Closed-loop method for calling trusted tool to guard

Abstract

The invention discloses a trusted tool calling guarding closed-loop method, and belongs to the technical field of penetration testing, the trusted tool calling guarding closed-loop method helps a tool calling model to generate a more reasonable initial instruction through similarity matching, the accuracy and applicability of instruction generation are improved, an interactive instruction approval step can prevent error instruction execution from the source, and the accuracy and applicability of instruction generation are improved. According to the method, the safety and the stability of the tool execution process are guaranteed, penetration test faults caused by wrong instructions are effectively avoided, traceability and interpretability of the execution process are achieved through the instruction chain, subsequent analysis and troubleshooting of the penetration test process are facilitated, the preference instruction storage step is further set, and the method is easy to implement. The model can continuously learn expert experience, progressive optimization of parameter configuration and decision consistency enhancement are achieved, the accuracy of subsequent instruction generation is improved, on the whole, the stability, safety and reliability of a penetration system are comprehensively improved, and it is ensured that penetration testing can be efficiently and smoothly carried out.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of penetration testing, and particularly relates to a trusted tool invocation daemon closed loop method. BACKGROUND

[0002] In the process of penetration testing, a single incorrect instruction can cause serious consequences of the whole attack and defense link failure. The tool invocation mode of the traditional penetration testing system lacks perfect constraint and guarantee process, and it is difficult to deal with this high-risk problem. For example, the instruction generated by the tool invocation model may be directly executed, and if the instruction has errors or risks, it will have a great impact on the whole penetration testing. The executed instruction lacks an effective traceability mechanism, and it is difficult to troubleshoot the cause when a problem occurs. At the same time, there is no effective method to learn from the revision experience of experts to optimize the generation of subsequent instructions.

[0003] These problems greatly reduce the stability, security and reliability of penetration testing, and therefore, a systematic method is urgently needed to solve the above problems. SUMMARY

[0004] To solve the problems in the background art, the application provides a trusted tool invocation daemon closed loop method to solve the problems that incorrect instructions in the traditional tool invocation mode can cause whole link failure, it is difficult to troubleshoot the cause when a problem occurs, and there is no effective method to learn from the revision experience of experts to optimize the generation of subsequent instructions.

[0005] To achieve the above purpose, the application provides the following technical scheme: A trusted tool invocation daemon closed loop method, comprising the following steps: S1: processing the current penetration scenario context by a compression model and generating a context vector, and obtaining tool invocation instructions of a historical similar scenario from a vector database based on vector similarity matching; S2: a tool invocation model generates tool instructions for the current penetration scenario in combination with the tool invocation instructions, and sends the generated tool instructions to an expert for review. The expert makes a selection of confirming execution, modifying parameters and executing, or rejecting execution on the tool instructions. The penetration testing system performs corresponding operations according to the selection of the expert; S3: for the tool instructions of confirming execution, modifying parameters and executing, recording the content of the tool instructions and the corresponding penetration scenario according to the execution timestamp, and storing them into an instruction log database to form a traceable tool instruction chain. The tool instructions of modifying parameters and executing are used as preferred instructions. The semantic compression module extracts key information related to instruction modification from the recorded penetration scenario, converts the extracted key information into a vector key, and stores the vector key in association with the modified preferred instructions in the vector database for optimizing the generation of subsequent tool instructions.

[0006] Preferably, in S1, the vector similarity matching is to calculate the cosine similarity of the current penetration scenario context vector and the historical scene context vector, and when the cosine similarity is greater than a preset threshold, it is determined that the historical similar scene.

[0007] Preferably, in S1, the current penetration scenario context includes historical inquiries, executed tool chains and real-time attack targets, and the generated context vector is used as a retrieval key, and the preferred instructions matched in the vector database are added to the prompt words for tool calling model reference.

[0008] Preferably, in S2, the tool calling model is ToolCalling model, and the expert returns an approval signal to the tool calling model when confirming execution, returns the modified instruction when modifying the parameter, and returns a blocking signal when refusing execution.

[0009] Preferably, in S3, each record of the tool instruction chain contains a unique identifier, which is associated with the execution timestamp of the corresponding tool instruction.

[0010] Preferably, in S3, the key information is converted into a vector key by an embedding model based on a Transformer architecture, and a pair of <scene semantics-preferred instructions> is formed with the preferred instructions and stored in the vector database.

[0011] Preferably, in S3, the semantic compression module filters out information logically associated with instruction modification as key information through a correlation algorithm, and the key information includes historical inquiry information, executed tool chain information and real-time attack target information.

[0012] Preferably, the trusted tool calling daemon closed loop method further includes a rollback mechanism: when an exception occurs in the tool calling process and needs to be rolled back, the rollback component extracts the instruction sequence of the current penetration session from the instruction log database formed by S3 according to the timestamp, and reloads all instructions in chronological order, skips the erroneous instruction and the previous instruction of the rollback instruction during reloading, and restores to the stable state before the error occurs.

[0013] Preferably, the reloading process does not enter the expert review link, and the rollback component directly drives the tool module to execute to shorten the recovery time.

[0014] Preferably, during the reloading process, the rollback process log is recorded.

[0015] Compared with the prior art, the present application has the following advantages: This application utilizes similarity matching to help the tool call the model to generate more reasonable initial instructions, improving the accuracy and applicability of instruction generation. The interactive instruction approval process can prevent the execution of erroneous instructions from the source, ensuring the security and stability of the tool's execution process and effectively avoiding penetration testing failures caused by incorrect instructions. Furthermore, the instruction chain enables the traceability and interpretability of the execution process, facilitating subsequent analysis and troubleshooting of the penetration testing process. This application also includes a preferred instruction storage step, allowing the model to continuously learn from expert experience, achieving incremental optimization of parameter configuration and enhanced decision consistency, thereby improving the accuracy of subsequent instruction generation. Overall, this application comprehensively improves the stability, security, and reliability of the penetration testing system, ensuring that penetration testing can be conducted efficiently and smoothly. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the process of this application. Detailed Implementation

[0017] To facilitate understanding of the technical content of this invention by those skilled in the art, the invention will be further described in detail below with reference to the accompanying drawings and specific examples. It should be understood that the specific examples described herein are merely illustrative and not intended to limit the scope of the invention.

[0018] Example 1: like Figure 1 As shown, a trusted tool invoking a daemon closed-loop method includes the following steps: S1: The current penetration scenario context includes previous inquiry records of the system, executed port scanning toolchains, and the IP address of the real-time attack target. The compression model processes this context information to generate a context vector, calculates the cosine similarity between the context vector and the historical scenario context vector in the vector database, and when the similarity is greater than a preset threshold, it obtains the corresponding user preference instructions under the historical similar scenarios and adds them to the prompt words for the ToolCalling model to refer to. If no instructions are found, the model generates them. S2: The ToolCalling model generates tool instructions for current network system vulnerability detection based on the obtained historical instructions, such as using a certain vulnerability scanning tool to scan a certain port of the target IP, etc. The tool instructions are displayed to the expert through the front-end interface. The expert reviews and believes that the instruction meets the intention, clicks to confirm execution, and the front-end returns the approval signal to the system. When the tool is correct, but the parameters need to be modified due to potential risks, for example, the scan port is modified, the expert clicks to modify and inputs the correct instruction parameters on the front-end, and the front-end returns the modified signal and the modified instruction to the system. When the model-generated tool instruction has serious risks or does not meet the expectations of the expert, the expert can click to refuse execution, and this signal will be returned to the system by the front-end to prevent the execution of the instruction; S3: The system records the instruction content, execution time, and corresponding penetration scene information according to the execution timestamp, and stores it in the instruction log database to form a record of the tool instruction chain, which contains a unique identifier associated with the execution timestamp. Among them, the tool instruction with modified parameters and execution is the preferred instruction. The semantic compression module extracts key information such as target IP, vulnerability detection scene, and modified port from the penetration scene recorded in the instruction log database, eliminates irrelevant information such as abnormal echo, selects information related to port modification through correlation algorithm, and converts it into a vector key through a special embedding model based on the Transformer architecture. Store in the vector database to form a pair of 〈scene semantics - preferred instruction〉; If an exception occurs during tool execution, such as scan tool crash, rollback is needed, enter the instruction rollback branch process: The rollback component receives the rollback instruction, extracts the instruction sequence of the current penetration session from the instruction log database according to the timestamp, assuming the sequence is instruction A (port scanning), instruction B (vulnerability detection), and instruction B is the error instruction. The rollback component reloads and skips the error instruction and the previous instruction of the rollback instruction, directly drives the tool module to execute instruction A, quickly recovers to the stable state before instruction B execution, and records the rollback process log stored in the instruction log database.

[0019] In the embodiment, the application generates more reasonable initial instructions by similarity matching help tool calling model, improves the accuracy and applicability of instruction generation, the interactive instruction approval step can prevent the execution of incorrect instructions from the source, ensures the safety and stability of the tool execution process, effectively avoids the penetration test failure caused by incorrect instructions, and the instruction chain realizes the traceability and explainability of the execution process, which is convenient for subsequent analysis and troubleshooting of the penetration test process, the application also sets the preference instruction storage step, so that the model can continuously learn the experience of experts, realizes the progressive optimization of parameter configuration and the enhancement of decision consistency, improves the accuracy of subsequent instruction generation, and overall, the application improves the stability, safety and reliability of the penetration system, ensures that the penetration test can be carried out efficiently and smoothly.

[0020] The above merely describes the preferred embodiments of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A trusted tool invocation daemon loop method, characterized by, The method comprises the following steps: S1: processing the current penetration scenario context through a compression model and generating a context vector, and obtaining the tool call instructions of the historical similar scenarios from the vector database based on vector similarity matching; S2: the tool calling model generates tool instructions for the current penetration scenario in combination with the tool calling instructions, and sends the generated tool instructions to experts for review, and the experts make a selection of confirming execution, modifying parameters and executing, or rejecting execution, and the penetration testing system executes the corresponding operation according to the selection of the experts; S3: for the tool instructions of confirming execution, modifying parameters and executing, record the content of the tool instructions and the corresponding penetration scene according to the execution timestamp, and store them into the instruction log database to form a traceable tool instruction chain, wherein the tool instructions of modifying parameters and executing are used as preferred instructions, the key information related to instruction modification is extracted from the recorded penetration scene through a semantic compression module, the extracted key information is converted into a vector key, and the vector key is associated with the modified preferred instruction and stored in the vector database for optimizing the generation of subsequent tool instructions.

2. The trusted tool invocation daemon loop method of claim 1, wherein, In S1, the vector similarity matching is to calculate the cosine similarity of the current penetration scenario context vector and the historical scenario context vector, and when the cosine similarity is greater than a preset threshold, it is determined that it is a historical similar scenario.

3. The trusted tool invocation daemon loop method of claim 2, wherein, In S1, the current penetration scenario context includes historical inquiries, executed tool chains and real-time attack targets, the generated context vector is used as a retrieval key, and the preferred instructions matched in the vector database are added to the prompt words for the tool calling model to refer to.

4. The trusted tool invocation daemon loop method of claim 3, wherein, In S2, the tool calling model is a ToolCalling model, the expert returns an approval signal to the tool calling model when confirming execution, returns the modified instruction when modifying parameters, and returns a blocking signal when rejecting execution.

5. The trusted tool invocation daemon loop method of claim 1, wherein, In S3, each record of the tool instruction chain contains a unique identifier, which is associated with the execution timestamp of the corresponding tool instruction.

6. The trusted tool invocation daemon loop method of claim 1, wherein, In S3, the key information is converted into a vector key by an embedding model based on the Transformer architecture, and a pair of <scene semantics-preferred instruction> is stored in the vector database.

7. The trusted tool invocation daemon loop method of claim 6, wherein, In S3, the semantic compression module filters out information logically associated with instruction modification as key information through a correlation algorithm, and the key information includes historical inquiry information, executed tool chain information and real-time attack target information.

8. The trusted tool invocation daemon loop method of claim 1, wherein, The trusted tool calling daemon closed loop method further comprises a rollback mechanism: when an exception occurs in the tool calling process and needs to be rolled back, the rollback component extracts the instruction sequence of the current penetration session from the instruction log database formed in S3 according to the timestamp, and reloads all instructions in chronological order, skips the erroneous instruction and the previous instruction of the rollback instruction during reloading, and restores to the stable state before the error occurs.

9. The trusted tool invocation daemon loop method of claim 8, wherein, The reloading process does not enter the expert review link, and the tool module is directly driven by the rollback component to execute in order to shorten the recovery time.

10. The trusted tool invocation daemon loop method of claim 9, wherein, During the reloading process, the rollback process log is recorded.

Images