## 3 Methods
### Social Engineering Factor Extended Intelligent Penetration Test Model
#### 3.2.1 Penetration Test Model  
**Definition 6**. : _Penetration test model_  
_The penetration test model consists of NMPT, role, action, penetration test target and state observation space, which is expressed as:_  
\[\text{Model}_{\text{PT}}=\langle\text{G}(\text{t}),\text{Ro},\text{A},\text{T},\text{O}\rangle \tag{18}\]  
_G(t) is a network graph model for penetration test, which serves as the target network in the process of the penetration test. Ro refers to the relevant role in the penetration test process. A is the action adopted during the penetration test. T is the target of the penetration test. O is the observation space._  
1. Role in the penetration test model The role of the penetration test model is expressed as: \[\text{Role}=\{\text{Attacker, Defender}\}\] (19)  
The attacker is a role who penetrates the target network during the penetration test, while the defender defends against the attacker who penetrates the target network. The attacker and defender directly affect the state of the target network through the attack and defense actions, respectively. Figure 6: The interaction between the penetration tester and network G(t). Action in the penetration test model  
Actions in the penetration test model are divided into attack actions and defense actions according to the roles in the penetration test model, which are expressed as:  
\[A=\left\{A_{\text{Attack}}\,,A_{\text{Defence}}\,\right\} \tag{20}\]  
There are four kinds of actions of the attacker, which are expressed as:  
\[A_{\text{Attack}}=\left\{A_{\text{local}},A_{\text{remote}},A_{\text{connect}},A _{\text{social}}\right\} \tag{21}\]  
\(A_{\text{local}}\) is the local vulnerability exploitation action. \(A_{\text{remote}}\) represents the remote exploit action. \(A_{\text{connect}}\) represents the credentials connecting action. \(A_{\text{social}}\) represents social engineering action and is represented by a 2-tuple: \(A_{\text{social}}=<\text{Vid}_{\text{person}}\,,\text{SEmethod}>\), where Vidperson is the ID of the person node. The social engineering method starts with human vulnerabilities and uses a range of deception and seduction methods to obtain critical sensitive data about infiltration targets. The parameter SEmethod represents the social engineering methods used, such as phishing attacks, forgery Man-in-the-MiddleAttack, and so on. By means of social work, the login information is obtained from the person node, the information of the host controlled by the person and a series of sensitive resources that are of great value to the attacker is discovered. The parameter list of the attacker action is shown in Table 1.  
There are three types of defender actions, which are expressed as:  
\[A_{\text{Defence}}\,=\left\{A_{\text{patch}}\,,A_{\text{down}}\,,A_{\text{ change}}\,\right\} \tag{22}\]  
\(A_{\text{patch}}\) means to fix a specific vulnerability on a target network host. \(A_{\text{down}}\) indicates to shut down services on the host or power off the host to physically isolate the invaded node and prevent further horizontal movement and infiltration as a jumper. \(A_{\text{change}}\) represents adjusting firewall policies to deal with malicious access and filtering malicious traffic. Target in the penetration test model  
The target T of the penetration test is set as obtaining sensitive resources specified in the target network, obtaining certain accumulative rewards or obtaining a certain proportion or all host control permissions in the target network. Observation in the penetration test model  
The observation space O observes the state changes of the target network and feeds back the action processing results of the target network to the penetration tester. These responses include:  
* Whether the current penetration tester action is successful. * The network status changes caused by the success or failure of the action. * How does the current state change motivate both penetration tester and defender.