Network-oriented penetration testing scheme automatic-generation method

Abstract

The invention provides a network-oriented penetration testing scheme automatic-generation method. The technical problem that the conventional penetration testing scheme is formulated mainly by a penetration tester according to a penetration testing target so that the penetration tester always participates in penetration testing details is solved. The method consists of four flows, namely 'planning', 'information collection', 'generation of a penetration diagram' and 'generation of a penetration testing scheme'. The problem that overmany unrelated nodes can be found by a searching-based penetration diagram generation algorithm is solved by a penetration diagram generation algorithm combining backward searching and forward searching; and the problem of absence of an abstract model and a generation algorithm for the penetration testing scheme is solved by modeling the penetration testing scheme and providing the generation algorithm. By the method, the penetration tester is freed from the penetration testing details, and the penetration testing scheme can be quickly and accurately generated.

Description

technical field [0001] The invention belongs to the field of network information security, in particular to a method for automatically generating a network-oriented penetration testing scheme. Background technique [0002] Penetration testing is a security test in which testers simulate controlled attacks to find ways to bypass security features of applications, systems, and networks. Penetration testing, as a professional security service, has gradually begun to get more applications at home and abroad. Usually, penetration testing has a clear scope, goal and time limit. It is generally used to test the real-time status of enterprise security and the effect of security measures. It is suitable for security audit departments to conduct assessment tests, and can also be part of large-scale assessments. [0003] In the penetration testing process, the penetration testing personnel mainly rely on their own experience and knowledge to plan a penetration testing process, and the...

AI Technical Summary

Problems solved by technology

But the current penetration testing process is always too much manual involvement

[0006] Research on the generation of penetration testing schemes, the current problem is: there is no clear abstract model of penetration testing schemes, which is the basis for automatic generation of penetration testing schemes

The problem with this is: simply searching in one direction will cause too many irrelevant nodes to be searched

Images