function, model training and correlation analysis are performed to determine potential vulnerability exploitation chains.

[0206] In this embodiment of the application, the effective vulnerability exploitation chain determination module 430 filters effective vulnerability exploitation chains from the potential vulnerability exploitation chains based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, including:

[0207] For each potential vulnerability exploitation chain, the potential vulnerability exploitation chain is tested to determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain;

[0208] The salience labeling results of the vulnerabilities are determined based on the number of paths where the vulnerabilities are located and the penetration depth.

[0209] Based on the correlation coefficient and the saliency labeling results, the effective exploit chains in the potential exploit chains are determined.

[0210] In this embodiment of the application, the effective vulnerability exploitation chain determination module 430 tests the potential vulnerability exploitation chain to determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain, including:

[0211] For the vulnerabilities in the potential exploit chain, based on the scenario in which the vulnerabilities occur, the vulnerabilities in the potential exploit chain are tested according to the set test cases and defense test cases to determine the normal working saturation attribute value and the maximum working saturation attribute value of the vulnerabilities; wherein, the normal working saturation attribute value is the value when the attack success rate tends to be stable under normal attack intensity, and the maximum working saturation attribute is set to the value when the attack success rate tends to be stable under extreme attack intensity.

[0212] The set test cases and the defense test cases are sorted according to the historical attack success rate, and the threshold for the number of test cases is determined based on the normal workload saturation attribute value and the maximum workload saturation attribute value.

[0213] Based on the threshold for the number of test cases, the test case with the highest historical attack success rate is selected as the target test case.

[0214] Based on the target test cases, other vulnerabilities in the potential vulnerability exploitation chain are tested, and the correlation coefficient between the vulnerability and the other vulnerabilities is determined based on the test results of the vulnerability and the other vulnerabilities.

[0215] In this embodiment of the application, the effective vulnerability exploitation chain determination module 430 determines the test case quantity threshold based on the regular work saturation attribute value and the maximum work saturation attribute value, including:

[0216] The difference coefficient is determined based on the relative deviation between the normal working saturation attribute value and the maximum working saturation attribute value corresponding to the vulnerability;

[0217] The balance coefficient is determined based on the historical actual number of times the vulnerability has been exploited and the predicted number of times it has been exploited.

[0218] The threshold for the number of test cases is determined based on the difference coefficient, the balance coefficient, the attack intensity correction coefficient, and the maximum number of successful attacks.

[0219] In this embodiment of the application, the effective vulnerability exploitation chain determination module 430 determines the correlation coefficient between the vulnerability and the other vulnerabilities based on the test results of the vulnerability and other vulnerabilities, including:

[0220] Based on the test results obtained by testing the vulnerabilities in the potential vulnerability exploitation chain using each target test case, determine the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate.

[0221] For each target test case, the correlation coefficient is determined by the ratio of the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate, to the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities and the test weight of the target test case.

[0222] In this embodiment of the application, the effective vulnerability exploitation chain determination module 430 determines the salience labeling result of the vulnerability based on the number of paths where the vulnerability is located and the penetration depth, including:

[0223] A vulnerability map is constructed based on directly related target entities to determine the penetration depth; wherein, the related target entities are the hardware and software to which the vulnerability belongs;

[0224] The first weight of the vulnerability is determined based on the number of paths where the vulnerability is located and the penetration depth.

[0225] The second weight of other vulnerabilities is determined based on the first weight of the aforementioned vulnerability;

[0226] Based on the first weight and the second weight, the saliency labeling results of the vulnerability and the other vulnerabilities are determined.

[0227] In this embodiment of the application, the adaptive attack script determination module 440 generates an adaptive attack script based on the effective vulnerability exploitation chain, including:

[0228] Construct an augmentation set based on the aforementioned effective vulnerability exploit chain;

[0229] Select vulnerability combinations from the augmented set, merge them with the effective vulnerability exploit chain, and obtain the initial script corresponding to the merged vulnerability from the attack script database;

[0230] Randomly select a combination of vulnerabilities from the minimum boundary of the effective vulnerability exploitation chain, and obtain the first script corresponding to the selected vulnerability combination from the attack script database;

[0231] Aggregate the string chains of the effective vulnerability exploit chains, and obtain the second script corresponding to the aggregation result from the attack script database;

[0232] The adaptive attack script is determined based on the initial script, the first script, and the second script.

[0233] In this embodiment of the application, the device further includes an optimization module, used for:

[0234] Penetration testing was conducted based on adaptive attack scripts to determine the scope of impact index and the severity level index.

[0235] The priority level of the effective vulnerability exploit chain is determined based on the impact scope index and the hazard level index. The chain is then optimized based on the priority level and the effective vulnerability exploit chain. Subsequent penetration tests are then conducted based on the optimized effective vulnerability exploit chain.

[0236] The collaborative testing device for multiple penetration vulnerabilities provided in this application can execute the collaborative testing method for multiple penetration vulnerabilities provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of the execution method.

[0237] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement embodiments of this application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital processors, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of this application as described herein and / or the first preset requirements.

[0238] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0239] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0240] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as collaborative testing methods for multiple penetration vulnerabilities.

[0241] In some embodiments, the collaborative testing method for multiple vulnerabilities can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the collaborative testing method for multiple vulnerabilities described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the collaborative testing method for multiple vulnerabilities by any other suitable means (e.g., by means of firmware).

[0242] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0243] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable multi-penetration vulnerability testing apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may execute entirely on the machine, partially on the machine, as a standalone software package partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0244] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0245] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0246] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0247] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0248] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements a collaborative testing method for multiple penetration vulnerabilities as provided in any embodiment of this application.

[0249] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0250] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired information of the technical solution of this application can be achieved, and this is not limited herein.

[0251] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made based on the first design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A collaborative testing method for multiple penetration vulnerabilities, characterized in that, The method includes: The system uses an automated web crawler engine to traverse the target network space in real time to collect vulnerability information and determine the combined tags of the vulnerability information. The vulnerability information and the combined tags are then stored in a dynamic vulnerability feature database. The combined tags include classification tags obtained by classifying the vulnerability information according to different types. For vulnerabilities in the dynamic vulnerability feature library, the vulnerability is detected based on the vulnerability information and the combined label using a vulnerability association analysis model to obtain potential vulnerability exploitation chains; wherein, the vulnerability association analysis model is a reinforcement learning-based model. Based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain and the vulnerability saliency labeling results, effective vulnerability exploitation chains are selected from the potential vulnerability exploitation chains. An adaptive attack script is generated based on the effective vulnerability exploit chain for attack testing.

2. The method according to claim 1, characterized in that, Determine the combined tags of the vulnerability information, including: The vulnerability information is classified according to at least two preset classification methods to obtain classification results in at least two dimensions; wherein, the at least two preset classification methods include classification by vulnerability type, classification by triggering conditions and scope of impact, and classification by associated target entities; Based on the classification results of at least two dimensions, determine the combined tags of the vulnerability information.

3. The method according to claim 1, characterized in that, Based on the vulnerability association analysis model, the vulnerability is detected according to the vulnerability information and the combined tag, and the potential vulnerability exploitation chain is obtained, including: The reinforcement learning algorithm is used to define the state space based on the combined labels, the action space based on the associated operations of the vulnerability, and the reward function based on the vulnerability exploitation success rate and the attack path length. Based on the state space, the action space, and the reward function, model training and correlation analysis are performed to determine potential vulnerability exploitation chains.

4. The method according to claim 1, characterized in that, Based on the correlation coefficient between two vulnerabilities in the potential exploit chain and the vulnerability saliency labeling results, valid exploit chains are selected from the potential exploit chains, including: For each potential vulnerability exploitation chain, the potential vulnerability exploitation chain is tested to determine the correlation coefficient between two vulnerabilities in the potential vulnerability exploitation chain; The salience labeling results of the vulnerabilities are determined based on the number of paths where the vulnerabilities are located and the penetration depth. Based on the correlation coefficient and the saliency labeling results, the effective exploit chains in the potential exploit chains are determined.

5. The method according to claim 4, characterized in that, The potential exploit chain is tested to determine the correlation coefficient between two vulnerabilities in the potential exploit chain, including: For the vulnerabilities in the potential exploit chain, based on the scenario in which the vulnerabilities occur, the vulnerabilities in the potential exploit chain are tested according to the set test cases and defense test cases to determine the normal working saturation attribute value and the maximum working saturation attribute value of the vulnerabilities; wherein, the normal working saturation attribute value is the value when the attack success rate tends to be stable under normal attack intensity, and the maximum working saturation attribute is set to the value when the attack success rate tends to be stable under extreme attack intensity. The set test cases and the defense test cases are sorted according to the historical attack success rate, and the threshold for the number of test cases is determined based on the normal workload saturation attribute value and the maximum workload saturation attribute value. Based on the threshold for the number of test cases, the test case with the highest historical attack success rate is selected as the target test case. Based on the target test cases, other vulnerabilities in the potential vulnerability exploitation chain are tested, and the correlation coefficient between the vulnerability and the other vulnerabilities is determined based on the test results of the vulnerability and the other vulnerabilities.

6. The method according to claim 5, characterized in that, The threshold for the number of test cases is determined based on the normal workload saturation attribute value and the maximum workload saturation attribute value, including: The difference coefficient is determined based on the relative deviation between the normal working saturation attribute value and the maximum working saturation attribute value corresponding to the vulnerability. The balance coefficient is determined based on the historical actual number of times the vulnerability has been exploited and the predicted number of times it has been exploited. The threshold for the number of test cases is determined based on the difference coefficient, the balance coefficient, the attack intensity correction coefficient, and the maximum number of successful attacks.

7. The method according to claim 5, characterized in that, The correlation coefficient between the vulnerability and other vulnerabilities is determined based on the test results of the vulnerability and other vulnerabilities, including: Based on the test results obtained by testing the vulnerabilities in the potential vulnerability exploitation chain using each target test case, determine the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate. For each target test case, the correlation coefficient is determined by the ratio of the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities, the degree of overlap of common attacks, the test weight of the target test case, and the cross-vulnerability exploitation success rate, to the sum of the product of the path weight of the attack path formed by the vulnerability and other vulnerabilities and the test weight of the target test case.

8. The method according to claim 4, characterized in that, Based on the number of paths where the vulnerability is located and the penetration depth, the salience labeling results of the vulnerability are determined, including: Vulnerability maps are constructed based on directly related target entities to determine penetration depth; wherein, the related target entities are the hardware and software to which the vulnerability belongs; The first weight of the vulnerability is determined based on the number of paths where the vulnerability is located and the penetration depth. The second weight of other vulnerabilities is determined based on the first weight of the aforementioned vulnerability; Based on the first weight and the second weight, the saliency labeling results of the vulnerability and the other vulnerabilities are determined.

9. The method according to claim 1, characterized in that, Generate an adaptive attack script based on the effective vulnerability exploit chain, including: Construct an augmentation set based on the aforementioned effective vulnerability exploit chain; Select vulnerability combinations from the augmented set, merge them with the effective vulnerability exploit chain, and obtain the initial script corresponding to the merged vulnerability from the attack script database; Randomly select a combination of vulnerabilities from the minimum boundary of the effective vulnerability exploitation chain, and obtain the first script corresponding to the selected vulnerability combination from the attack script database; Aggregate the string chains of the effective vulnerability exploit chains, and obtain the second script corresponding to the aggregation result from the attack script database; The adaptive attack script is determined based on the initial script, the first script, and the second script.

10. The method according to claim 1, characterized in that, The method further includes: Penetration testing was conducted based on adaptive attack scripts to determine the scope of impact index and the severity level index. The priority level of the effective vulnerability exploit chain is determined based on the impact scope index and the hazard level index. The chain is then optimized based on the priority level and the effective vulnerability exploit chain. Subsequent penetration tests are then conducted based on the optimized effective vulnerability exploit chain.

11. A collaborative testing device for multiple penetration vulnerabilities, characterized in that, The collaborative testing device for multiple penetration vulnerabilities includes: The vulnerability identification module is used to collect vulnerability information in real time by traversing the target network space based on an automated crawler engine, determine the combined tags of the vulnerability information, and store the vulnerability information and combined tags in a dynamic vulnerability feature database; wherein, the combined tags include classification tags obtained by classifying the vulnerability information according to different types; The potential vulnerability exploitation chain determination module is used to detect vulnerabilities in the dynamic vulnerability feature library based on the vulnerability information and the combined label according to the vulnerability association analysis model, and obtain potential vulnerability exploitation chains; wherein, the vulnerability association analysis model is a reinforcement learning-based model; The effective vulnerability exploit chain determination module is used to filter effective vulnerability exploit chains from the potential vulnerability exploit chains based on the correlation coefficient between two vulnerabilities in the potential vulnerability exploit chain and the vulnerability saliency labeling results. An adaptive attack script determination module is used to generate an adaptive attack script based on the effective vulnerability exploit chain for attack testing.

12. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the collaborative testing method for multiple penetration vulnerabilities according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the collaborative testing method for multiple penetration vulnerabilities as described in any one of claims 1-10.

Images