Abstract: Attack graph is a visual display of the attack paths. It can reveal the relation of the vulnerabilities and damage may be caused. Attack graph provides a more intuitive and in-depth analysis method for risk assessment and penetration test. The complexity of current attack graph generation algorithms is too high to apply to large-scale network environments. In this paper, studying the process of constructing attack graph, an attack graph generation method was proposed based on privilege escalation matrix, attack pattern bank and describing target model. With the use of matrixes to describe the process of privilege escalation, the complexity of attack graph generation algorithms was lowered greatly. Finally, an experimental network was built as a case to illustrate the attack graph generation process.