## 3 Methods  
### Network Graph Model for Penetration Test  
#### 3.1.1 Definition of the Model  
**Definition 1**. : _Network graph model_  
_The network graph model for penetration test (NMPT) is a network graph model that is suitable for describing the penetration test process. NMPT is constructed by extending the attributes of edges and nodes based on the traditional network graph model. NMPT is defined as a 4-tuple:_  
\[\mathrm{G}(\mathrm{t})=\langle\mathrm{V},\mathrm{E},\mathbf{W},\mathrm{H}\rangle \tag{1}\]  
_where \(V\) is the set of nodes. \(E\) is the set of edges. \(\mathbf{W}\) is the connection relation between nodes, expressed in the form of a matrix. \(H\) represents the network hierarchy, indicating the location and hierarchical relationship of nodes in the network topology._  
**Definition 2**. : _Nodes in NMPT_  
_For the network graph model, \(\mathrm{G(t)}=\langle\mathrm{V,E,\textbf{W},H}\rangle\), where the set of nodes \(\mathrm{V}=\{\mathrm{v_{1},v_{2},\cdots,v_{n}}\},\mathrm{n}\in\mathrm{N}\), for each node in the network, according to the network security attributes related to the penetration test, the node attributes is defined as a 3-tuple:_  
\[\mathrm{V_{n}(t)}=\langle\text{ Vid, Vtype, Vattr }\rangle \tag{2}\]  
_where Vid is the identification of a node. Vtype indicates the type of node. Vattr indicates the attribute of node._  
(1) Node identification  
Due to modern network's characteristics of gradation, heterogeneity and complexity, we consider dividing the Vid into two parts, mandatory information and custom information, according to the usage of the scenario. Therefore, the node identifier Vid is defined as:  
\[\mathrm{Vid}=\left\{\text{ MInfo ; CIInfo }\right\}=\left\{\text{ \lx@math@degree\quad\text{Vname, Vnum; Info}}^{1},\cdots,\text{Info}^{n}\right\} \tag{3}\]  
MIInfo is the mandatory information segment, including the node name, serial number, etc., as the basic information that must be provided to relevant personnel. The serial number is the globally unique identifier of the node. CIInfo indicates the user-defined information segment. The user-defined information segment meets the requirements of different network scenarios and serves as a supplement for identification information. (2) Node type  
Due to social engineering methods, the penetration test is widely used with a high threat and characteristics of a high yield. Therefore, we consider the characters and their effect on social relations in the process of the penetration test. We set the node type as not limited to the host node type, and it contains person nodes, so the node type is expressed as:  
\[\mathrm{Vtype}=\left\{\mathrm{Vtype_{H},Vtype_{p}}\right\} \tag{4}\]  
\(\mathrm{Vtype_{H}}\) is the host node type, and \(\mathrm{Vtype_{p}}\) is the person node type. Because host nodes have multiple meanings and are often mobile and virtual, host node types can be further represented as \(\mathrm{Vtype_{H}}=<\mathrm{Vmob,Vvrm>}\). \(\mathrm{Vtype_{p}}\) is classified into administrators and common users based on their operation rights. \(\mathrm{Vtype_{p}}=\left\{\text{ Administrator,User}\right\}\). (3) Node properties  
The penetration test process involves many attributes related to network security. People, as a key factor in social networks and social engineering, should be included in the network model for a penetration test. a. Attributes of host-type nodes  
Attributes of the host include service, operating system version, vulnerabilities, the value of host, permission level, current running status and host assets, which are represented by 7-tuples:  
\[\text{Vattr}_{\text{H}}=\left\langle\text{Service,OSV,Vuln,Val,CPL,CRS,Prop}_{ \text{H}}\right.\rangle \tag{5}\]  
Service indicates the open service information of the host. OSV indicates the operating system version information of the host. The host operating system version could be Windows, Linux or CentOS. Vuln refers to the vulnerability of the host.