A method, apparatus, medium, and program product for generating a detection tool

Abstract

Embodiments of the present application provide a method, device, medium and program product for generating a detection tool, the method comprising: determining script information, the script information comprising a target script and script running information; detecting the target script in combination with the script running information to generate a script detection result; and analyzing the script detection result using a target model to generate a corresponding script detection tool. The script detection tool is automatically generated by the model without manual code writing, and is more efficient.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method for generating a testing tool, an electronic device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] With the continuous development of cloud computing technology, cloud computing platforms are providing cloud computing services to an increasing number of users. Users can connect to cloud computing platforms and access services such as storage and computing through them.

[0003] Cloud computing platforms offer scripts for various services to users, who can also upload their own scripts for use. However, these scripts may contain undiscovered security risks, such as vulnerabilities or privilege abuse. Running these scripts in a production environment could lead to system crashes, data breaches, or malicious attacks.

[0004] Currently, script detection is often done by developers manually writing code to generate detection tools, which is inefficient. Summary of the Invention

[0005] This application provides a method for generating detection tools to improve the efficiency of detection tool generation.

[0006] Accordingly, embodiments of this application also provide an electronic device, a computer-readable storage medium, and a computer program product to ensure the implementation and application of the above-mentioned system.

[0007] To address the aforementioned issues, this application discloses a method for generating a detection tool. The method includes: determining script information, which includes a target script and script execution information; detecting the target script using the script execution information to generate a script detection result; and analyzing the script detection result using a target model to generate a corresponding script detection tool.

[0008] Optionally, determining the target information includes: monitoring the script library, identifying scripts that meet the extraction rules as target scripts; running the target scripts, and determining the script execution information of the target scripts.

[0009] Optionally, the step of detecting the target script by combining the script execution information and generating a script detection result includes: combining the script execution information, using the first model to detect the target script, and generating a script detection result.

[0010] Optionally, the step of combining the script execution information and using the target script in the first model to perform detection and generate script detection results includes: generating first input data based on the script execution information and the target script, inputting the first input data into at least one first model for detection, and outputting at least one script detection result.

[0011] Optionally, generating the first input data based on the script execution information and the target script includes: obtaining a first prompt word template for prompting the detection script; assembling the target script, the script execution information, and the first prompt word template to generate the first input data.

[0012] Optionally, the first prompt word template includes: task prompt information for the script detection task, script variable parameters, and runtime variable parameters; the step of assembling the target script, script runtime information, and the first prompt word template to generate the first input data includes: filling the target script into the script variable parameters, filling the script runtime information into the runtime variable parameters, and combining it with the task prompt information to generate the first input data.

[0013] Optionally, the step of inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: inputting the first input data into at least one first model; the first model performing at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; and generating at least one script detection result in a predetermined format.

[0014] Optionally, the target model is a second model. The step of analyzing the script detection results using the target model to generate a corresponding script detection tool includes: obtaining a second prompt word template for prompting the generation of the script detection tool; generating second input data based on the second prompt word template and the script detection results; inputting the second input data into the second model for analysis, and outputting the corresponding script detection tool.

[0015] Optionally, the target model is a second model, and the method further includes: using a generated script detection tool to detect the target script and generating corresponding tool detection results; the step of using the second model to analyze the script detection results and generate corresponding script detection tools includes: obtaining a third prompt word template for suggesting differences, and generating third input data based on the third prompt word template, the script detection results, and the tool detection results; inputting the third input data into the second model to analyze differences and outputting difference analysis results; obtaining a fourth prompt word template for suggesting updates to the script detection tool, and generating fourth input data based on the fourth prompt word template, the difference analysis results, and the script detection tool; inputting the fourth input data into the second model and outputting update information for the generated script detection tool; and updating the generated script detection tool using the update information to obtain an updated script detection tool.

[0016] Optionally, it also includes: generating test cases for the script detection tool based on the second model, so as to test the script detection tool based on the test cases.

[0017] Optionally, it also includes: analyzing the at least one script detection result and filtering the script detection results used to generate the script detection tool.

[0018] Optionally, the step of analyzing the at least one script detection result and filtering the script detection results used to generate the script detection tool includes: obtaining a fifth prompt word template for prompting evaluation of the processing results of different models; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into a third model for filtering processing, and outputting the filtered script detection results.

[0019] This application also discloses an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in this application.

[0020] This application also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method described in the embodiments of this application.

[0021] This application also discloses a computer program product, including a computer program / computer executable instructions, wherein the computer program / computer executable instructions implement the method described in this application embodiment when executed by a processor in an electronic device.

[0022] Compared with the prior art, the embodiments of this application have the following advantages:

[0023] In this embodiment, the target script to be detected and its script execution information are obtained. Then, the target script is detected using a first model in combination with the script execution information to generate script detection results. Compared with using static script information to detect the script, the detection accuracy of the script execution is higher when combined with the script execution context. Then, the script detection results are analyzed using a second model to generate a corresponding script detection tool. No manual coding is required, and the script detection tool automatically generated by the model is more efficient. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the steps of an embodiment of a method for generating a detection tool according to this application;

[0025] Figure 2 This is a flowchart of the steps in an optional embodiment of a method for generating a detection tool according to this application;

[0026] Figure 3 This is a flowchart of the steps in an optional embodiment of the method for generating another detection tool according to this application;

[0027] Figure 4 This is a schematic diagram of a script detection architecture according to an embodiment of this application;

[0028] Figure 5 This is a flowchart illustrating the steps of an embodiment of a script detection tool update method according to this application;

[0029] Figure 6 This is a flowchart illustrating the steps of another embodiment of the script detection tool update method of this application;

[0030] Figure 7 This is a schematic diagram of the structure of a device for generating a detection tool according to this application;

[0031] Figure 8 This is a schematic diagram of the structure of an exemplary device provided in one embodiment of this application. Detailed Implementation

[0032] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] This application's embodiments are applied to script detection scenarios, enabling script detection based on a model and the generation of script detection tools based on the detection results. The model can also be used for updating and testing the script detection tool. The model used can be a large model. A large model refers to a machine learning model with a large number of parameters and a complex structure, capable of processing massive amounts of data and completing various complex tasks, such as natural language processing, computer vision processing, speech recognition, code writing, and code detection. A large model can be a Large Language Model (LLM), a language model based on a transformer architecture, or various large language models trained by different software service providers based on an LLM model.

[0034] Large-scale models can be processed using prompt engineering, a method that guides the model to output the desired result by designing input prompts. Prompt engineering guides large language models to generate more accurate and demanding outputs by designing and optimizing the structure, content, and context of input prompts. In other words, by designing and optimizing input prompts, the large model is guided to generate more accurate answers, similar to equipping it with a "human language translator." Therefore, prompt templates can be set and combined with corresponding information to form input data, thereby guiding the model to output the corresponding results. In this embodiment, different prompt templates can be set for different tasks to prompt the large model to perform corresponding task processing. In this embodiment, the tasks to be performed by the large model include at least one of the following: script detection task, script detection tool generation task, script detection tool update task, analysis task of differences between different script detection results, and evaluation task of different model processing results. Accordingly, the prompt word templates include at least one of the following: a first prompt word template for prompting the detection script, a second prompt word template for prompting the script generation detection tool, a third prompt word template for prompting the analysis of differences, a fourth prompt word template for prompting the update of the script detection tool, and a fifth prompt word template for prompting the evaluation of the processing results of different models. The generated script detection tool also needs to be tested; therefore, the large model's tasks also include testing tasks for the script detection tool and generating test cases for the script detection tool. Corresponding prompt word templates can be set. Furthermore, test cases can be generated together with the script detection tool, for example, during the script detection tool generation or update tasks.

[0035] In the following embodiments, the detection of scripts is performed by combining the model and prompt word template, and the corresponding script testing tool is generated and updated based on the script detection results, so as to realize the automatic generation and adaptive optimization of the script testing tool, thereby improving processing efficiency and accuracy.

[0036] Reference Figure 1 The diagram illustrates a flowchart of an embodiment of a method for generating a detection tool according to this application.

[0037] Step 102: Determine the script information, which includes the target script and script execution information.

[0038] The platform monitors scripts, determining script information such as based on the platform's database, script library, and associated directories. This script information includes the target script and its runtime information. The target script is the script to be monitored, and the runtime information refers to details about the script's execution, such as its runtime environment.

[0039] In one optional embodiment, determining the target information includes: monitoring the script library to identify scripts that meet the extraction rules as target scripts; running the target scripts to determine their execution information. Monitoring the platform's script library can be understood as a storage unit such as a database storing scripts. Monitoring the script library can be done, for example, by monitoring the script directory of the script library, and identifying newly added scripts as target scripts based on the script directory. In one example, the script directory can be monitored, and when a newly added file is identified as a script based on its filename, file extension, etc., that script is selected as the target script. The file extension is used to identify the file format; for example, Python scripts typically have the extension ".py", and Shell scripts typically have the extension ".sh". The file extension identifies the file as a script.

[0040] In this embodiment, unique identifier information such as the hash value of the collected scripts can also be recorded. When a new script is detected, its hash value is compared with the recorded hash value to determine if it is a recorded script. If it is recorded, the script can be ignored; if not, it can be acquired as the target script. The list of script hash values ​​can be updated incrementally.

[0041] After identifying the target script to be tested, its execution information can be obtained. This execution information refers to the context information during script execution. This information can be obtained by running the target script, or directly if the execution information is already stored.

[0042] In one embodiment, when a new script is detected, the script is run to obtain the execution context. Table 1 below shows an example of script execution information:

[0043]

[0044] Table 1

[0045] This allows for analysis of the script in conjunction with its runtime context.

[0046] Step 104: Detect the target script by combining the script execution information and generate script detection results.

[0047] In this embodiment, the target script can be detected based on script execution information. There are various methods for script detection, such as detecting the script based on an algorithm model and generating script detection results, or detecting the target script separately using multiple detection tools and generating multiple script detection results. Such detection tools are used to detect different dimensions of the target script, such as detecting function behavior security, permission security, data security, etc., and detecting results from multiple dimensions so that the results can be combined to generate a script detection tool that can detect different dimensions of the script.

[0048] In one optional embodiment, the step of detecting the target script by combining the script execution information and generating script detection results includes: using a first model to detect the target script by combining the script execution information and generating script detection results. The script execution information and the target script can be input into the first model for detection to generate corresponding script detection results. For example, one or more LLM models can be selected as the first model to detect the target script, such as detecting script security, and generating corresponding script detection results. For LLM models, prompt word engineering can also be used to set prompt word templates to assist in detection.

[0049] In one optional embodiment, the step of combining the script execution information and using a first model to detect the target script and generate script detection results includes: generating first input data based on the script execution information and the target script; inputting the first input data into at least one first model for detection; and outputting at least one script detection result. The first input data can be generated based on the target script and script execution information, and then input into at least one first model for analysis and processing, correspondingly outputting script detection results, thus obtaining at least one script detection result. This approach enables automatic script detection through models, improving script detection efficiency, and by incorporating execution information during the script detection process, it enhances the accuracy of script detection.

[0050] In this embodiment, generating first input data based on the script execution information and the target script includes: obtaining a first prompt word template; assembling the target script, script execution information, and the first prompt word template to generate the first input data. The first prompt word template is pre-generated based on a script detection task, and the target script, script execution information, and the first prompt word template are then assembled to generate the first input data.

[0051] The first prompt word template includes: task prompt information for the script detection task, script variable parameters, and parameter variable parameters. The task prompt information is used to indicate the task objective and requirements of the script detection task to be performed by the first model. For example, the task objective is to detect the security of the script, and the task requirements include the format requirements of the output data of the security items to be detected. In one example, the task prompt information can indicate the operations to be performed, the required variable parameters, and the format of the output data, among other tasks. The variable parameters are variable parameters in the first prompt word template; the script variable parameters are used to determine the script to be detected, and the parameter variable parameters are used to determine the script's execution parameters. Assembling the target script, script execution information, and the first prompt word template to generate the first input data includes: filling the target script into the script variable parameters, filling the script execution information into the parameter variable parameters, and combining it with the task prompt information to generate the first input data.

[0052] In one example, the target script to be detected includes Python scripts and Shell scripts. Python is an interpreted scripting language, and Shell is a scripting language. An example of a first-response word template is:

[0053] py_script_permission_prompt = """You are a security expert proficient in Python and Shell, and your task is to analyze the security of scripts."

[0054] Please analyze the script according to the following requirements:

[0055] - Issues requiring permission checks fall into the following categories; you can add more categories based on your experience:

[0056] 1. ……

[0057] 2. ……

[0058] ...

[0059] - Output follows the specified JSON (JavaScript Object Notation) format.

[0060] Please do not output any unnecessary information; only output the results in JSON format.

[0061] **Notice**:

[0062] - Only analyze the given script content; if there are no problems, return empty.

[0063] - The output format is as follows (must be an exact match):

[0064] json

[0065] {{

[0066] "permission_checker": [

[0067] {{

[0068] "line_number": "<line number>",

[0069] "danger_type": "<danger type, such as Accessing Sensitive Directories>",

[0070] "danger_detail": "<Details of the dangerous behavior, such as cd / root / benchmarksql / run>",

[0071] }}

[0072] ],

[0073] }}

[0074] ```

[0075] The following is the specific content of the Python script:

[0076] {python_script_code}

[0077] The following is the context of the Python script.

[0078] {python_script_context}

[0079] """

[0080] The task prompt information in the aforementioned first prompt word template includes various information such as: task objective, task content, variable parameter positions, output format, and output content. Specifically, the task objective indicates the detection task the model needs to perform; the task content specifies the detection task, including the detection category and item; the variable parameter positions indicate the location and type of the variable parameters to be filled in the template, allowing for the filling of corresponding variable parameter values; the output format indicates the format of the model's output data, such as JSON; and the output content indicates the specific content of the template's output data, such as the results corresponding to the detected items, including the output item type and its location.

[0081] In one example, script detection includes performing security checks on the script to ensure the security of the invoked script. Therefore, the step of inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: inputting the first input data into at least one first model; the first model performing at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; and generating at least one script detection result in a predetermined format.

[0082] The first input data is input into the first model. Based on the prompts from the first input data and combined with script execution information, the first model performs at least one of the following security checks on the target script: function behavior security check, permission security check, data security check, dependency security check, and network behavior security check. For each security check item, a corresponding check result is obtained, and these results are combined to obtain a script check result in a predetermined format, such as a JSON format script check result or a YAML (Yet Another Markup Language) format script check result. Specifically, function behavior security check detects the security of function behavior in the script, such as whether a function performs undefined behavior, and whether the calling and accessing of data corresponding to a function is secure. Permission security check detects the security of permission calls in the script, such as whether the permissions called by the script are necessary, and whether there is any abuse of permissions. Data security check detects the security of data corresponding to the script, such as whether the data called by the script is secure. Dependency security check detects the security of dependencies corresponding to the script, such as whether the dependencies between functions in the script are secure, and the security of dependencies between data called by the script. Network behavior security detection is used to check the security of network behaviors corresponding to scripts, such as whether the network behavior of scripts calling interfaces, data, services, etc., is secure. The above security detection items can be adjusted based on requirements, such as expanding to include new security detection items or modifying existing ones. Therefore, the first prompt word template can be adjusted based on the detection item adjustment information. This adjustment information determines the detection items to be adjusted, and based on these adjusted detection items, the task prompts in the first prompt word template can be adjusted, such as changing the task content.

[0083] The first input data is then input into each of the first models, yielding script detection results output by each model. In this embodiment, since different first models have certain differences, their script detection results will also differ. Therefore, multiple first models can be used to analyze the target script separately, and the script detection results of each model can be tested to filter the desired script detection results. That is, at least one script detection result is analyzed to filter the script detection results used to generate the script detection tool. In one example, the script detection results can be analyzed using methods such as scoring to filter the desired results.

[0084] In some alternative embodiments, the step of analyzing and filtering the script detection results for generating the script detection tool includes: obtaining a fifth prompt word template; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into a third model for filtering processing; and outputting the filtered script detection results. The script detection results can be filtered using a large language model. A fifth prompt word template can be pre-constructed to prompt the task of filtering the script detection results. The fifth prompt script includes a prompt task and variable parameters. The prompt task is used to prompt the execution of the script detection result filtering task, including the filtering content, filtering conditions, etc., and the variable parameters correspond to each script detection result. Based on the fifth prompt word template and each script detection result, fifth input data is generated. The fifth input data is input into the third model to filter each script detection result, and the filtered script detection results are output.

[0085] In one optional embodiment, the filtering content includes at least one of the following verification items: syntax verification, context verification, and consistency verification. The filtering criteria can be passing each verification item, or the number of verification items passed, etc. Specifically, language verification is used to check the format validity of the script detection results, such as verifying format validity through JSON Schema. Context verification is used to verify whether dangerous items in the script detection results conform to the runtime environment, such as whether dangerous items in the script detection results conform to the runtime environment and whether the operating system will mark root access. Consistency verification is used to cross-validate the script detection results output by different first models.

[0086] In this embodiment of the application, the first model and the fifth model can be the same large model or different large models, and the script detection results are filtered through the large model.

[0087] Step 106: Analyze the script detection results using the target model to generate a corresponding script detection tool.

[0088] After obtaining the script detection results, a target model, such as a large model, can be used to analyze these results, thereby generating a script detection tool. The target model is a model capable of generating a script detection tool.

[0089] A script detection tool is a tool used to detect scripts. The items detected by the tool can be determined based on requirements, such as detecting script security vaults or script functionality. A script detection tool can take the form of an SDK (Software Development Kit). An SDK is a collection of tools provided to developers, typically including library files, APIs (Application Programming Interfaces), and sample code, used to quickly build software or applications with specific functions. In this embodiment, the script detection tool can be in the form of an SDK; one example is a packaged toolkit with script security detection capabilities.

[0090] In one optional embodiment, the step of analyzing the script detection results using a second model to generate a corresponding script detection tool includes: obtaining a second prompt word template; generating second input data based on the second prompt word template and the script detection results; inputting the second input data into the second model for analysis; and outputting the corresponding script detection tool. The second prompt word template can be pre-constructed. This template is used to prompt the task of generating the script detection tool. The second prompt script includes task prompts and variable parameters. The task prompts indicate the required operations for the task of generating the script detection tool, such as prompting the generation of a corresponding script detection tool based on the script detection results. The items that the script detection tool needs to detect can be determined based on the detection items in the script detection results, as well as the output results and format requirements for each detection item. The variable parameters are used to fill in variable parameters, such as the script detection results.

[0091] The script detection results are filled into the variable parameters of the second prompt word template to generate second input data. This second input data is then input into the second model for processing. The second model processes the second input data and, based on the prompts in the second input data, determines the script detection tool that needs to be generated. Based on the script detection results in the second input data, it determines the items that need to be detected in the script. These detection items include at least one of the following: function behavior security detection, permission security detection, data security detection, dependency security detection, network behavior security detection, etc. The output requirements of the script detection tool, such as output content and format, can also be determined based on the script detection results. Thus, the script detection tool is generated and output. This method combines the second model with the prompt word template to perform the script detection tool generation process. The prompt word template indicates the required processing for the second model, improving the generation efficiency and accuracy of the script detection tool.

[0092] In this embodiment, the first model and the second model can be the same model or different models. For example, the second model is a model with good code compilation capabilities, etc. This embodiment does not limit this.

[0093] In summary, the first model is used to detect the target script and its execution information, and then the first model is used to detect the target script in combination with the execution information to generate script detection results. Compared with using static script information to detect the script, the detection accuracy of the script execution is higher when combined with the execution context. The second model is then used to analyze the script detection results to generate a corresponding script detection tool. No manual coding is required, and the script detection tool automatically generated by the model is more efficient.

[0094] Based on the above embodiments, this application also provides a method for generating a detection tool, which can combine multiple first models to detect target scripts, select better script detection results to generate script detection tools, and improve the accuracy of script detection tools.

[0095] Reference Figure 2 The diagram illustrates a flowchart of an optional embodiment of a method for generating a detection tool according to this application.

[0096] Step 202: Monitor the script library and identify scripts that meet the extraction rules as target scripts.

[0097] Step 204: Run the target script and determine the script execution information of the target script.

[0098] Step 206: Obtain the first prompt word template.

[0099] Step 208: Assemble the target script, script execution information, and first prompt word template to generate the first input data.

[0100] Specifically, the target script is filled into the script variable parameters, the script running information is filled into the running variable parameters, and combined with the task prompt information to generate the first input data.

[0101] Step 210: Input the first input data into at least one first model.

[0102] Step 212, the first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0103] Step 214: Generate at least one script detection result in a predetermined format.

[0104] Step 216: Analyze the at least one script detection result and filter the script detection results used to generate the script detection tool.

[0105] Specifically, the process involves: obtaining a fifth prompt word template; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into a third model for filtering; and outputting the filtered script detection result.

[0106] Step 218: Obtain the second prompt word template.

[0107] Step 220: Generate second input data based on the second prompt word template and script detection results.

[0108] Step 222: Input the second input data into the second model for analysis and output the corresponding script detection tool.

[0109] This allows for the use of multiple primary models to detect scripts, followed by a comprehensive evaluation of the script detection results from each model. Script detection results that meet the requirements are then selected, and a script detection tool is generated based on the selected results and a secondary model. This enables the automatic generation of script detection tools and improves processing efficiency.

[0110] After the script detection tool is generated, it usually needs to be tested to assess its security, stability, accuracy, and other properties. In this embodiment, test cases for the script detection tool can also be automatically generated using the model. These test cases can be generated simultaneously with the script detection tool or generated separately; this embodiment does not impose any limitations on this. In one optional embodiment, test cases for the script detection tool are generated based on the second model, so that the script detection tool can be tested based on these test cases.

[0111] In one implementation, prompts for generating script test cases can be added to the second prompt word template. Thus, the task prompts in the second prompt word template include prompts for generating a script testing tool and prompts for generating script test cases. After generating second input data based on the script detection results and the second prompt word template, the second model can process the second input data to generate a script detection tool and test cases, thereby using the test cases to detect the script detection tool.

[0112] In another implementation, a separate prompt template, referred to as the sixth prompt template, can be created to prompt the script detection tool for generating test cases. Based on the sixth prompt template and the script detection tool, sixth input data is generated and fed into a second model for processing, outputting the corresponding test cases for the script detection tool.

[0113] The script detection tool can be tested based on the test cases generated by the model, and after the script detection tool passes the test, it can be used to detect scripts.

[0114] Based on the above embodiments, this application also provides a method for generating a detection tool, which can combine multiple first models to detect target scripts, select better script detection results to generate script detection tools, and improve the accuracy of script detection tools.

[0115] Reference Figure 3 The diagram illustrates a flowchart of an alternative embodiment of the method for generating another detection tool according to this application.

[0116] Step 302: Monitor the script library and identify scripts that meet the extraction rules as target scripts.

[0117] Step 304: Run the target script and determine the script execution information of the target script.

[0118] Step 306: Obtain the first prompt word template.

[0119] Step 308: Assemble the target script, script execution information, and first prompt word template to generate the first input data.

[0120] Specifically, the target script is filled into the script variable parameters, the script running information is filled into the running variable parameters, and combined with the task prompt information to generate the first input data.

[0121] Step 310: Input the first input data into at least one first model.

[0122] Step 312, the first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0123] Step 314: Generate at least one script detection result in a predetermined format.

[0124] Step 316: Analyze the at least one script detection result and filter the script detection results used to generate the script detection tool.

[0125] Specifically, the process involves: obtaining a fifth prompt word template; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into a third model for filtering; and outputting the filtered script detection result.

[0126] Step 318: Obtain the second prompt word template.

[0127] Step 320: Generate second input data based on the second prompt word template and script detection results.

[0128] Step 322: Input the second input data into the second model for analysis, and output the corresponding script detection tool and test cases.

[0129] Step 324: Test the script detection tool using the test cases.

[0130] In this embodiment, taking a cloud computing platform as an example, the cloud computing platform has self-developed components, which can be Python scripts and / or Shell scripts. These components can provide the necessary services to users of the cloud computing platform. The scripts for security detection of self-developed components by the cloud computing platform can be implemented through the following modules, such as... Figure 4 As shown:

[0131] The module includes: a monitoring and data collection module 401, a security enhancement analysis module 403, a code generation module 405, and a management module 407. Among these:

[0132] The monitoring and data collection module 401 is used to collect script execution information, such as newly added Python / Shell scripts and their execution context, from the self-developed components. Specifically, it takes the script directory of the self-developed components as input, identifies newly added Python scripts and / or newly added Shell scripts by monitoring the script directory, and obtains script execution information such as operating system data, permission data, and network exposure level.

[0133] The security enhancement analysis module 403 is used by the LLM model to perform various specialized checks and security risk analyses on newly added Python / Shell scripts, generating structured inspection results, i.e., script detection results, to guide the generation and iterative updates of script detection tools. The specialized inspections and security risk analyses include at least one of the following: function behavior security, permission security, data security, dependency security, and network behavior security. Furthermore, the required inspection items can be expanded as needed, and this embodiment does not impose any limitations on this.

[0134] The large language model is used as an "expert annotator" to generate high-precision structured inspection reports, which guide the generation and updating of script detection tools. Using the script and script execution information obtained by the monitoring and data collection module 401 as input, combined with the prompt word templates corresponding to the prompt word project, structured script detection results can be generated. In one optional embodiment, the filtering content includes at least one of the following verification items: syntax verification, context verification, and consistency verification. The filtering criteria can be passing each verification item, or the number of verification items passed. Language verification is used to check the format and discovery of the script detection results, such as verifying the format legality through JSON Schema. Context verification is used to verify whether dangerous items in the script detection results conform to the operating environment, such as whether dangerous items in the script detection results conform to the operating environment and whether the operating system will mark root access. Consistency verification is used to cross-validate the script detection results output by different first models.

[0135] The code generation module 405 is used to generate a script detection tool and update the script detection tool's code (including test code) based on the script detection results generated by the LLM model, achieving detection results that are essentially the same as those of the LLM model. The code generation module 405 converts the script detection results from the security enhancement analysis module 403 into executable SDK code for the script detection tool, generates corresponding test case code, and can also execute tests.

[0136] Specifically, for the script detection tool's code, the executable SDK code and updated patch code can be determined based on the script detection results and prompt word templates. Test cases can also be generated and executed to verify whether the script detection tool's code can pass the tests and to determine the corresponding logs, such as verifying whether code errors occur and whether performance meets requirements.

[0137] For test cases of script detection tools, a hybrid testing framework can be used, including unit testing, fuzz testing, and real-world testing. Unit tests are used to verify the logic of each detection item in the script detection tool, fuzz testing is used for stress testing of the tool, and real-world testing is used to execute tests based on a test suite of self-developed components. Quality thresholds can also be set for detection, such as unit test coverage ≥90% and performance degradation ≤10%.

[0138] The management module 407 is used to manage the version iteration of script detection tools, supporting release, rollback, and version tracking. For script detection tools that pass the test, information such as the script detection tool and its corresponding version number can be recorded, and the version release history can be determined.

[0139] This enables real-time analysis of newly added scripts using a large language model, generating structured script detection tools, and converting them into executable SDK code for automatic rule iteration. Rule update efficiency is improved, the update cycle is shortened, and new threats such as malicious script variants can be responded to quickly.

[0140] By combining script execution information from the runtime feedback of self-developed components, such as script execution results and environmental context data, rule weights are dynamically adjusted, allowing rules to evolve in sync with real-world scenarios and achieving runtime data-driven optimization of script tools. This enhances threat detection coverage, enabling the model to identify unseen permission abuse scripts and incorporate them into the rule base, reducing the risk of false negatives.

[0141] The model's script detection results undergo multiple verifications, including semantic and contextual consistency checks, and multi-model cross-validation, to improve the accuracy of the output results and ensure they conform to real-world environments. The script detection tool is tested during both generation and update processes, and any test failures (such as false positives / false negatives) are fed back to the model, triggering automatic iterative optimization. This improves functional consistency, ensuring a high degree of consistency between the script detection tool and the model's detection capabilities, and correcting deviations through backward verification such as testing.

[0142] The above process enables end-to-end automation, including listening for script update events, analyzing and detecting scripts using a large model, code generation, updates, automated testing, and version management. Iteration efficiency is significantly improved, enhancing the iteration efficiency of script detection tools.

[0143] Based on the above embodiments, this application also provides a method for updating a script detection tool. If a script detection tool has already been generated, it can be automatically updated using a model.

[0144] Based on the existing script detection tool, when a target script is detected, both the first model and the existing script detection tool can be used to detect the target script. Specifically, the existing script detection tool is used to detect the target script, generating corresponding tool detection results.

[0145] The generated script detection tool can be updated using a second model. By combining the differences between the script detection results output by the first model and the tool detection results output by the script detection tool, potential problems with the script detection tool can be analyzed, and the script detection tool can be updated accordingly.

[0146] In other optional embodiments, when adding or modifying the detection rules or methods of the script, the first prompt template can be adjusted accordingly, thereby updating the detection results for the script accordingly. By comparing the differences between the script detection results detected by the model and the tool detection results detected by the script detection tool, it is possible to determine whether the generated script detection tool has missing or outdated rules, and then update the generated script detection tool.

[0147] In one optional embodiment, the target model is a second model. The step of analyzing the script detection results using the target model to generate a corresponding script detection tool includes: obtaining a third prompt word template for suggesting differences in analysis, and generating third input data based on the third prompt word template, the script detection results, and the tool detection results; inputting the third input data into the second model to analyze the differences and outputting the difference analysis results; obtaining a fourth prompt word template for suggesting updates to the script detection tool, and generating fourth input data based on the fourth prompt word template, the difference analysis results, and the already generated script detection tool; inputting the fourth input data into the second model and outputting update information for the script detection tool; and updating the already generated script detection tool using the update information to obtain an updated script detection tool.

[0148] The target script can be detected using a first model and a script detection tool, respectively, combined with script execution information, yielding corresponding script detection results and tool detection results. These results are then combined with a third prompt template to generate the corresponding third input data. The third prompt template includes: task prompt information and variable parameters for the difference detection task. The task prompt information includes the task objective and requirements for the difference analysis task to be performed by the model. For example, the task objective is to analyze the differences between the results of two scripts, while the task requirements include the specific items to be analyzed, which are related to the items detected by the scripts, and suggestions for optimization based on the analyzed differences. The task requirements also include the output format of the output data, such as the difference items, difference content, and data format to be output. The variable parameters include: model output parameters and tool output parameters. The model output parameters are used to populate the script detection results output by the model, and the tool output parameters are used to populate the tool detection results output by the script detection tool.

[0149] An example of a third-party prompt template is shown below:

[0150] diff_prompt = """

[0151] You are a security expert proficient in Python and Shell, and your task is to analyze the security of scripts. We will use two tools:

[0152] 1. **Model** (Security analysis of scripts based on models)

[0153] 2. **Script-based security analysis** (not based on large models, but on static code analysis for security analysis)

[0154] Security analysis of the same Python or Shell script yielded different results. Both sets of results analyzed security from the perspectives of five detectors (function checker, permission checker, data checker, dependency checker, and network checker).

[0155] ---

[0156] ### Task Requirements

[0157] 1. **Comparative Analysis:** Identify risk factors detected by the model but not by the script detection tool.

[0158] 2. **Optimization Suggestions:** If discrepancies exist, please clearly state the **expected performance of the script detection tool**, including:

[0159] - Which checker type (function_checker, permission_checker, etc.)

[0160] - Which section of code should be inspected, and what kind of inspection result is expected?

[0161] 3. **Output format requirements:**

[0162] - Strictly adhere to the following JSON format

[0163] - Outputs only JSON results without any extra information.

[0164] - If there is no difference, then `diff` is an empty list.

[0165] ---

[0166] ### Output format (strict matching):

[0167] json

[0168] {{

[0169] "diff": [

[0170] {{

[0171] "checker_type": "<checker type>",

[0172] "llm_report": "<Dangerous behaviors reported by the LLM, showing the specific sub-items of this checker>",

[0173] "sdk_report": "<Dangerous behaviors reported by the SDK, showing the specific sub-items of this checker>",

[0174] "diff_analysis": "<Difference analysis, divided into two categories:

[0175] 1. No difference

[0176] 2. There is a difference, describe the type of difference>",

[0177] "action": "Whether the SDK needs to be updated. If so, describe:

[0178] - Which checker to modify

[0179] - Which section of the code to check and what the expected check result is"

[0180] }}

[0181] ,

[0182] }}

[0183] Thus, the differences between different detection results are detected through the third prompt template.

[0184] Fill the script detection results into the model output parameters of the third prompt template, and fill the tool detection results into the tool output parameters of the third prompt template to generate the third input data. Then input the third input data into the second model for analysis and processing. The second model can take the script detection results as a benchmark to detect the differences between two different detection results. For example, a certain dangerous prompt item is detected in the script detection results but not in the tool detection results. Based on the differences, the reasons for the differences and improvement suggestions can also be analyzed. For example, the difference is caused by the detection method, or the difference is caused by the lack of corresponding detection rules. Furthermore, a difference analysis result is generated.

[0185] The difference analysis results are then combined with the fourth prompt word template to generate the corresponding fourth input data. The fourth prompt word template includes task prompts and variable parameters for the difference detection task. The task prompts indicate the task objective and requirements for the difference detection task to be performed by the model. For example, the task objective is to detect differences between different detection results, and the task requirements include analyzing the differences between different results, the content of the differences, and output format requirements. The variable parameters are used to populate parameters such as the difference analysis results and the code of the script detection tool.

[0186] Here is an example of a fourth cue word template:

[0187] code_generate_prompt = """

[0188] You are a security expert proficient in Python and Shell. Your task is to generate a code patch for the security SDK based on the diff analysis results between this detection and the tool's detection results (analyzing {file}).

[0189] This enables the security SDK to analyze {file} in a way that achieves the same effect as LLM analysis.

[0190] ---

[0191] ###Related code for script detection tool:

[0192] {sdk_content}

[0193] ### Input Requirements

[0194] Based on the diff analysis results input in the following JSON format, please generate patch code and test cases for the script detection tool:

[0195] {diff_result}

[0196] Please carefully read and understand the existing code logic of the script detection tool, and then generate the patch code.

[0197] Output requirements

[0198] 1. Generate patch code:

[0199] Please ensure you understand the existing code logic of the script detection tool before adding patches to it.

[0200] Clearly indicate the modification path (e.g., security_analyzer / checkers / function_checker / XX.py)

[0201] Use + to indicate adding code.

[0202] Use - to delete the code (if needed).

[0203] Output format

[0204] diff analysis results (outputting the complete {diff_result})

[0205] Code patch (outputs only in diff format)

[0206] """

[0207] Therefore, based on the aforementioned fourth prompt word template and the code of the script detection tool, as well as the difference analysis results, a fourth input data can be generated.

[0208] The fourth input data is fed into the second model for analysis. Based on the difference analysis, the content that needs to be updated in the script detection tool can be determined. This update must follow the code logic of the script detection tool itself. Based on this code logic, patch code is generated and output as update information for the script detection tool. Then, the generated script detection tool is updated using the code patch and other update information to obtain the updated script detection tool. Based on the generated script detection tool, the same script is detected using both the generated script detection tool and the second model. The differences between the two detection results are analyzed to obtain the patch code and other update information for the generated script detection tool, thereby quickly updating the generated script detection tool.

[0209] Based on the above embodiments, this application also provides a method for updating a script detection tool, such as... Figure 5 As shown:

[0210] Step 502: Monitor the script library and identify scripts that meet the extraction rules as target scripts.

[0211] Step 504: Run the target script and determine the script execution information of the target script.

[0212] Step 506: Obtain the first prompt word template for the prompt detection script.

[0213] Step 508: Assemble the target script, script execution information, and first prompt word template to generate the first input data.

[0214] Specifically, the target script is filled into the script variable parameters, the script running information is filled into the running variable parameters, and combined with the task prompts to generate the first input data.

[0215] Step 510: Input the first input data into at least one first model.

[0216] Step 512: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0217] Step 514: Generate at least one script detection result in a predetermined format.

[0218] Step 516: Obtain the fifth prompt word template to evaluate the processing results of different models, and generate the fifth input data based on the fifth prompt word template and at least one script detection result.

[0219] Step 518: Input the fifth input data into the third model for filtering processing, and output the filtered script detection results.

[0220] Step 520: Use the generated script detection tool to detect the target script and generate the corresponding tool detection results.

[0221] Step 522: Obtain a third prompt word template for analyzing differences, and generate third input data based on the third prompt word template, script detection results, and tool detection results.

[0222] Step 524: Input the third input data into the second model to analyze the differences and output the difference analysis results.

[0223] Step 526: Obtain the fourth prompt word template for prompting the script detection tool to update, and generate the fourth input data based on the fourth prompt word template, the difference analysis results, and the script detection tool.

[0224] Step 528: Input the fourth input data into the second model.

[0225] Step 530: Analyze the fourth input data using the second model to determine the patch code for the generated script testing tool, and output the patch code as update information for the script testing tool.

[0226] Step 532: Update the generated script detection tool using the update information to obtain an updated script detection tool.

[0227] In one alternative embodiment, the script detection tool can be updated using the same model, and test cases and corresponding test results can be generated. This allows for simultaneous testing of the updated script detection tool during the update process, resulting in higher efficiency.

[0228] Therefore, the fourth prompt template can be used to set prompts for generating test cases and executing tests. Based on this template, test cases can be generated and executed using the updated script testing tool, and the test results can be determined. Accordingly, the task objectives of the fourth prompt template include generating test cases and executing tests using these test cases. Mapping rules for test cases and the test commands required to execute the tests can be configured accordingly.

[0229] In one example, a prompt template for generating update information (such as patch code), test cases, and determining test results for a script testing tool is shown below:

[0230] code_generate_prompt = """

[0231] You are a security expert proficient in Python and Shell. Your task is to generate a code patch for the security SDK based on the diff analysis results between this detection and the tool's detection results (analyzing {file}).

[0232] This enables the security SDK to analyze {file} in a way that achieves the same effect as LLM analysis.

[0233] ---

[0234] ###Related code for script detection tool:

[0235] {sdk_content}

[0236] ### Input Requirements

[0237] Based on the diff analysis results input in the following JSON format, please generate patch code and test cases for the script detection tool:

[0238] {diff_result}

[0239] Please carefully read and understand the existing code logic of the script detection tool, and then generate the patch code.

[0240] Output requirements

[0241] 1. Generate patch code:

[0242] Please ensure you understand the existing code logic of the script detection tool before adding patches to it.

[0243] Clearly indicate the modification path (e.g., security_analyzer / checkers / function_checker / XX.py)

[0244] Use + to indicate adding code.

[0245] Use - to delete the code (if needed).

[0246] 2. Generate unit test cases

[0247] Test file mapping rules:

[0248] function_checker → tests / test_func_checker.py

[0249] permission_checker → tests / test_permission_checker.py

[0250] data_checker → tests / test_data_checker.py

[0251] dependency_checker → tests / test_dependency_checker.py

[0252] network_checker → tests / test_network_checker.py

[0253] Test case requirements (if applicable):

[0254] Using the pytest framework

[0255] Covering the following scenarios:

[0256] Forward matching: Scripts containing dangerous functions / patterns

[0257] Reverse matching: Scripts that do not contain dangerous functions / patterns

[0258] Boundary conditions: Dangerous functions appearing on multiple lines, in comments, or during string concatenation, etc.

[0259] 3. Verify the test results

[0260] Run command

[0261] cd / Users / yanrong / Documents / develop / X-Sec / sdk-agent /

[0262] source .venv / bin / activate

[0263] pytest sdk_output / security_analyzer / tests

[0264] Failure handling:

[0265] If the test case fails, please:

[0266] Check if the regular expression matches the expected pattern

[0267] Verify that the patch is applied correctly.

[0268] Adjust test cases or patch code

[0269] Output format

[0270] diff analysis results (outputting the complete {diff_result})

[0271] Code patch (outputs only in diff format)

[0272] Test cases (output Python test code only)

[0273] Verify the test results (output only the test results)

[0274] """

[0275] This allows for the generation of fourth input data based on the aforementioned fourth prompt word template, script detection tool code, and difference analysis results.

[0276] The fourth input data is fed into the second model for analysis. Based on the difference analysis, the content that needs to be updated in the script detection tool can be determined. This update must follow the original code logic of the script detection tool. Patch code is generated based on this code logic and used as the update information for the script detection tool. Test cases for the script testing tool and patch code can be generated and executed to test the tool and patch code, determining the corresponding test results. If a test case fails, the reason for the failure can be checked and the test case adjusted until it succeeds. The code patch, test cases, and verification test results can be used as update information for the script testing tool.

[0277] Based on the above embodiments, this application also provides a method for updating a script detection tool, such as... Figure 6 As shown:

[0278] Step 602: Monitor the script library and identify scripts that meet the extraction rules as target scripts.

[0279] Step 604: Run the target script and determine the script execution information of the target script.

[0280] Step 606: Obtain the first prompt word template for the prompt detection script.

[0281] Step 608: Assemble the target script, script execution information, and first prompt word template to generate the first input data.

[0282] Specifically, the target script is filled into the script variable parameters, the script running information is filled into the running variable parameters, and combined with the task prompts to generate the first input data.

[0283] Step 610: Input the first input data into at least one first model.

[0284] Step 612: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0285] Step 614: Generate at least one script detection result in a predetermined format.

[0286] Step 616: Obtain the fifth prompt word template to evaluate the processing results of different models, and generate the fifth input data based on the fifth prompt word template and at least one script detection result.

[0287] Step 618: Input the fifth input data into the third model for filtering processing, and output the filtered script detection results.

[0288] Step 620: Use the generated script detection tool to detect the target script and generate the corresponding tool detection results.

[0289] Step 622: Obtain a third prompt word template for analyzing differences, and generate third input data based on the third prompt word template, script detection results, and tool detection results.

[0290] Step 624: Input the third input data into the second model to analyze the differences and output the difference analysis results.

[0291] Step 626: Obtain the fourth prompt word template for prompting the script detection tool to update, and generate the fourth input data based on the fourth prompt word template, the difference analysis results, and the script detection tool.

[0292] Step 628: Input the fourth input data into the second model.

[0293] Step 630: Analyze the fourth input data using the second model to determine the patch code and test cases for the script testing tool, and perform tests on the script testing tool and patch code based on the test cases to determine the test results.

[0294] Step 632: Output the patch code, test cases, and test results as update information for the generated script detection tool.

[0295] Step 634: Update the generated script detection tool using the update information to obtain an updated script detection tool.

[0296] This enables the updating and testing of script detection tools. In this embodiment, after the script detection tool passes testing, it can be released, allowing users to use it to detect scripts. For example, the script detection tool can be released in a cloud computing system, so that scripts uploaded to the cloud computing system can be detected by the tool.

[0297] In this embodiment, a large language model is used to analyze newly added scripts in real time, generating a structured script detection tool, which is then converted into executable SDK code to achieve automatic rule iteration. This improves rule update efficiency, shortens the rule update cycle, and enables rapid response to new threats such as malicious script variants. Furthermore, the model identifies unseen privilege abuse scripts and incorporates them into the rule base, reducing the risk of false negatives.

[0298] It enables end-to-end automation, from listening for script update events, analyzing and detecting scripts using a large model, code generation, updates, automated testing, to version management. It significantly improves iteration efficiency, enhancing the iteration efficiency of script detection tools.

[0299] It should be noted that the embodiments of this application may involve the use of user data. In practical applications, user-specific personal data may be used in the scheme described herein within the scope permitted by applicable laws and regulations, provided that it complies with the applicable laws and regulations of the country (e.g., with the user's explicit consent, with the user being properly notified, etc.).

[0300] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0301] Based on the above embodiments, this embodiment also provides a device for generating detection tools, which can be applied to electronic devices such as server-side devices, for example... Figure 7 As shown, the device includes:

[0302] The script determination module 702 is used to determine script information, which includes the target script and script execution information.

[0303] The script detection module 704 is used to detect the target script by combining the script execution information and generate script detection results.

[0304] The tool generation module 706 is used to analyze the script detection results using the target model and generate a corresponding script detection tool.

[0305] In summary, the first model is used to detect the target script and its execution information, and then the first model is used to detect the target script in combination with the execution information to generate script detection results. Compared with using static script information to detect the script, the detection accuracy of the script execution is higher when combined with the execution context. The second model is then used to analyze the script detection results to generate a corresponding script detection tool. No manual coding is required, and the script detection tool automatically generated by the model is more efficient.

[0306] The script determination module is used to monitor the script library, determine scripts that meet the extraction rules as target scripts, run the target scripts, and determine the script execution information of the target scripts.

[0307] The script detection module is used to combine the script execution information and use the target script of the first model to perform detection and generate script detection results.

[0308] The script detection module is used to generate first input data based on the script execution information and the target script, input the first input data into at least one first model for detection, and output at least one script detection result.

[0309] The script detection module is used to obtain a first prompt word template for prompting the script for detection; and to assemble the target script, script execution information and the first prompt word template to generate first input data.

[0310] The first prompt word template includes: task prompt information for the script detection task, script variable parameters, and runtime variable parameters; the script detection module is used to fill the target script into the script variable parameters, fill the script runtime information into the runtime variable parameters, and combine them with the task prompt information to generate the first input data.

[0311] The script detection module is used to input the first input data into at least one first model; the first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; and generates at least one script detection result in a predetermined format.

[0312] The tool generation module is used to obtain a second prompt word template for prompting the generation of a script detection tool; generate second input data based on the second prompt word template and the script detection results; input the second input data into a second model for analysis; and output the corresponding script detection tool.

[0313] The tool generation module is further configured to: use the generated script detection tool to detect the target script and generate corresponding tool detection results; obtain a third prompt word template for suggesting differences analysis, and generate third input data based on the third prompt word template, script detection results, and tool detection results; input the third input data into a second model to analyze differences and output difference analysis results; obtain a fourth prompt word template for suggesting updates to the script detection tool, and generate fourth input data based on the fourth prompt word template, difference analysis results, and script detection tool; input the fourth input data into the second model and output update information for the generated script detection tool; and use the update information to update the generated script detection tool to obtain an updated script detection tool.

[0314] The tool generation module is further configured to generate test cases for the script detection tool based on the second model, so as to test the script detection tool based on the test cases.

[0315] The script detection module is used to analyze the at least one script detection result and filter the script detection results used to generate the script detection tool.

[0316] The script detection module is used to obtain a fifth prompt word template for prompting evaluation of the processing results of different models; based on the fifth prompt word template and at least one script detection result, generate fifth input data; input the fifth input data into the third model for filtering processing, and output the filtered script detection results.

[0317] In this embodiment, a large language model is used to analyze newly added scripts in real time, generating a structured script detection tool, which is then converted into executable SDK code to achieve automatic rule iteration. This improves rule update efficiency, shortens the rule update cycle, and enables rapid response to new threats such as malicious script variants. Furthermore, the model identifies unseen privilege abuse scripts and incorporates them into the rule base, reducing the risk of false negatives.

[0318] It enables end-to-end automation, from listening for script update events, analyzing and detecting scripts using a large model, code generation, updates, automated testing, to version management. It significantly improves iteration efficiency, enhancing the iteration efficiency of script detection tools.

[0319] This application also provides a non-volatile readable storage medium storing one or more modules (programs). When these modules are applied to a device, they enable the device to execute the instructions for the method steps in this application.

[0320] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods described in this application.

[0321] This application also provides an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in this application embodiment. In this application embodiment, the electronic device includes devices such as servers and terminal devices.

[0322] This application also discloses a computer program product, including a computer program / computer executable instructions, wherein the computer program / computer executable instructions, when executed by a processor in an electronic device, implement the method described in this application.

[0323] Embodiments of this disclosure can be implemented as an apparatus with any suitable hardware, firmware, software, or any combination thereof, configured as desired, and the apparatus may include electronic devices such as servers (clusters) and terminals. Figure 8 An exemplary apparatus 800 is schematically shown that can be used to implement the various embodiments described in this application.

[0324] In one embodiment, Figure 8 An exemplary device 800 is shown, which includes one or more processors 802, a control module (chipset) 804 coupled to at least one of the processors 802, a memory 806 coupled to the control module 804, a non-volatile memory (NVM) / storage device 808 coupled to the control module 804, one or more input / output devices 810 coupled to the control module 804, and a network interface 812 coupled to the control module 804.

[0325] Processor 802 may include one or more single-core or multi-core processors, and processor 802 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, device 800 can serve as a server, terminal, or other device as described in the embodiments of this application.

[0326] In some embodiments, apparatus 800 may include one or more computer-readable media (e.g., memory 806 or NVM / storage device 808) having instructions 814 and one or more processors 802 that are combined with the one or more computer-readable media and configured to execute the instructions 814 to implement the module and thus perform the actions described in this disclosure.

[0327] In one embodiment, the control module 804 may include any suitable interface controller to provide any suitable interface to at least one of the processors 802 and / or any suitable device or component communicating with the control module 804.

[0328] The control module 804 may include a memory controller module to provide an interface to the memory 806. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0329] Memory 806 may be used, for example, to load and store data and / or instructions 814 for device 800. In one embodiment, memory 806 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, memory 806 may include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

[0330] In one embodiment, the control module 804 may include one or more input / output controllers to provide an interface to the NVM / storage device 808 and (one or more) input / output devices 810.

[0331] For example, NVM / storage device 808 may be used to store data and / or instructions 814. NVM / storage device 808 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more optical disc drives (CDs), and / or one or more digital universal optical disc (DVD) drives).

[0332] NVM / storage device 808 may include storage resources that are part of a device on which device 800 is mounted, or that are accessible to the device but do not necessarily have to be part of the device. For example, NVM / storage device 808 may be accessed via a network through one or more input / output devices 810.

[0333] One or more input / output devices 810 may provide an interface for device 800 to communicate with any other suitable device. Input / output devices 810 may include communication components, audio components, sensor components, etc. A network interface 812 may provide an interface for device 800 to communicate via one or more networks. Device 800 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, such as accessing a wireless network based on communication standards, such as Bluetooth, WiFi, 2G, 3G, 4G, 5G, 6G, etc., or combinations thereof.

[0334] In one embodiment, at least one of the processors 802 may be logically packaged with one or more controllers (e.g., memory controller modules) of the control module 804. In one embodiment, at least one of the processors 802 may be logically packaged with one or more controllers of the control module 804 to form a system-in-package (SiP). In one embodiment, at least one of the processors 802 may be integrated with the logic of one or more controllers of the control module 804 on the same die. In one embodiment, at least one of the processors 802 may be integrated with the logic of one or more controllers of the control module 804 on the same die to form a system-on-a-chip (SoC).

[0335] In various embodiments, device 800 may be, but is not limited to, a server, desktop computing device, or mobile computing device (e.g., laptop, handheld computing device, tablet, netbook, etc.). In various embodiments, device 800 may have more or fewer components and / or different architectures. For example, in some embodiments, device 800 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0336] The detection device can use a main control chip as a processor or control module, and sensor data, position information, etc. can be stored in a memory or NVM / storage device. The sensor group can be used as an input / output device, and the communication interface can include a network interface.

[0337] This application also provides an electronic device, including: a processor; and a memory storing executable code thereon. When the executable code is executed, the processor performs one or more methods as described in this application embodiment. In this application embodiment, the memory can store various types of data, such as target files, file-application association data, and user behavior data, thereby providing a data foundation for various processing operations.

[0338] This application also provides one or more machine-readable media having executable code stored thereon, which, when executed, causes a processor to perform one or more of the methods described in this application.

[0339] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0340] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0341] This application describes embodiments with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0342] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0343] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0344] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0345] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0346] The foregoing has provided a detailed description of a method for generating a detection tool, an electronic device, a computer-readable storage medium, and a computer program product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for generating a detection tool, wherein, The method includes: Determine the script information, which includes the target script and script execution information; The target script is detected by combining the script execution information, and a script detection result is generated; The target model is used to analyze the script detection results, and a corresponding script detection tool is generated. When the target script is detected, the first model and the script detection tool are used to detect the target script by combining the script execution information, and the corresponding script detection results and tool detection results are obtained. The script detection tool is updated by analyzing the differences between the script detection results output by the first model and the tool detection results output by the script detection tool using the second model.

2. The method according to claim 1, wherein, The determined script information includes: Monitor the script library and identify scripts that match the extraction rules as target scripts; Run the target script and determine the script execution information of the target script.

3. The method according to claim 1, wherein, The step of detecting the target script by combining the script execution information and generating script detection results includes: Based on the script execution information, the first model is used to detect the target script and generate script detection results.

4. The method according to claim 3, wherein, The step of combining the script execution information and using the first model to detect the target script and generate script detection results includes: Based on the script execution information and the target script, first input data is generated, and the first input data is input into at least one first model for detection, and at least one script detection result is output.

5. The method according to claim 4, wherein, Based on the script execution information and the target script, the first input data is generated, including: Obtain the first prompt word template for the prompt detection script; The target script, script execution information, and first prompt word template are assembled to generate the first input data.

6. The method according to claim 5, wherein, The first prompt word template includes: task prompt information for the script detection task, script variable parameters, and runtime variable parameters; The step of assembling the target script, script execution information, and first prompt word template to generate first input data includes: The target script is filled into the script variable parameters, the script execution information is filled into the execution variable parameters, and combined with the task prompt information to generate the first input data.

7. The method according to claim 4, wherein, The step of inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: The first input data is input into at least one first model; The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; Generate at least one script detection result in a predetermined format.

8. The method according to claim 1, wherein, The target model is a second model. The process of analyzing the script detection results using the target model to generate a corresponding script detection tool includes: Obtain the second prompt word template for the prompt generation script detection tool; Based on the second prompt word template and the script detection results, generate the second input data; The second input data is fed into the second model for analysis, and the corresponding script detection tool is output.

9. The method according to claim 1, wherein, The step of analyzing the difference between the script detection results output by the first model and the tool detection results output by the script detection tool using the second model, and updating the script detection tool, includes: Obtain a third prompt word template for analyzing differences, and generate third input data based on the third prompt word template, script detection results, and tool detection results; The third input data is input into the second model to analyze the differences, and the difference analysis results are output. Obtain a fourth prompt word template for prompting the update of the script detection tool, and generate fourth input data based on the fourth prompt word template, the difference analysis results, and the generated script detection tool; The fourth input data is input into the second model, and the updated information of the generated script detection tool is output. The generated script detection tool is updated using the updated information to obtain an updated script detection tool.

10. The method according to claim 8 or 9, wherein, Also includes: Test cases for the script detection tool are generated based on the second model, so that the script detection tool can be tested based on the test cases.

11. The method according to claim 4, wherein, Also includes: The script detection results of at least one script are analyzed, and the script detection results used to generate the script detection tool are selected.

12. The method according to claim 11, wherein, The step of analyzing the at least one script detection result and filtering the script detection results used to generate the script detection tool includes: Obtain a fifth prompt word template for evaluating the results of different model processing; Based on the fifth prompt word template and at least one script detection result, the fifth input data is generated; The fifth input data is input into the third model for filtering, and the filtered script detection results are output.

13. An electronic device, wherein, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-12.

14. A computer-readable storage medium, wherein, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-12.

15. A computer program product comprising a computer program / computer-executable instructions, wherein, When the computer program / computer-executable instructions are executed by a processor in an electronic device, the method of any one of claims 1-12 is implemented.

Images