基于机器学习的自动化渗透测试系统技术的研究

Research on Automatic Penetration Testing System TechnologyBased on Machine Learning

为加强目标系统网络的安全等级,验证目标存在的威胁与漏洞,研究设计出基于机器学习的自动化渗透测试系统,利用多种入侵方法对目标进行自动化渗透测试;针对目标系统的各个网路节点的脆弱性和连接关系生成全局攻击图,计算对攻击目标的攻击路径的攻击价值,自动化生成最优攻击路径;采用多阶段渗透攻击的方法,建立渗透攻击的动态划分模型,利用网络中的漏洞不断接近并攻击目标;模拟企业网络架构进行渗透测试,实验结果显示该研究系统发起渗透攻击的成功率较高,最高达到95.4%,攻击目标主机能够生成最优的攻击路径,攻击价值最高达到27.3。

In order to strengthen the security level of the target system network and verify the threats and vulnerabilities of the target,an automatic penetration testing system based on machine learning is designed,a variety of intrusion methods are used to to carry out automatic penetration testing on the target.The global attack map is generated based on the vulnerability and connection of each network node of the target system,the attack value of the attack path on the target is calculated,and the optimal attack path is automatically generated.By using the method of the multi-stage infiltration attack,the dynamic partition model of the infiltration attack is established,and the loopholes in the network are used to approach and attack the target.The penetration test was conducted by simulating the enterprise network architecture.The experimental results show that,the success rate of penetration attack launched by this research system is high,up to 95.4%.The target host can generate the optimal attack path,and the attack value is up to 27.3.