A network security range training path generation method and an electronic device

Abstract

The application provides a network security target range training path generation method and an electronic device, and belongs to the technical field of network security training. The method comprises the following steps: acquiring a training state, a training path context and a training target of a user at a current time; based on the above information, determining a weak ability node set of the user, a stage node set not yet covered in the training target and a pre-skills node set in a pre-constructed attack chain knowledge graph, and generating a candidate question set based on each node set; using a reinforcement learning model, selecting a question title that meets a stage connection relationship and a pre-dependence relationship in the candidate question set according to the training state and the training path context of the user, and composing an ordered training path based on the question title. The application can dynamically generate a personalized training path according to real-time user feedback, and improve the matching degree of the training path and the user's ability state and the continuity of the training path.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity training technology, and more specifically, to a method for generating training paths for cybersecurity test ranges and an electronic device. Background Technology

[0002] Cybersecurity test ranges utilize technologies such as virtualization and containerization to create controllable training environments, providing users with security training tasks.

[0003] The training tasks in the existing test range are mostly organized in the form of single-point questions, and there is a lack of attack and defense links between the questions. Even after completing a number of single questions, users still find it difficult to form a complete attack chain mindset.

[0004] Furthermore, existing training path generation methods largely rely on coaches manually arranging fixed training paths. Different job targets have different requirements for attack phases and capability coverage, making it difficult to adapt a unified fixed path to a large number of users. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a method for generating training paths in a cybersecurity range and an electronic device, so as to dynamically generate personalized training paths based on the user's training status and real-time feedback, thereby achieving continuity and adaptability of the training paths.

[0006] Firstly, a method for generating training paths for a cybersecurity test range is provided, including: Obtain the user's current training status, training path context, and training objective; the training status at least represents the user's level of mastery in cybersecurity training; Based on the user's training status, training path context, and training objective, the set of the user's weak capability nodes, the set of stage nodes not yet covered in the training objective, and the set of prerequisite skill nodes are determined in the pre-constructed attack chain knowledge graph. A set of candidate questions is then generated based on each set of nodes. The attack chain knowledge graph at least represents the relationship between question nodes and attack stage nodes, capability nodes, and prerequisite skill nodes. The relationship includes the prerequisite dependency relationship between question nodes and prerequisite skill nodes, and the stage connection relationship between attack stage nodes. Using a reinforcement learning model, target questions that satisfy stage connection and prerequisite dependency are selected from the candidate question set based on the user's training status and training path context, and an ordered training path is formed based on the target questions.

[0007] Optionally, the process of constructing the attack chain knowledge graph includes: Obtain the training questions and metadata of each question from the cybersecurity test range; Based on the training questions and the metadata of each question, the types of nodes are determined. The nodes include attack phase nodes, question nodes, vulnerability type nodes, tool command nodes, prerequisite skill nodes, protection and detection nodes, and capability dimension nodes. Establish relationships between nodes, including capability coverage relationships between question nodes and capability dimension nodes, stage subordination relationships between question nodes and attack stage nodes, precondition, successor, and substitution relationships between question nodes, and protection correspondence relationships between question nodes and protection detection nodes.

[0008] Optionally, obtaining the user's current training state includes: The system obtains the user's completion status, prompt usage, error type, and training time on training questions for each ability dimension. After normalizing the completion status, prompt usage, error type, and training time, the system performs a weighted fusion to obtain the ability mastery level for each ability dimension.

[0009] Optionally, based on the user's training state, training path context, and training objective, the set of the user's vulnerable capability nodes can be determined in a pre-built attack chain knowledge graph, including: Determine the covered capability dimensions based on the training path context; In the covered capability dimensions, the capability mastery level corresponding to each covered capability dimension is compared with the preset capability mastery level threshold; If the level is less than the preset capability mastery threshold, then query the attack chain knowledge graph for nodes associated with that capability dimension and add them to the weak capability dimension node set.

[0010] Optionally, based on the user's training state, training path context, and training objective, the set of stage nodes not yet covered in the training objective can be determined in the pre-built attack chain knowledge graph, including: Obtain the set of target attack phases for the training objective and the set of covered attack phases for the user in the training context path; The set of uncovered stage nodes is determined by the difference between the target attack stage set and the covered attack stage set.

[0011] Optionally, based on the user's training state, training path context, and training objective, the set of the user's prerequisite skill nodes is determined in the pre-built attack chain knowledge graph, including: Based on the training path context and training objectives, determine the training topics to be advanced; Search the attack chain knowledge graph for the prerequisite skill nodes corresponding to the training questions to be advanced; Based on the user's training status, the prerequisite skill nodes that the user has mastered are determined; among them, prerequisite skill nodes whose skill mastery exceeds a preset skill mastery threshold are determined as prerequisite skill nodes that have been mastered. Add the nodes whose ability mastery level is less than the preset ability mastery level threshold from the prerequisite skill nodes corresponding to the training questions to be advanced to the prerequisite skill node set.

[0012] Optionally, generating a candidate question set based on each node set includes: Based on the nodes in the set of weak capability nodes, the set of uncovered stage nodes, and the set of prerequisite skill nodes, query the associated training questions in the attack chain knowledge graph. The associated training questions in the query are merged and deduplicated to obtain an initial candidate set; The questions in the initial candidate set are filtered based on preset filtering conditions to obtain a candidate question set.

[0013] Optionally, using a reinforcement learning model, target questions that satisfy stage connection relationships and prerequisite dependencies are selected from the candidate question set based on the user's training state and training path context. These include: The user's training state and training path context are used as the state space, and the candidate question set is used as the action space. The input is the reinforcement learning model, and the output is the selection value or selection probability of each candidate question in the candidate question set. Based on the selection value or selection probability and the preset reward function, the comprehensive evaluation value of each candidate topic is determined, and the target candidate topic is determined from the candidate topic set based on the comprehensive evaluation value. The target candidate topics determined in turn are arranged into the initial training topic sequence according to the decision order. The initial training question sequence is verified and corrected based on preset path constraints to obtain the target questions.

[0014] Optionally, the method also includes: Obtain feedback information from users when performing secure training based on an ordered training path; Based on the feedback information, update the user's training status, the edge weights in the attack chain knowledge graph, and the parameters of the reinforcement learning model.

[0015] In a second aspect, an electronic device is provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, when executing a program stored in memory, implements any of the methods of the first aspect.

[0016] The present invention provides a method and electronic device for generating training paths in a cybersecurity test range. By constructing an attack chain knowledge graph, it organizes individual questions in a cybersecurity test range into a training resource system with interconnected relationships. This ensures that the generated questions are no longer isolated sets of questions, but rather form an ordered training path according to the attack and defense chain. Simultaneously, it dynamically generates subsequent training paths based on the user's training status, improving the matching degree between the training path and the user's capability status.

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 The flowchart illustrates a method for generating training paths in a cybersecurity test range provided by an embodiment of the present invention. Figure 2 A flowchart of another method for generating training paths for a cybersecurity target range provided by an embodiment of the present invention is shown; Figure 3 The flowchart illustrates another method for generating training paths in a cybersecurity test range provided by an embodiment of the present invention. Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present invention is shown. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0021] like Figure 1As shown, this embodiment provides a method for generating training paths in a cybersecurity test range. This method can be executed by a server on the cybersecurity test range platform side, a training path generation device, or a cybersecurity training service device. It is used to dynamically generate an ordered training path based on the user's current training state and training objectives, under the constraints of an attack chain knowledge graph. Specifically, it includes the following steps: Step S101: Obtain the user's current training state, training path context, and training objective.

[0022] Among these, training status at least characterizes the user's level of mastery of cybersecurity training capabilities. Capability mastery describes the user's level of mastery across different capability dimensions, which may include web vulnerability exploitation, code auditing, traffic analysis, log analysis, internal network penetration, cloud security, and incident response, among others.

[0023] The training status is not limited to the level of skill mastery, but may also include attack chain stage progress, historical feedback information, and training load status, etc. This embodiment does not impose any restrictions on this.

[0024] The attack chain stages, in sequence, include information gathering, vulnerability discovery, vulnerability exploitation, privilege maintenance, and protection detection.

[0025] The training path context represents the attack phases and capability dimensions that the user has covered in the current training path. For example, if the user has completed some questions in the information gathering phase and vulnerability discovery phase, the training path context records the information of the covered phases and capability dimensions.

[0026] The training objective represents the target template selected by the user for the job, such as the target template for web penetration, intranet penetration, incident response, cloud security, or industrial control security.

[0027] Different job target templates correspond to different sets of target attack stages and target capability dimensions. For example, Web penetration training objectives may require coverage of information gathering, vulnerability discovery, vulnerability exploitation, privilege maintenance, and protection detection stages, while emergency response training objectives may require coverage of log analysis, traffic detection, alarm analysis, source tracing analysis, and emergency response stages.

[0028] Step S102: Based on the user's training status, training path context and training objective, determine the user's weak capability node set, the stage node set not yet covered in the training objective and the prerequisite skill node set in the pre-constructed attack chain knowledge graph, and generate a candidate question set based on each node set.

[0029] An attack chain knowledge graph is a pre-constructed graph structure data that at least represents the relationships between question nodes and attack stage nodes, ability nodes, and prerequisite skill nodes.

[0030] The relationships include the prerequisite dependencies between the question node and the prerequisite skill node, as well as the phase connections between the attack phase nodes.

[0031] Pre-dependencies indicate that to complete a certain problem, you need to master another problem or skill first. For example, to complete the comprehensive SQL injection problem, you need to master request parameter analysis and database basics first.

[0032] The phase connection relationship indicates the sequence between different phases in the attack chain. For example, the information gathering phase connects to the vulnerability discovery phase, the vulnerability discovery phase connects to the vulnerability exploitation phase, and the vulnerability exploitation phase connects to the privilege maintenance phase.

[0033] The node and edge relationships in the attack chain knowledge graph make training questions no longer isolated single-point resources, but structured training resources with queryable and constrained attributes such as stage affiliation, prerequisite dependencies, and capability coverage.

[0034] It should be noted that the training questions in this embodiment are training resource nodes in the attack chain knowledge graph, which are the basic building blocks of the training path.

[0035] The candidate question set is the set of training questions. The reinforcement learning model then selects from this set, providing a constrained decision space for the sequential decision in step S103.

[0036] Step S103: Using a reinforcement learning model, select target questions that satisfy the stage connection relationship and the prerequisite dependency relationship from the candidate question set according to the user's training state and training path context, and form an ordered training path based on the target questions.

[0037] Reinforcement learning models model training path generation as a sequential decision-making process.

[0038] Since the candidate question set itself is generated under the constraints of the attack chain knowledge graph, the decision object of the reinforcement learning model is the candidate question rather than any question. Therefore, the target question output by the model can satisfy the stage connection relationship and the prerequisite dependency relationship.

[0039] As the decision-making process progresses, the system successively determines the target questions and arranges them according to the decision-making order to form an orderly training path.

[0040] This ordered training path is not a simple list of problems, but a sequence of training tasks organized according to the attack chain phase progression and satisfying prerequisite dependencies.

[0041] This embodiment, through steps S101 to S103, enables the training path to proceed in an orderly manner along the real attack and defense stages such as information collection, vulnerability discovery, vulnerability exploitation, privilege maintenance, and protection detection; at the same time, it dynamically selects subsequent training tasks based on the user's training status, thereby improving the matching degree between the training path and the user's ability status.

[0042] Based on the above embodiments, this embodiment further illustrates the construction process of the attack chain knowledge graph.

[0043] The attack chain knowledge graph is the pre-built graph structure data upon which step S102 relies. Its construction can be completed offline before training path generation, or it can be continuously updated during system operation based on newly added questions and training feedback. Specifically: Step A: Obtain the training questions and metadata of each question from the cybersecurity test range.

[0044] Training questions are the smallest unit of training resources available for users to execute in a cybersecurity test range. They can be a single vulnerability exploitation question, a traffic analysis task, a scenario-based penetration test, or a set of composite tasks with an internal sequential relationship.

[0045] Metadata is used to describe the attributes of training questions at the attack chain, capability dimensions, and training management levels. Metadata includes question type, vulnerability type, attack stage, difficulty, required tools, prerequisite skills, capability dimensions, environment type, estimated time, and protection checkpoints.

[0046] The question types can include multiple choice questions, operation questions, scenario questions, debriefing questions, and comprehensive adversarial questions; the vulnerability type indicates the specific vulnerability category involved in the question, such as SQL injection, cross-site scripting, file upload, deserialization, privilege escalation, or lateral movement. The attack phase refers to the stage in the attack chain to which the problem belongs, such as information gathering, vulnerability discovery, vulnerability exploitation, privilege escalation, lateral movement, persistence, protection detection, or emergency response. Difficulty level indicates the relative ease or difficulty of a question, and can be represented by discrete levels or continuous scores. The required tools refer to the tools or commands needed to complete the task, such as directory scanning tools, packet capture tools, database connection tools, or specific command-line tools; Prerequisite skills refer to the knowledge or skills that must be mastered before completing the questions. The capability dimension represents the capability items trained by the questions, such as web vulnerability exploitation, code auditing, traffic analysis, log analysis, intranet penetration, cloud security, or incident response; The environment type indicates the type of target environment required for the test to run, such as a web environment, intranet environment, cloud environment, or industrial control environment; Estimated time indicates the time required to complete the question under normal training conditions. Protection detection points refer to the detection, alarm, or handling tasks corresponding to this topic, such as log detection points, traffic alarm points, or source analysis points.

[0047] Metadata can be obtained through structured forms when questions are entered into the question catalog, or it can be automatically extracted from the question description text, or it can be annotated by coaches or platform administrators before the questions go online.

[0048] Step B involves determining the node type based on the training questions and metadata. Nodes include attack phase nodes, question nodes, vulnerability type nodes, tool command nodes, prerequisite skill nodes, protection and detection nodes, and capability dimension nodes.

[0049] Attack phase nodes represent the phase divisions in an attack chain, used to organize the training order and determine phase coverage. Attack phase nodes can be set according to a general attack chain model, or they can be trimmed and expanded according to different training objectives.

[0050] For example, in a red team training scenario, the attack phase nodes may include reconnaissance, vulnerability exploitation, privilege escalation, lateral movement, and persistence; in a blue team training scenario, the attack phase nodes may include log analysis, traffic detection, alarm analysis, source tracing analysis, and emergency response; and in a web penetration training scenario, the attack phase nodes may include information gathering, vulnerability discovery, vulnerability exploitation, privilege maintenance, and protection detection.

[0051] A question node represents a specific training question or scenario task and is a basic component of the training path.

[0052] The vulnerability type node indicates the vulnerability category involved in the question. It is used to group questions with the same or similar vulnerability types, making it easier to control the diversity of vulnerability types in the training path.

[0053] The tool command node represents the tools or commands required to complete the task. It is used to determine whether the user has the corresponding tool usage ability and to insert tool training tasks when necessary.

[0054] Prerequisite skill nodes represent the knowledge or skills that must be mastered before completing a question, and are used to express the prerequisite dependencies between questions.

[0055] The protection detection node represents the detection, alarm, and handling tasks corresponding to the attack behavior. It is used to link attack training with protection training so that the training path can reflect the attack and defense closed loop.

[0056] The capability dimension node represents the capability items trained by the questions, and is used to characterize the user's training status and the scope of question coverage from the capability dimension.

[0057] Among the various types of nodes mentioned above, the question node is the direct component of the training path, while the other nodes are used to describe the attributes, constraints, and relationships of the question node.

[0058] Step C: Establish the relationships between nodes. These relationships include the capability coverage relationship between question nodes and capability dimension nodes, the stage dependency relationship between question nodes and attack stage nodes, the preceding, succeeding, and substitution relationships between question nodes, and the protection correspondence relationship between question nodes and protection detection nodes.

[0059] Capability coverage relationships indicate which capability dimensions a problem can train. For example, a comprehensive SQL injection problem can be connected to the Web vulnerability exploitation capability dimension node and the database security capability dimension node through capability coverage relationships.

[0060] Phase dependency indicates which phase of the attack chain a problem belongs to. For example, the same comprehensive SQL injection problem can be linked to the exploitation phase node through phase dependency.

[0061] Prerequisite relationships indicate that mastering another problem or skill is required to complete a certain problem. For example, a comprehensive SQL injection problem can be connected to the request parameter analysis node, the database base node, and the basic injection judgment node through prerequisite relationships.

[0062] The successor relation is the reverse of the predecessor relation, indicating the next problem or skill that can be advanced to after completing a certain problem.

[0063] Substitution relationships indicate that two questions are interchangeable in terms of training objectives, ability coverage, and stage affiliation. When a question is filtered out due to unavailability of the environment, mismatch in difficulty, or recent repeated completion, a substitute question can be found through substitution relationships.

[0064] The protection mapping relationship represents the association between an attack-related question and its corresponding protection detection task. For example, a comprehensive SQL injection question can be connected to a log detection node through the protection mapping relationship, indicating that after completing the SQL injection attack training, the user can further train how to detect this type of attack behavior through log detection.

[0065] By establishing the aforementioned nodes and relationships, the attack chain knowledge graph can transform training topics from isolated resources into structured training resources with attributes such as stage affiliation, prerequisite dependencies, capability coverage, and corresponding protection.

[0066] For any given question node, its set of preceding nodes, set of succeeding nodes, set of capabilities covered, and stage affiliation can be obtained through graph query.

[0067] The set of preceding nodes is used to determine whether the prerequisite skills for the question have been met. The set of succeeding nodes is used to determine the candidate questions that can be advanced after the current question is completed. The set of ability coverage is used to determine the question's role in strengthening the user's weak abilities. The stage affiliation is used to determine whether the question belongs to a stage that has not yet been covered in the training objectives.

[0068] The query results can be directly used in the generation of the candidate question set in step S102, or in the path constraint verification in step S103.

[0069] For example, when it is necessary to determine whether a candidate question satisfies the prerequisite dependency relationship, the prerequisite node set of the question can be queried in the graph, and the ability mastery corresponding to each prerequisite node can be judged one by one to see if it exceeds the preset threshold; when it is necessary to determine whether the current training path covers the attack stage required by the training target, the stage affiliation of each question node in the path can be queried and compared with the target attack stage set.

[0070] To illustrate the structure of the attack chain knowledge graph more clearly, we will use a comprehensive SQL injection problem as an example below.

[0071] This question node is connected to the request parameter analysis node, the database basic node, and the basic injection judgment node through a prerequisite relationship, indicating that users need to master request parameter analysis methods, basic database concepts, and basic injection judgment capabilities before they can complete this comprehensive question.

[0072] This question node is connected to the vulnerability exploitation stage node through a stage hierarchy relationship, indicating that this question belongs to the vulnerability exploitation stage in the attack chain. This question node is connected to the Web vulnerability exploitation capability dimension node and the database security capability dimension node through a capability coverage relationship, indicating that this question can train the user's capabilities in the above two capability dimensions.

[0073] The question node is connected to the log detection node through the protection mapping relationship, indicating that the protection detection task corresponding to this question is log detection.

[0074] In addition, this question node can also be connected to the WebShell privilege maintenance question node through successor relationships, indicating that after completing the comprehensive SQL injection question, the user can advance to the privilege maintenance phase of training.

[0075] Through the aforementioned node and edge relationships, the SQL injection comprehensive question is no longer an isolated question in the attack chain knowledge graph. Instead, it has established a clear connection with prerequisite skills, attack stages, capability dimensions, and protection detection tasks. Based on this, we can determine the question's position in the training path, whether the prerequisite conditions are met, its contribution to stage coverage and capability enhancement, and the subsequent training tasks that can be connected.

[0076] The training status obtained in step S101 at least represents the user's level of competence in cybersecurity training. This embodiment elaborates on the specific calculation method of competence and how to determine the set of weak competence nodes based on competence.

[0077] Step S101A: Obtain the user's completion status, prompt usage, error type, and training time on training questions for each ability dimension. After normalizing the completion status, prompt usage, error type, and training time, perform weighted fusion to obtain the ability mastery level for each ability dimension.

[0078] For example, the formula for calculating the level of skill mastery is as follows: Mastery can be calculated in the following way:

[0079] in, Indicates the user's capabilities The completion status of independently completing training tasks. Indicates the error type; This indicates the usage status; Indicates the training time; , , , For example, weighting coefficients , , , ;clip means to restrict the result to between 0 and 1.

[0080] The completion status indicates the user's final completion result for a training question, which can include statuses such as completed independently, completed after using prompts, partially completed, and not completed.

[0081] The usage of prompts indicates the number and frequency with which users view prompts or call upon auxiliary information during the training process.

[0082] Error type indicates the specific category of errors encountered by the user during the training process, such as command execution error, tool selection error, parameter configuration error, vulnerability identification error, or misunderstanding of the attack phase.

[0083] Training time represents the actual time a user spends completing a training question.

[0084] The above four types of data all come from the actual training process records of users in the cybersecurity test range, rather than simply the results of answering questions correctly or incorrectly.

[0085] Normalization can be achieved using truncation normalization. For numerical fields such as submission count, prompt usage count, and training time, values ​​exceeding a preset upper limit can be truncated to that limit before being divided by the preset upper limit, ensuring that the normalized value falls between 0 and 1.

[0086] For example, if the maximum number of times a hint can be used for a training question under a certain ability dimension is set to 5, and the user actually uses the hint 7 times, then it will be truncated to 5 times, and the normalized result will be 1.

[0087] For categorical fields such as completion status and error type, they can be first mapped to discrete numerical values ​​and then normalized. For example, independent completion can be mapped to 1, completion after using a prompt can be mapped to 0.6, partial completion can be mapped to 0.3, and incomplete can be mapped to 0. Error types can be mapped to different penalty values ​​based on the severity of the error; for example, tool selection errors are mapped to 0.3, vulnerability assessment errors are mapped to 0.6, and attack phase comprehension errors are mapped to 0.8.

[0088] The weighting coefficients for weighted fusion can be determined based on the training scenario. Different training scenarios may have different emphases on completion status, prompt usage, error type, and training time. For example, in basic skill training scenarios, the weight of completion status can be set higher because basic skill training focuses more on whether the user can complete the operation independently; in comprehensive attack and defense training scenarios, the weights of error type and training time can be appropriately increased because comprehensive attack and defense training focuses more on the user's judgment accuracy and response efficiency in complex scenarios.

[0089] The weighting coefficients can be configured by the platform administrator according to the training objectives, or they can be automatically determined through statistical analysis of historical training data.

[0090] For example, when a user completes training exercises for a certain ability dimension independently without using hints, the normalized value corresponding to the completion status is higher, while the normalized value corresponding to the use of hints is lower. After weighted fusion, the ability mastery level for that ability dimension increases. When a user fails training or frequently uses hints, the normalized value corresponding to the completion status is lower, the normalized value corresponding to the use of hints is higher, and the penalty value corresponding to the error type is also higher. After weighted fusion, the ability mastery level for that ability dimension decreases.

[0091] Therefore, the level of skill mastery can comprehensively reflect a user's training performance across multiple dimensions, such as completion status, reliance on prompts, error types, and time spent, rather than judging solely based on whether a single answer is correct or incorrect.

[0092] Based on the user's level of skill mastery, and considering the user's training status, training path context, and training objectives, the set of the user's weak capability nodes is determined in a pre-constructed attack chain knowledge graph, including: Step S102A: Determine the covered capability dimensions based on the training path context.

[0093] The training path context, as described in the above embodiments, is used to characterize the attack phases and capability dimensions that the user has covered in the current training path.

[0094] Based on the training path context, determine which capability dimensions are covered capability dimensions, and then assess the level of capability mastery for each of these covered capability dimensions.

[0095] Step S102B: In the covered capability dimensions, compare the capability mastery level corresponding to each covered capability dimension with the preset capability mastery level threshold.

[0096] The preset skill mastery threshold is used to distinguish whether a user's mastery of a certain skill dimension meets the training requirements. The preset skill mastery threshold can be set according to the training objective or the type of skill dimension. For example, for core skill dimensions that are explicitly required to be mastered in the training objective, the preset skill mastery threshold can be set higher, such as 0.8; for auxiliary skill dimensions that are only required to be understood or initially mastered in the training objective, the preset skill mastery threshold can be set lower, such as 0.5.

[0097] For example, for practical skills such as web vulnerability exploitation and intranet penetration, the preset skill mastery threshold can be set higher; for auxiliary skills such as tool use and basic concepts, the preset skill mastery threshold can be set lower.

[0098] The preset skill mastery threshold can be configured by the platform administrator based on the training target template, or it can be dynamically adjusted based on the average skill mastery level of the user group in this skill dimension in historical training data.

[0099] In step S102C, if the level is less than the preset capability mastery threshold, then query the attack chain knowledge graph for nodes associated with that capability dimension and add them to the weak capability dimension node set.

[0100] When the mastery of a certain covered capability dimension is less than the preset capability mastery threshold, it indicates that the user has a capability gap in that capability dimension. In this case, the node associated with that capability dimension is queried in the attack chain knowledge graph.

[0101] In the attack chain knowledge graph, capability dimension nodes are connected to question nodes through capability coverage relationships. Therefore, querying a node associated with a capability dimension can yield question nodes that can be used to train that capability dimension. These nodes are then added to the set of weak capability dimension nodes.

[0102] The nodes in the weak capability dimension node set will serve as one of the query entry points for generating the candidate question set in step S102, so that the candidate question set can include reinforcement questions for the user's weak capability dimension.

[0103] The assessment of weaknesses is based on a comparison between the level of ability mastery and a preset threshold, making the assessment of weaknesses more accurate and avoiding the judgment of ability gaps based solely on the accuracy rate of answering questions.

[0104] The above embodiments have already described the process of determining the set of weak capability nodes. This embodiment will continue to explain the process of generating the set of stage nodes, the set of prerequisite skill nodes, and the set of candidate questions that have not yet been covered.

[0105] Step S102D: Obtain the target attack phase set of the training target and the set of covered attack phases of the user in the training context path.

[0106] The target attack phase set is obtained by parsing the training objective. As explained in Example 1, the training objective represents the user-selected job target template; different job target templates correspond to different target attack phase sets. For example, if the Web penetration training objective requires coverage of the information gathering, vulnerability discovery, vulnerability exploitation, privilege escalation, and protection detection phases, then the target attack phase set would be the aforementioned five phases.

[0107] The training path context records the attack phases that the user has completed or has encountered in the current training path.

[0108] Step S102E: Based on the difference between the target attack phase set and the covered attack phase set, determine the set of phase nodes that have not yet been covered.

[0109] By performing a difference operation between the target attack phase set and the already covered attack phase set, we obtain the attack phases that the training target requires to be covered but which the user has not yet covered.

[0110] For example, if a user has already covered the information gathering and vulnerability discovery phases, the set of phase nodes that have not yet been covered are the vulnerability exploitation, privilege maintenance, and protection detection phase nodes.

[0111] It should be noted that the determination of whether the attack phase has been covered can be based on whether the user has completed at least one training question in that phase, or on whether the user's progress in that phase has reached a preset progress threshold. This embodiment does not impose any restrictions on this.

[0112] The nodes in the set of stages that have not yet been covered will serve as one of the entry points for subsequent queries of related training questions, so that the candidate question set can include questions used to fill the gaps in the training target stages.

[0113] Furthermore, the process of determining the set of prerequisite skill nodes needs to be explained.

[0114] Step S102F: Based on the training path context and training objective, determine the training topics to be advanced.

[0115] Among them, training problems to be advanced refer to the problems that the user should advance to or will face next, based on the current training path context and training objectives. Training problems to be advanced can be determined in a variety of ways.

[0116] For example, based on the user's current attack stage and completed questions recorded in the training path context, the successor questions of the current question can be queried along the successor relationship in the attack chain knowledge graph, and the questions that belong to the stage required to be covered by the training objective can be identified as training questions to be promoted.

[0117] For example, based on the set of uncovered stage nodes, the stage with the earliest stage connection relationship can be selected from the uncovered stages, and the introductory questions under that stage can be identified as training questions to be promoted.

[0118] For example, based on the phase progression sequence specified in the training objectives, basic questions in the next target phase of the currently covered phase can be identified as training questions to be advanced.

[0119] Step S102G: Query the prerequisite skill nodes corresponding to the training questions to be advanced in the attack chain knowledge graph.

[0120] Step S102H: Based on the user's training status, determine the prerequisite skill nodes that the user has mastered.

[0121] Among them, the prerequisite skill nodes whose skill mastery exceeds the preset skill mastery threshold are identified as prerequisite skill nodes that have been mastered.

[0122] In the attack chain knowledge graph, the question node is connected to the preceding skill node through the preceding dependency relationship. Therefore, by querying the preceding relationship edge of the question node to be advanced, the set of preceding skill nodes of the question can be obtained.

[0123] For example, if the training question to be advanced is a comprehensive SQL injection question, the prerequisite skill nodes obtained by querying can include request parameter analysis nodes, database basic nodes, and basic injection judgment nodes.

[0124] Step S102I: Add the nodes in the prerequisite skill nodes corresponding to the training questions to be advanced, whose ability mastery is less than the preset ability mastery threshold, to the prerequisite skill node set.

[0125] Pre-existing skill nodes whose mastery level exceeds a preset mastery level threshold are identified as mastered pre-existing skill nodes, and pre-existing skill nodes whose mastery level is less than a preset mastery level threshold are added to the pre-existing skill node set.

[0126] The nodes in the prerequisite skill node set represent prerequisite skills that the user has not yet mastered but are required for the questions to be advanced. They will serve as one of the entry points for querying related training questions, so that the candidate question set can include questions to fill the gaps in prerequisite skills.

[0127] Based on the above embodiments, generating a candidate question set based on each node set includes: Step S102J: Based on the nodes in the weak capability node set, the uncovered stage node set, and the prerequisite skill node set, query the associated training questions in the attack chain knowledge graph.

[0128] Using the nodes in the three node sets mentioned above as query entry points, query the training questions associated with these nodes in the attack chain knowledge graph.

[0129] Specifically, for a capability dimension node in the set of weak capability nodes, query the question node that can train that capability dimension along the capability coverage relationship edge; For attack stage nodes in the set of stage nodes that have not yet been covered, query the question nodes belonging to that attack stage along the stage dependency edges. For each prerequisite skill node in the prerequisite skill node set, query the question node that has that prerequisite skill as a prerequisite along the prerequisite dependency edge.

[0130] Step S102K: Merge and deduplicate the associated training questions to obtain the initial candidate set.

[0131] Since the same training question may be associated with multiple query entry points at the same time, for example, a comprehensive SQL injection question may be associated with the Web vulnerability exploitation capability dimension node, the vulnerability exploitation stage node, and the request parameter analysis prerequisite skill node. Therefore, there may be duplicate questions among the three query results. The training questions obtained from the query are merged and deduplicated to obtain the initial candidate set.

[0132] For example, deduplication can be performed based on question identifiers, merging questions with the same question identifier into a single record.

[0133] Step S102L: Filter the questions in the initial candidate set based on preset filtering conditions to obtain a candidate question set.

[0134] Preset filtering conditions may include: prerequisites can be met, the task has not been repeated recently, the difficulty matches the user's ability, the training environment is available, and the training time does not exceed the planned requirements.

[0135] The prerequisites can be met, which means that all the necessary prerequisite skills for the question have been mastered by the user, or that although there are prerequisite skills that have not been mastered, they can be met by inserting supplementary basic tasks.

[0136] "Not recently completed" means that the question has not been completed by the user within the preset recent time window, thus avoiding users repeatedly training on the same content.

[0137] Matching difficulty with user ability means that the gap between the difficulty of the question and the user's current ability level does not exceed a preset threshold, so as to avoid the question being too difficult for the user to complete or too easy for the user to achieve insufficient training benefits.

[0138] The training environment is available, meaning that the target environment required for the question to run is available. Questions with abnormal environments or insufficient resources will not be included in the candidate question set.

[0139] The training duration not exceeding the planned requirement means that after adding the questions to the training path, the total estimated time of the path does not exceed the maximum time limit specified in the training plan.

[0140] All of the above filtering conditions can be enabled, or some conditions can be enabled depending on the training scenario. This embodiment does not impose any restrictions on this.

[0141] Through this embodiment, the candidate question set simultaneously covers three dimensions: strengthening weak capabilities, completing stages, and supplementing prerequisite skills, making the search space for subsequent reinforcement learning decisions both complete and constrained.

[0142] When the reinforcement learning model selects from this set of candidate questions, the search space will not contain a large number of invalid or unexecutable questions due to its excessive scope, nor will it miss key questions needed to strengthen weak capabilities, complete stages, or supplement prerequisite skills due to its excessive scope, thus achieving a balance between decision efficiency and path quality.

[0143] Based on the above embodiments, this embodiment further illustrates the specific process of the reinforcement learning model selecting target questions and the path constraint verification and correction process. For example... Figure 2 As shown, it includes the following steps: Step S103A: The user's training state and training path context are used as the state space, and the candidate question set is used as the action space. The input is the reinforcement learning model, and the selection value or selection probability of each candidate question in the candidate question set is output.

[0144] The state space is used to describe the environmental state observed by the reinforcement learning model at the decision time.

[0145] The state space includes the capability mastery vector, the attack chain stage progress vector, the training target vector, the historical feedback vector, the path context vector, and the training load state vector.

[0146] The ability mastery vector is used to represent the user's mastery level in each ability dimension, and its calculation method has been explained in the above embodiments.

[0147] The attack chain stage progress vector is used to represent the user's completion level at each stage of the attack chain. It can be determined based on the ratio between the number of questions completed by the user at each stage and the number required by the training objective.

[0148] The training target vector is used to represent the requirements of the training target for each capability dimension and each attack stage, and can be obtained by parsing the training target template.

[0149] The historical feedback vector is used to represent information such as the user's recent training process, including completion rate, number of consecutive failures, prompt usage rate, average time consumption rate, and skip rate.

[0150] The path context vector is used to represent the knowledge points covered by the current training path, the completed attack phases, the remaining phases, and the current path length.

[0151] The training load state vector is used to indicate whether a user is in a state of continuous failure, long training time, or fatigue risk.

[0152] The aforementioned vectors together constitute the state space, enabling the reinforcement learning model to consider multiple dimensions such as user ability level, attack chain progress, training objective requirements, historical performance, path progress, and training load when making decisions.

[0153] The action space is a set of candidate questions.

[0154] The reinforcement learning decision-making module can employ a value function model, a policy network model, or a combination of both. The specific output form of the selected value or selection probability can be determined based on the model type; this embodiment does not impose any restrictions on this.

[0155] If a value function model is used, the system calculates the long-term value of selecting candidate topic a in the current state. If a policy network model is used, the system calculates the probability that candidate topic a is selected. Specifically:

[0156]

[0157] in, and Indicates parameters Decision-making model, Characteristics of candidate topics For training path context; This indicates the user's training status.

[0158] For any question node q, the system generates a feature vector for that question node. This vector is composed of vulnerability type, attack stage, difficulty, tool requirements, prerequisite skills, capability dimensions, and historical statistical characteristics, as shown below:

[0159] in, The vectorized representation of the category field. This represents an aggregate representation of multiple prerequisite skills or ability dimensions. It represents statistical characteristics such as the historical pass rate, average time spent, hint dependency rate, and environmental availability of the questions.

[0160] Step S103B: Based on the selection value or selection probability and the preset reward function, determine the comprehensive evaluation value of each candidate topic, and determine the target candidate topic from the candidate topic set based on the comprehensive evaluation value, and arrange the successively determined target candidate topics into the initial training topic sequence according to the decision order.

[0161] The preset reward function is used to score each candidate topic according to rules from dimensions such as training target coverage gain, attack chain phase advancement gain, degree of weakness reinforcement, and risk penalty.

[0162] Training target coverage gain represents the degree of contribution of candidate questions to the capability dimensions or attack phases required to be covered by the training target. It can be determined based on the intersection ratio of the candidate question capability coverage set and the training target capability dimension set.

[0163] The attack chain stage advancement gain represents the degree to which a candidate problem contributes to the advancement of an attack chain stage. It can be determined based on whether the attack stage to which the candidate problem belongs belongs to a set of stage nodes that have not yet been covered.

[0164] The degree of reinforcement of weak capabilities indicates the reinforcement effect of candidate questions on the user's weak capability dimensions. It can be determined based on the intersection of the candidate question capability coverage set and the weak capability node set, as well as the user's mastery gap in each weak capability dimension.

[0165] Risk penalty refers to the penalty value imposed on candidate questions due to excessive difficulty, recent repetition, excessive time consumption, or excessive security risk level.

[0166] The overall evaluation value is determined by the model output and the rule score.

[0167] Specifically, the selection value or probability output by the reinforcement learning model can be weighted and summed with the rule score calculated from a pre-defined reward function to obtain the comprehensive evaluation value for each candidate item. Taking the value of the candidate items output by the policy network as an example, the specific expression for the comprehensive evaluation value is as follows:

[0168] in, Indicates the training objective coverage gain. Indicates the attack chain phase advance gain. Indicates the degree to which a user's weak capabilities have been strengthened. The system assigns penalties for tasks that are too difficult, repetitive, time-consuming, or pose safety risks, with weighting coefficients ranging from η1 to η5. The system selects the candidate task with the highest overall action value as the initial decision.

[0169] The model output reflects the long-term benefit estimate learned by the reinforcement learning model from historical training data, while the rule score reflects operational constraints such as training objectives, attack chain stages, weaknesses, and risk control. By combining the model output with the rule score, the comprehensive evaluation value considers both the model's judgment on long-term training benefits and ensures that the current decision meets the basic requirements of training objectives and path constraints.

[0170] The system determines target candidate topics from the candidate topic set based on the comprehensive evaluation value. For example, the system can select the candidate topic with the highest comprehensive evaluation value as the target candidate topic for the current decision time. In the early stages of training or when feedback data is insufficient, the system can also employ an exploration mechanism to select candidate topics with a certain probability that do not have the highest comprehensive evaluation value but still meet the basic constraints, thereby collecting training feedback under different path arrangements and providing data for subsequent model optimization. As the decision-making process progresses, the system successively determines the target candidate topics for each decision time and arranges the successively determined target candidate topics into an initial training topic sequence according to the decision order. The topics in the initial training topic sequence are arranged in the order of decision, reflecting the results of the reinforcement learning model's successive selection from the candidate topic set.

[0171] Step S103C: The initial training question sequence is verified and corrected based on preset path constraints to obtain the target question.

[0172] The preset path constraints include preconditions, difficulty constraints, stage coverage constraints, diversity constraints, training duration constraints, and safety constraints.

[0173] Preconditions are used to determine whether the prerequisite skills for each question in the initial training question sequence have been met. For a question in the sequence, the set of prerequisite nodes for that question can be queried in the attack chain knowledge graph, and the skill mastery corresponding to each prerequisite node can be determined one by one to see if it exceeds the preset skill mastery threshold.

[0174] If there are unmet prerequisite nodes, the problem is not output directly. Instead, the node with the highest dependency weight is selected from the unmet prerequisite nodes, the corresponding prerequisite supplementary task is generated, and the prerequisite supplementary task is inserted before the problem.

[0175] Difficulty constraints are used to determine whether the gap between the difficulty of the question and the user's ability level exceeds a preset threshold. If the difficulty gap is too large, a lower-difficulty alternative task at the same stage can be selected, or the comprehensive task can be broken down into multiple sub-tasks to reduce the difficulty of a single training session.

[0176] The phase coverage constraint is used to determine whether the initial training question sequence covers the attack phases required by the training objective. If a certain target attack phase is not covered, the system increases the priority of the candidate tasks related to that phase, or directly inserts the corresponding phase task.

[0177] Diversity constraints are used to avoid recommending questions of the same vulnerability type, the same tool, or the same question type consecutively.

[0178] The training duration constraint is used to control the total estimated time of the path to not exceed the upper limit of the training plan.

[0179] Security constraints are used to prevent users with insufficient basic capabilities from prematurely recommending high-risk attack techniques or complex attack chain tasks.

[0180] The correction methods correspond to the constraints mentioned above. When the prerequisites are insufficient, insert a supplementary basic task. When the difficulty difference is too large, select a lower difficulty replacement task or split the comprehensive task. When the target attack phase is not covered, increase the priority of the uncovered phase tasks or insert corresponding phase tasks. When there are too many consecutive similar tasks, perform diversified replacements. When there are security risks, restrict the output of high-risk tasks.

[0181] The purpose of path constraint verification and correction is to prevent reinforcement learning models from generating actions that do not conform to the training rules in certain cases.

[0182] In most cases, the strategies learned by reinforcement learning models based on historical data can select reasonable candidate questions. However, in certain boundary cases, the model may output question sequences that do not meet the preconditions, have too large a difficulty range, or have missing stage coverage.

[0183] By verifying and correcting the initial training question sequence through preset path constraints, the system can perform secondary verification and automatic correction based on the model output results, ensuring that the output path meets the requirements of prerequisite dependencies and stage connection.

[0184] Meanwhile, since the candidate question set itself has already been generated under the constraints of the attack chain knowledge graph, the search space of the reinforcement learning model has been limited by the prior dependencies and the stage connection relationships. The path constraint verification and correction is a further guarantee based on this limited search space. The two work together to ensure that the final output ordered training path not only conforms to the attack chain stage advancement logic, but also meets the requirements of the user's current ability status and training objectives.

[0185] After step S103 outputs the ordered training path, the user performs security training in the cybersecurity test range based on this ordered training path. During and after the user's training task, the system collects the user's actual training performance data and updates the user's training status, attack chain knowledge graph, and reinforcement learning model based on this data, so that subsequent training paths can be dynamically replanned based on the user's real-time feedback.

[0186] Therefore, based on the above embodiments, as Figure 3 As shown, the method also includes: Step S104: Obtain feedback information from the user when performing secure training based on the ordered training path.

[0187] Feedback information includes at least one of the following: completion status, number of submissions, error type, number of prompts used, training time, skipped status, number of environment resets, and debriefing evaluation.

[0188] Step S105: Based on the feedback information, update the user's training state, the edge weights in the attack chain knowledge graph, and the parameters of the reinforcement learning model.

[0189] Updating user training status includes: if the user completes the training independently and within a reasonable timeframe, improving the user's mastery of relevant skills and progress in the corresponding attack phase; If a user fails repeatedly or uses the prompts frequently, the corresponding skill level will be reduced or the skill will be marked as a weak skill.

[0190] Specifically, the update of the ability mastery can follow the weighted fusion method in the above embodiments. The completion status, prompt usage, error type and training time in the feedback information of this round are normalized and then weighted and fused to obtain the increment or decrement of the mastery of the relevant ability dimensions in this round of training. Then, the mastery is accumulated or attenuated on the basis of the original ability mastery.

[0191] The updates to the attack phase progress are interconnected with the updates to the user's skill mastery. When a user completes a training question belonging to a specific attack phase, the progress of that attack phase increases accordingly.

[0192] If a user skips a question or fails on that question, the progress of the corresponding attack phase will not increase or the increase will be reduced.

[0193] Updating the edge weights in the attack chain knowledge graph includes adjusting the weights of the preceding or succeeding relationships between question nodes based on the feedback from this round, so that the graph relationships more accurately reflect the actual training gains.

[0194] Edge weights are used to represent the strength of the relationship between two nodes. When initially constructing the attack chain knowledge graph, edge weights can be determined based on manual annotation, historical training co-occurrence, and training reward statistics. As user training data accumulates, the edge weights are incrementally adjusted based on feedback from the current round.

[0195] For example, if a large number of users exhibit high completion rates and short training times when immediately moving from question A to question B, it indicates that the successor relationship between question A and question B has significant practical training benefits, and the system can accordingly increase the edge weights of this successor relationship. Conversely, if users frequently fail or skip questions when moving from question A to question B, it suggests that the connection between question A and question B may be flawed, and the system can accordingly decrease the edge weights of this successor relationship.

[0196] Adjusting edge weights will affect the generation of subsequent candidate question sets, because the generation of candidate question sets requires querying related questions along the edge relationships in the graph. Subsequent questions with higher edge weights have higher priority in the query results.

[0197] Updating the parameters of a reinforcement learning model includes adjusting the model parameters based on feedback values ​​to make subsequent decisions more aligned with the user's ability level. For example, if a user fails repeatedly on a high-difficulty question, the reinforcement learning model, after updating its parameters, will reduce the probability of choosing questions of that difficulty level in similar user states, and instead choose questions of moderate difficulty or those that provide foundational knowledge.

[0198] After the update is completed, the updated training state is used as the new current training state. The candidate question set generation and reinforcement learning decision are re-executed, so that the training path can be dynamically replanned based on real-time feedback such as user failure, skipping, long-term stuckness, frequent use of prompts, or quick completion.

[0199] Specifically, the updated training state will change the determination of the weak capability node set because the change in capability mastery will affect the comparison result with the preset capability mastery threshold; the updated attack chain knowledge graph edge weights will change the priority ranking of the questions in the candidate question set; and the updated reinforcement learning model parameters will change the selection value or selection probability of each candidate question in the candidate question set.

[0200] The combined effect of these three levels of updates alters the generation and decision-making outcomes of the next round of candidate question sets.

[0201] For example, if a user fails repeatedly on a comprehensive SQL injection question and frequently uses hints, the system can reduce the user's mastery of SQL injection-related skills based on the feedback, mark that skill as a weak skill, reduce the edge weights of the successor relationships between the comprehensive SQL injection question and its subsequent questions, and adjust the reinforcement learning model parameters to reduce the probability of choosing a high-difficulty SQL injection question in similar situations.

[0202] In the next round of training path generation, the updated training state is used as the new current training state. Step S102, candidate question set generation, and step S103, reinforcement learning decision are re-executed. The candidate question set will preferentially include preliminary supplementary questions such as request parameter analysis and database basics. The reinforcement learning model will also be more inclined to select these supplementary questions, thereby realizing dynamic replanning of the training path.

[0203] It should be noted that the collection and updating of feedback information can be performed immediately after the user completes each training question, or in batches after the user completes a set of training questions.

[0204] Based on the same technical concept, embodiments of the present invention also provide an electronic device, such as... Figure 4 As shown, it includes a processor 401, a communication interface 402, a memory 403, and a communication bus 404, wherein the processor 401, the communication interface 402, and the memory 403 communicate with each other through the communication bus 404.

[0205] Memory 403 is used to store computer programs; When the processor 401 executes the program stored in the memory 403, it implements the steps of the above-described method ten embodiments.

[0206] The communication bus mentioned in the above electronic devices can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, only one thick line is used to represent it in the diagram, but this does not mean that there is only one bus or one type of bus.

[0207] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0208] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0209] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0210] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0211] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0212] In addition, the functional units in the embodiments provided by the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0213] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0214] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0215] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. All should be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating training paths in a cybersecurity test range, characterized in that, include: Obtain the user's current training state, training path context, and training objective; The training status at least represents the user's level of mastery in cybersecurity training; Based on the user's training state, training path context, and training objective, the user's set of weak capability nodes, set of stage nodes not yet covered in the training objective, and set of prerequisite skill nodes are determined in the pre-constructed attack chain knowledge graph. A set of candidate questions is generated based on each set of nodes. The attack chain knowledge graph at least represents the association between question nodes and attack stage nodes, capability nodes, and prerequisite skill nodes. The association includes the prerequisite dependency relationship between question nodes and prerequisite skill nodes and the stage connection relationship between attack stage nodes. Using a reinforcement learning model, target questions that satisfy the stage connection relationship and prerequisite dependency relationship are selected from the candidate question set according to the user's training state and training path context, and an ordered training path is formed based on the target questions.

2. The method according to claim 1, characterized in that, The process of constructing the attack chain knowledge graph includes: Obtain the training questions and metadata of each question from the cybersecurity test range; Based on the training questions and the metadata of each question, the types of nodes are determined. The nodes include attack phase nodes, question nodes, vulnerability type nodes, tool command nodes, prerequisite skill nodes, protection and detection nodes, and capability dimension nodes. Establish the association relationships between the nodes, including the capability coverage relationship between the question node and the capability dimension node, the stage dependency relationship between the question node and the attack stage node, the preceding, succeeding and substitution relationships between the question nodes, and the protection correspondence relationship between the question node and the protection detection node.

3. The method according to claim 1, characterized in that, The process of obtaining the user's current training status includes: The system obtains the user's completion status, prompt usage, error type, and training time on training questions for each ability dimension. After normalizing the completion status, prompt usage, error type, and training time, the system performs a weighted fusion to obtain the ability mastery level for each ability dimension.

4. The method according to claim 1, characterized in that, Based on the user's training state, training path context, and training objective, the set of the user's vulnerable capability nodes is determined in the pre-constructed attack chain knowledge graph, including: The covered capability dimensions are determined based on the training path context; In the covered capability dimensions, the capability mastery level corresponding to each covered capability dimension is compared with the preset capability mastery level threshold; If the level is less than the preset capability mastery threshold, then query the attack chain knowledge graph for nodes associated with that capability dimension and add them to the weak capability dimension node set.

5. The method according to claim 1, characterized in that, Based on the user's training state, training path context, and training objective, the set of stage nodes not yet covered in the training objective is determined in the pre-constructed attack chain knowledge graph, including: Obtain the target attack phase set of the training objective and the set of covered attack phases of the user in the training context path; Based on the difference between the target attack phase set and the covered attack phase set, the set of phase nodes that have not yet been covered is determined.

6. The method according to claim 1, characterized in that, Based on the user's training state, training path context, and training objective, the set of the user's prerequisite skill nodes is determined in the pre-constructed attack chain knowledge graph, including: Based on the training path context and the training objective, determine the training topics to be advanced; In the attack chain knowledge graph, query the prerequisite skill node corresponding to the training question to be advanced; Based on the user's training status, the prerequisite skill nodes that the user has mastered are determined; wherein, the prerequisite skill nodes whose skill mastery exceeds a preset skill mastery threshold are determined as the prerequisite skill nodes that have been mastered. Add the nodes whose ability mastery level is less than the preset ability mastery level threshold from the prerequisite skill nodes corresponding to the training questions to be advanced to the prerequisite skill node set.

7. The method according to claim 1, characterized in that, The generation of the candidate question set based on each node set includes: Based on the nodes in the set of weak capability nodes, the set of uncovered stage nodes, and the set of prerequisite skill nodes, query the associated training questions in the attack chain knowledge graph. The associated training questions in the query are merged and deduplicated to obtain an initial candidate set; The questions in the initial candidate set are filtered based on preset filtering conditions to obtain a candidate question set.

8. The method according to claim 1, characterized in that, Using a reinforcement learning model, based on the user's training state and training path context, target questions that satisfy the stage connection relationship and prerequisite dependency relationship are selected from the candidate question set, including: The user's training state and training path context are used as the state space, and the candidate question set is used as the action space. The input is the reinforcement learning model, and the selection value or selection probability of each candidate question in the candidate question set is output. Based on the selection value or selection probability and the preset reward function, the comprehensive evaluation value of each candidate question is determined, and the target candidate question is determined from the candidate question set based on the comprehensive evaluation value. The target candidate questions determined in turn are arranged into an initial training question sequence according to the decision order. The initial training question sequence is verified and corrected based on preset path constraints to obtain the target questions.

9. The method according to claim 1, characterized in that, The method further includes: Obtain feedback information from users when performing secure training based on the ordered training path; Based on the feedback information, the user's training state, the edge weights in the attack chain knowledge graph, and the parameters of the reinforcement learning model are updated.

10. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes the program stored in the memory, it implements the method described in any one of claims 1-9.

Images