Method for generating a vulnerability sample based on self-consistent interpretation of damage

Abstract

The application relates to the technical field of network security and artificial intelligence, and specifically discloses a damage vulnerability sample generation method based on self-consistent explanation, which first extracts damage scene features from multi-source situation data, maps the features into a structured thinking chain of syllogistic logical reasoning of a forced large model according to vulnerability principle-triggering condition-damage consequence, generates codes after establishing a complete cause-effect chain from the source constraint model, and avoids statistical probability-driven shallow imitation. Subsequently, the generated code segments and mechanism assertion texts are respectively subjected to static topology reverse deduction and semantic coding, cross self-consistency verification is realized by calculating cosine similarity, and false defect samples are filtered. Further, an attack chain cascading dependence graph and link propagation enhancement scoring are introduced, the cause-effect conduction relationship among samples is brought into evaluation, false rejection of attack chain bridging nodes and false retention of logically contradictory samples are avoided, and finally a high-fidelity vulnerability sample library that can be used for multi-level damage scene testing in an industrial field is generated.

Description

Technical Field

[0001] This application relates to the fields of cybersecurity and artificial intelligence, and more specifically, to a method for generating destructive vulnerability samples based on self-consistent interpretation. Background Technology

[0002] With the deepening of the digital transformation of power industry control systems, cybersecurity threats are becoming increasingly complex and varied. Traditional passive defense models based on known vulnerability signature databases are no longer sufficient to cope with new attack methods. To effectively improve the proactive defense capabilities of power systems, it is urgent to build a high-fidelity destructive vulnerability sample library covering diverse attack scenarios. This library would support the training and optimization of vulnerability detection models, the verification and exercise of security protection strategies, and the continuous improvement of offensive and defensive capabilities. However, existing vulnerability samples mainly rely on manual discovery and the accumulation of historical attack events. The sample acquisition cycle is long, costly, and has limited coverage, making it difficult to meet the rapidly iterating security protection needs of power systems.

[0003] In recent years, with the rapid development of large language model technology, researchers have begun to explore using generative artificial intelligence techniques to automatically generate vulnerability code samples to expand training sets. Existing methods typically rely on single-dimensional vulnerability feature descriptions or simple prompt word engineering to drive large models for code generation. However, these methods generally suffer from a fundamental flaw: the generated samples are superficially similar but lack the underlying essence. Specifically, while the autoregressive generation mechanism based on statistical probability can mimic the surface syntactic structure of vulnerability code, it lacks a deep understanding of the rigorous causal chain between vulnerability triggering mechanisms, execution paths, and destructive consequences. The generated vulnerability samples often exhibit logical gaps between the pre-triggered conditions, the vulnerability's underlying principles, and the final destructive manifestations. This results in syntactically correct code that fails to reproduce the expected destructive effects in real-world industrial environments, producing a large number of pseudo-vulnerability samples that are difficult to use for practical defense. More seriously, existing methods treat each candidate sample as an isolated entity for independent evaluation, completely ignoring the objective law that vulnerability exploitation in power industry control systems often relies on the cascading propagation of multi-level attack chains. This may result in the erroneous discarding of intermediate bridging nodes in the attack chain, leading to missed detections, or the retention of logically contradictory samples, causing misjudgments. This severely restricts the practical application value of the generated sample library.

[0004] Therefore, an optimized scheme for generating destructive vulnerability samples is desired. Summary of the Invention

[0005] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a method for generating destructive vulnerability samples based on self-consistent interpretation, comprising: S1. Entity extraction and scenario association network construction are performed on the situational data stream containing device system log text, industrial vulnerability test scripts and device crash memory snapshots to obtain the damage scenario matrix. S2. By using structured thinking chain prompt templates and word embedding models, multi-dimensional causal logic constraint mapping and tensor space encoding are performed on the vulnerability meta-information and equipment environment attributes in the damage scenario matrix to obtain a self-consistent prompt tensor set. S3. Based on the vertical domain large language model, the self-consistent prompt tensor set is decoded and generated in a controlled manner and the vulnerability modality is segmented. The obtained source code fragments are then paired with the corresponding mechanism assertion text key value binding relationship to obtain a candidate vulnerability sample set. S4. Perform multimodal attribute graph self-consistency reverse verification on the candidate vulnerability sample set to obtain the verification vulnerability sample set; S5. Reshape and encapsulate the vulnerability sample set into a multi-dimensional vulnerability feature library to obtain a vulnerability sample library.

[0006] Compared with existing technologies, this application proposes a method for generating destructive vulnerability samples based on self-consistent interpretation. First, it extracts destructive scenario features from multi-source situational data such as power system equipment logs, vulnerability scripts, and memory snapshots. These features are then mapped to a structured thought chain prompt that forces a large model to reason according to a syllogistic logic of vulnerability principle-triggering condition-destructive consequence. This constrains the model from the source to establish a complete causal deductive chain before code generation, avoiding shallow imitation driven by statistical probability. Subsequently, the method performs static topological inversion and semantic vectorization encoding on the generated source code fragments and their accompanying mechanism assertion texts, respectively. Cross-self-consistency verification is achieved by calculating the cosine similarity between the two in high-dimensional space, effectively filtering out false defect samples generated by the illusion of a large model. Furthermore, the method introduces an attack chain cascade dependency graph construction and link propagation enhancement scoring mechanism, incorporating the causal transmission relationship between samples into the evaluation dimension. This avoids missed judgments caused by erroneously discarding attack chain bridging nodes and prevents misjudgments caused by retaining logically contradictory samples. Finally, it generates a high-fidelity vulnerability sample library that can be directly used for multi-level destructive scenario cascade testing in industrial settings. Attached Figure Description

[0007] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0008] Figure 1 This is a flowchart of a method for generating destructive vulnerability samples based on self-consistent interpretation according to an embodiment of this application; Figure 2 This is a schematic diagram of data flow for a destructive vulnerability sample generation method based on self-consistent interpretation according to an embodiment of this application; Figure 3 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistent interpretation according to an embodiment of this application. The method involves using a structured thought chain prompt template and a word embedding model to perform multi-dimensional causal logic constraint mapping and tensor space encoding on vulnerability metadata and device environment attributes in a damage scenario matrix to obtain a self-consistent prompt tensor set. Figure 4 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistent interpretation according to an embodiment of this application. The method is based on a large language model in a vertical domain, and involves controlled decoding and generation of a self-consistent hint tensor set and vulnerability modality segmentation. The resulting source code fragments are then paired and encapsulated with the corresponding mechanism assertion text key value binding relationships to obtain a candidate vulnerability sample set. Figure 5 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistency interpretation according to an embodiment of this application, which involves performing multimodal attribute graph self-consistency reverse verification on a candidate vulnerability sample set to obtain a verification vulnerability sample set. Figure 6 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistency interpretation according to an embodiment of this application. The method involves calculating the cross-consistency of code semantic vectors and assertion text vectors, and filtering out logically inconsistent candidate samples based on a preset confidence threshold to obtain a set of verification vulnerability samples. Detailed Implementation

[0009] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0010] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0011] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0012] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0013] Existing vulnerability sample generation methods based on large language models suffer from a severe disconnect between code semantics and damage logic. The generated samples lack a causal chain between pre-triggered conditions, vulnerability occurrence principles, and final damage manifestations, failing to reproduce attack effects in real-world industrial environments and resulting in numerous false vulnerability samples. Furthermore, they treat samples as isolated entities for evaluation, ignoring the cascading nature of vulnerability exploitation through multi-level attack chains, leading to missed and false positives. Therefore, this application proposes a damage vulnerability sample generation method based on self-consistent interpretation. This method first extracts damage scenario features from multi-source situational data, constructs a scenario association network using named entity recognition algorithms, and quantifies it into a damage scenario matrix. This matrix is ​​then mapped to a structured thought chain that forces a large model to perform syllogistic logical reasoning based on vulnerability principle – triggering conditions – damage consequences. This constrains the model from the source to establish a complete causal chain before generating code, avoiding shallow imitation driven by statistical probability. Based on this, controlled decoding generation is performed using a vertical domain large language model, and source code fragments are paired with mechanism assertion text key-value bindings for encapsulation, ensuring that each candidate sample simultaneously contains an executable payload and a logical explanation. To ensure sample quality, the solution utilizes a code attribute graph static analysis tool to perform topological inversion on the source code to obtain code semantic vectors, and performs semantic encoding on the mechanism assertion text to obtain assertion text vectors. Cross-consistency verification is achieved by calculating cosine similarity, filtering out false defect samples. More importantly, the solution introduces an attack chain cascading dependency graph and a link propagation enhancement scoring mechanism, incorporating causal transmission relationships between samples into the evaluation. Scoring is corrected by aggregating upstream node link support information, avoiding the erroneous rejection of attack chain bridging nodes and the misjudgment of logically contradictory samples. Ultimately, this generates a high-fidelity vulnerability sample library that can be used for multi-level damage scenario testing in industrial settings.

[0014] Figure 1 This is a flowchart of a destructive vulnerability sample generation method based on self-consistent interpretation according to an embodiment of this application. Figure 2 This is a schematic diagram of data flow for a destructive vulnerability sample generation method based on self-consistent interpretation according to an embodiment of this application. Figure 1 and Figure 2As shown, an embodiment of this application provides a method for generating destructive vulnerability samples based on self-consistent interpretation, comprising: S1, performing entity extraction and scenario association network construction on a situational data stream containing device system log text, industrial vulnerability test scripts, and device crash memory snapshots to obtain a destructive scenario matrix; S2, using structured thought chain prompt templates and word embedding models, performing multi-dimensional causal logic constraint mapping and tensor space encoding on vulnerability metadata and device environment attributes in the destructive scenario matrix to obtain a self-consistent prompt tensor set; S3, based on a vertical domain large language model, performing controlled decoding generation and vulnerability modality segmentation on the self-consistent prompt tensor set, and pairwise encapsulating the obtained source code fragments with corresponding mechanism assertion text key value binding relationships to obtain a candidate vulnerability sample set; S4, performing multi-modal attribute graph self-consistency reverse verification on the candidate vulnerability sample set to obtain a verification vulnerability sample set; S5, performing multi-dimensional vulnerability feature library reshaping and closed-loop encapsulation on the verification vulnerability sample set to obtain a vulnerability sample library.

[0015] Specifically, in step S1, entity extraction and scenario association network construction are performed on the situational data stream containing device system log text, industrial vulnerability test scripts, and device crash memory snapshots to obtain a damage scenario matrix. It should be noted that the original situational data generated by the power industry control system contains multi-source heterogeneous information such as device system log text, industrial vulnerability test scripts, and device crash memory snapshots, and is mixed with interference information such as disordered heartbeat characters and non-aggressive background noise. Directly using this data for subsequent analysis will lead to a decrease in feature extraction accuracy. Therefore, the technical solution of this application first performs entity extraction and scenario association network construction on the situational data stream. Through the above processing, key entities such as port configuration, protocol field features, and memory out-of-bounds ranges can be extracted from the multi-source heterogeneous data. Furthermore, a damage scenario matrix is ​​constructed by quantifying the temporal and semantic relationships between entities, providing accurate domain feature input for the subsequent construction of a structured thought chain.

[0016] More specifically, in a specific example of this application, a situational data stream containing power SCADA system operation logs, Modbus protocol vulnerability test scripts, and memory snapshot data when a relay protection device crashes is received. A data diversion gateway is invoked to extract data of different modalities by identifying the file type identifier in the packet header. Then, a regular expression engine is used to match and remove periodic heartbeat packet records in the logs and comment lines in the test scripts. The retained valid data is serialized using UTF-8 encoding format to obtain a clean heterogeneous text set. The text set was input in batches into a pre-trained Named Entity Recognition (NAME) model for the power safety domain based on the Transformer architecture. After the bidirectional encoder layer of this model extracts the contextual representations of the lexical units, a conditional random field layer is used to calculate the joint probability distribution of the lexical sequence. This forcibly extracts key object nodes representing port configurations (e.g., port 502), protocol field features (e.g., function code 0x06), and memory out-of-bounds ranges (e.g., offset 0x7FFF). Simultaneously, the global semantic representation vector corresponding to each entity is extracted from the model's hidden layer. A hash mapping is used to bind entity nodes to their semantic vectors, forming a multi-dimensional entity feature set containing entity identifiers and numerical features. Using each entity object in this feature set as a network node, an undirected fully connected graph is constructed. For any two nodes in the graph, the absolute value of the difference between their timestamps (triggered or recorded in the original system) is extracted. and their respective bound global semantic representation vectors and Through calculation formula Quantify the damage correlation weight between two nodes, where The linear fusion weighting coefficients are used to adjust the emphasis ratio between temporal and semantic features. To characterize the proximity correlation of time series using a time decay function. For decay rate hyperparameter, To characterize the deep semantic relevance of cosine similarity, the association weights of all node pairs are calculated by traversing the graph and then the edge weights in the fully connected graph are extracted into a two-dimensional matrix to obtain the damage scenario matrix.

[0017] Specifically, in step S2, a self-consistent hint tensor set is obtained by performing multi-dimensional causal logic constraint mapping and tensor space encoding on the vulnerability metadata and device environment attributes in the damage scenario matrix through a structured thought chain hint template and word embedding model. It should be noted that, given that the damage scenario matrix quantifies the relationships between entities but still exists in the form of a discrete numerical matrix, large language models cannot directly understand the vulnerability metadata and device environment attributes contained therein, such as port exposure surfaces, network topology levels, industrial protocol types, and memory out-of-bounds characteristics. Furthermore, existing large models, based on statistical probability-based autoregressive generation mechanisms, lack a deep understanding of the rigorous causal chain between vulnerability triggering mechanisms, execution paths, and damage consequences. Direct input will lead to logical gaps between the generated samples and the pre-triggered conditions, vulnerability occurrence principles, and final damage manifestations. Therefore, the technical solution of this application further uses a structured thought chain hint template and word embedding model to perform multi-dimensional causal logic constraint mapping and tensor space encoding on the vulnerability metadata and device environment attributes in the damage scenario matrix. Through the above processing, the discrete features in the matrix can be transformed into structured natural language instructions that force the large model to reason according to the syllogistic logic of the underlying principle of the vulnerability, the boundary triggering conditions and the consequences of equipment damage. These instructions are then encoded into tensor space representations by word embedding and positional encoding superimposed with logical role perception vectors. This constrains the model to establish a complete causal deductive chain before generating code, effectively avoiding shallow imitation behavior driven by statistical probability.

[0018] Figure 3 This document describes a method for generating destructive vulnerability samples based on self-consistent interpretation, according to an embodiment of this application. It involves using a structured thought chain hint template and a word embedding model to perform multi-dimensional causal logic constraint mapping and tensor space encoding on vulnerability metadata and device environment attributes in a damage scenario matrix to obtain a self-consistent hint tensor set. (See flowchart for example.) Figure 3 As shown, step S2 includes: S21, using the text feature matching component to read out information slices and replace placeholder slots in the damage scenario matrix to obtain a filling template; S22, based on the preset three-part logical deduction rules, performing deduction timing guidance and text layer splicing and fusion on the filling template to obtain a structured thought chain; S23, performing discrete word serialization and feature space superposition transformation on the structured thought chain to obtain a self-consistent prompt tensor set.

[0019] In step S21, the text feature matching component is used to read out information slices and replace placeholder slots in the damage scenario matrix to obtain a filling template. It should be noted that since the damage scenario matrix stores entity nodes and their associated weights in a two-dimensional numerical form, although the matrix elements quantify the temporal and semantic relationships between entities, large language models cannot directly parse the specific vulnerability metadata and device environment attributes contained in the numerical matrix, such as port exposure surfaces, network topology levels, industrial protocol types, and memory out-of-bounds ranges. Based on this, the technical solution of this application further utilizes the text feature matching component to read out information slices and replace placeholder slots in the damage scenario matrix. Through the above processing, the discrete numerical features in the matrix can be transformed into natural language text fragments containing specific device situation background descriptions, providing a basic input for subsequently constructing a structured thought chain that forces large models to reason according to causal logic.

[0020] More specifically, in a specific example of this application, the damage scenario matrix generated by the aforementioned steps is received, and a matrix dimensionality reduction and slicing tool is invoked to traverse and scan the row and column vectors of the matrix. Based on the preset entity type identifier, key vulnerability metadata and device environment attributes are located and read out, such as the 502 port entity representing the port exposure surface, the SCADA master node entity representing the network topology layer, the Modbus TCP protocol entity representing the industrial protocol type, and the 0x7FFF offset entity representing the memory out-of-bounds range. The system synchronously loads a pre-compiled attack message text template. This template has multiple placeholder slots reserved for receiving specific device feature values. The system performs text feature matching to identify slot markers in the template, assigns the 502 port value read from the matrix to the target port slot, assigns the Modbus TCP protocol identifier to the protocol type slot, and assigns the 0x7FFF offset to the memory address slot. After all slots are assigned and replaced, the template, which originally contained blank placeholders, is transformed into a filled template containing a description of the specific device status background, such as the power SCADA system running the Modbus TCP protocol on port 502 and the existence of a 0x7FFF memory out-of-bounds risk.

[0021] In step S22, based on the preset three-part logical deduction rules, the filling template is guided by the deduction sequence and the text layer is spliced ​​and fused to obtain a structured thought chain. It should be noted that although the filling template contains a specific description of the device situation background, it is still presented in a flat text form, lacking clear constraints on the causal relationship between the vulnerability triggering mechanism, execution path, and damage consequences. If the large language model is directly generated based on this template, it will continue its autoregressive characteristics driven by statistical probability, resulting in logical jumps or causal breaks between the pre-trigger conditions, the vulnerability occurrence principle, and the final damage manifestation in the generated vulnerability sample. Based on this, the technical solution of this application further guides the deduction sequence and the text layer is spliced ​​and fused based on the preset three-part logical deduction rules. Through the above processing, the flat background description can be transformed into a structured instruction that forces the large model to reason according to the three-part sequence of vulnerability underlying principle, boundary triggering conditions, and device damage consequences. This constrains the model from the source to establish a complete causal deduction chain before generating code.

[0022] More specifically, in a specific example of this application, a populated template generated by the aforementioned steps, containing a description of the device status background such as the power SCADA system running the Modbus TCP protocol on port 502 and the existence of a 0x7FFF memory overflow risk, is received. This template is then injected into a pre-built syllogistic logical deduction framework. This framework contains three sequentially arranged reasoning dimensions. The first dimension requires describing the underlying principle of the vulnerability, namely, the memory management defect mechanism in which the Modbus TCP protocol fails to perform boundary checks on the data length field when processing function code 0x06 to write a single register, resulting in the stack buffer being overflowed and overwritten. The second dimension requires giving the boundary triggering condition, namely, the attacker sending a carefully crafted Modbus request message to port 502, where the data length field is set to an abnormal value exceeding the buffer capacity, such as an offset of 0x7FFF. The third dimension requires deducing the consequences of device damage, namely, after the stack frame is overwritten by malicious data, the return address points to the shellcode injected by the attacker, causing the SCADA master station process to crash or be remotely controlled. At the text level, specific delimiters are used to explicitly mark the reasoning boundaries of the three-dimensional paragraphs. The background description in the original filling template is used as a context prefix, and the syllogistic logical deduction framework is used as a mandatory constraint suffix. The prefix and suffix are merged at the text level through string concatenation operations to generate a structured thought chain that contains specific device environment information and embeds strict temporal deduction instructions.

[0023] In step S23, the structured thought chain is subjected to discrete word serialization and feature space superposition transformation to obtain a self-consistent cue tensor set. It should be noted that although the structured thought chain embeds a syllogistic logical deduction framework at the text level, it still exists in the form of a natural language string. The underlying computational architecture of the large language model requires the input to be in the form of a numerical tensor, and it is necessary to simultaneously encode the semantic features, temporal position features, and the role features of each word in the causal logical chain in the tensor space. Simple text form cannot meet the model's requirement for multi-dimensional feature fusion representation. Based on this, the technical solution of this application further performs discrete word serialization and feature space superposition transformation on the structured thought chain. Through the above processing, the natural language form of the thought chain can be transformed into a multi-dimensional numerical representation that integrates semantics, position, and logical role in the tensor space. This allows the large model to distinguish whether the current word is in the dimension of vulnerability principle, triggering condition, or destructive consequence during attention mechanism computation, providing high-quality input for subsequent controlled decoding generation.

[0024] More specifically, in a concrete example of this application, the structured thought chain generated by the aforementioned steps, containing a syllogistic logical deduction of the Modbus TCP protocol memory management defect mechanism, the triggering conditions of the 502 port abnormal message, and the consequences of the SCADA master station process crash, is received. A byte-to-byte encoding segmenter is then called to segment the text into tokens, decomposing the continuous string sequence into a discrete token sequence. A pre-trained word embedding matrix is ​​initialized, and for the t-th token in the sequence, it is represented as a one-hot encoded sparse vector in the vocabulary space. By using the word embedding weight matrix Multiplication extracts the basic semantic vector representation of the word, and simultaneously calculates the absolute position encoding vector of the word in the sequence. Used to characterize its temporal sequence. To enable the large model to perceive the role of lexical units within the syllogistic logical framework, a segmented characteristic function is introduced. Determine the logical causal interval where the t-th term lies. If the term is located in the principle paragraph describing the memory management defects of the Modbus protocol, then... Returns 1 if the value is in the section describing the triggering conditions of an abnormal message on port 502, and 2 if it is in the section describing the destructive consequences of a SCADA master station crash. Based on the return value, the corresponding learnable parameter vector is extracted from a pre-defined logical role perception vector lookup table. The three types of feature vectors are superimposed and fused to calculate the final self-consistent tensor representation of the t-th word: in, Based on basic semantic features, For temporal location features, For logical role features, the three elements are fused by vector addition in the same multidimensional tensor space. After traversing all lexical units in the sequence and completing the above calculations, the self-consistent tensor representations of each lexical unit are stacked and connected in the temporal dimension to form a deep numerical structure that supports input into a large language model for computation, resulting in a self-consistent logical cue tensor set.

[0025] Specifically, in step S3, based on the vertical domain large language model, the self-consistent hint tensor set is subjected to controlled decoding and vulnerability modality segmentation. The resulting source code fragments and corresponding mechanism assertion texts are then paired and encapsulated to obtain a candidate vulnerability sample set. It should be noted that although the self-consistent logical hint tensor set integrates multi-dimensional features of semantics, position, and logical roles in the tensor space and constrains the temporal path of causal reasoning through a syllogistic framework, this tensor set is essentially still a constraint instruction on the input side and has not yet been transformed into usable vulnerability exploit code and accompanying mechanism explanation text. Furthermore, the vertical domain large language model needs to balance the divergent creativity of exploring rare attack paths with the syntactic rigor of ensuring code compilability during the generation process. At the same time, the model output will contain two heterogeneous modalities, source code fragments and natural language assertion texts, in a mixed form. Without segmentation and binding, the correspondence between code and explanation will be lost. Based on this, the technical solution of this application further utilizes a large language model in a vertical domain to perform controlled decoding and vulnerability modal segmentation on the self-consistent hint tensor set, and encapsulates the resulting source code fragments with key-value binding relationships with the corresponding mechanism assertion texts. Through the above processing, a large language model pre-trained in the power industry security field can be used to generate candidate samples containing both executable vulnerability payloads and logical explanations under the causal constraints of the self-consistent hint tensor. The randomness of the generation is controlled by a temperature scaling mechanism to explore new attack paths, and modal segmentation and key-value binding ensure that the code fragments in each candidate sample maintain a strict one-to-one correspondence with the mechanism assertion texts, providing structurally complete and traceable input for subsequent cross-consistency verification.

[0026] Figure 4 This document describes a method for generating destructive vulnerability samples based on self-consistent interpretation, according to an embodiment of this application. It involves a vertical domain-based large language model, controlled decoding and vulnerability modality segmentation of a self-consistent hint tensor set, and pairwise encapsulation of the resulting source code fragments with corresponding mechanism assertion text key-value bindings to obtain a candidate vulnerability sample set. (See flowchart for example.) Figure 4As shown, step S3 includes: S31, performing non-standard log-conditional probability calculation and autoregressive discrete sampling on the self-consistent hint tensor set to obtain the original mixed output sequence; S32, performing modal data regularization segmentation and extraction on the original mixed output sequence through a multi-modal syntax tree matching engine to obtain binary segmented modal groups; S33, performing unpacking mapping and key-value pair assembly dictionary encapsulation on the binary segmented modal groups to obtain a candidate vulnerability sample set.

[0027] In step S31, non-standard log-conditional probability calculation and autoregressive discrete sampling are performed on the self-consistent hint tensor set to obtain the original mixed output sequence. It should be noted that although the self-consistent logic hint tensor set encodes syllogistic causal constraints in the tensor space, this tensor set is essentially a static input representation and has not yet undergone the dynamic reasoning and generation process of the large language model to be transformed into actual vulnerability code and mechanism explanation text. Furthermore, the large language model uses an autoregressive decoding mechanism to generate output word-by-word, requiring the calculation of the conditional probability distribution of all candidate words in the vocabulary space at each time step based on contextual conditions and historical generation sequences. Simultaneously, to explore rare new attack paths in power control systems, a certain degree of generation randomness needs to be introduced, but excessive randomness will lead to syntactic errors or logical inconsistencies in the generated code. Based on this, the technical solution of this application further performs non-standard log-conditional probability calculation and autoregressive discrete sampling on the self-consistent hint tensor set. Through the above processing, a text sequence can be generated word-by-word using a large language model in a vertical domain under the causal constraints of a self-consistent prompting tensor. The smoothness of the conditional probability distribution can be adjusted through a temperature scaling mechanism to balance the divergent creativity of exploring new attack paths with the syntactic rigor of ensuring code compilability. The process is iterated until a complete hybrid output sequence containing vulnerability code and mechanism explanation is generated.

[0028] More specifically, in a specific example of this application, a self-consistent logical hint tensor set generated by the aforementioned steps, containing syllogistic logical deductions such as the Modbus TCP protocol memory management defect mechanism, the triggering conditions of 502 port abnormal messages, and the consequences of SCADA master station process crashes, is received. This tensor set is then used as contextual conditions and input into the decoder module of a vertical large language model that has been incrementally pre-trained in the field of power industry vulnerability security. This initiates the autoregressive text generation engine, and at the initial time step... At that time, the model calculates the unnormalized logarithmic score, or Logits, of all candidate lexical units in the vocabulary space based on the input self-consistent hint tensor set. This is for lexical units with indices of... candidate word groups The corresponding Logits value is denoted as A temperature scaling parameter is introduced to control the randomness of the generation. Through calculation formula The conditional probability distribution of the model at the current time step on the vocabulary is obtained, where The set of self-consistent hint tensors for input. For historically generated word sequences, For the first Step 1 The Logits value of each candidate word element. For temperature parameters and The denominator corresponds to the size of the vocabulary. Summing is performed on all candidate lexical units within the range to achieve Softmax normalization. When the probability distribution approaches 0, it tends towards a greedy mode, selecting the word with the highest probability to ensure grammatical rigor. When the probability is greater than 1, the probability distribution is smoothed to increase generation diversity and explore rare attack paths against power SCADA systems. Discrete sampling is performed within the calculated conditional probability distribution. Based on the probability values ​​of each candidate term, a specific term is randomly selected as the generation result for step 1, appended to the historical sequence, and then proceed to the next time step. The model is based on the updated historical sequence. The conditional probability distribution is recalculated and the second term is sampled. This process is repeated iteratively. At each time step, the conditional probability is calculated and sampled based on the self-consistent cue tensor set and the ever-growing historical generation sequence until the model outputs a predefined stop marker. The discrete terms generated at all time steps are then concatenated in chronological order to obtain the original mixed output sequence, which includes C language exploit code for the Modbus TCP protocol 0x7FFF offset stack overflow and natural language explanation text describing how the vulnerability causes the SCADA master station to crash.

[0029] In step S32, a multi-modal syntax tree matching engine is used to perform modal data regularization segmentation and extraction on the original mixed output sequence to obtain binary segmented modal groups. It should be noted that, since the original mixed output sequence contains two heterogeneous modalities in the form of a continuous text stream—C language exploit code targeting a Modbus TCP protocol stack overflow and natural language explanation text describing the vulnerability's triggering mechanism and destructive consequences—the two modalities are intertwined and lack clear physical boundary markers. Without segmentation, it would be impossible to independently verify the execution logic of the code and the semantic logic of the assertions, and the correspondence between the two modalities would be lost during data flow. Therefore, the technical solution of this application further uses a multi-modal syntax tree matching engine to perform modal data regularization segmentation and extraction on the original mixed output sequence. Through the above processing, the source code fragments and assertion text data, two independent modalities, can be physically separated from the mixed sequence based on code block marker features and thought chain identifiers. The two are then packed into a tuple structure in sequence to maintain their one-to-one correspondence, providing a clearly structured input for subsequent key-value binding encapsulation and cross-consistency verification.

[0030] More specifically, in a specific example of this application, the raw mixed output sequence generated by the aforementioned steps, which includes a mixture of C language exploit code and natural language mechanism explanation text, is received. A pre-built syntax tree parser is invoked to perform a global scan of the sequence. The parser first identifies feature markers in the sequence that conform to the Markdown code block syntax specification, locates the scope that begins with three backticks and a language identifier, such as the 'c' tag, and ends with three backticks, and physically strips all the character content within this scope as a code modality. It extracts a C language exploit code fragment that causes a stack buffer overflow due to the failure to perform boundary checks on the data length field when processing function code 0x06 in the Modbus TCP protocol. This code fragment contains key statements such as constructing an abnormal Modbus request message, setting the data length field to an offset of 0x7FFF, and injecting shellcode to overwrite the return address. The extracted code content is marked as a source code fragment data object. A multi-mode regular expression matching engine is simultaneously launched to scan the remaining non-code portions of the mixed sequence. This engine performs pattern matching based on the dimension identifiers set during the construction of the structured thought chain in the preceding steps. It identifies and extracts text segments labeled as follows: those describing the underlying principles of the vulnerability (i.e., explanations of the Modbus protocol memory management defect mechanism); those labeled as boundary trigger conditions (i.e., trigger conditions for sending abnormal packets to port 502); and those labeled as device damage consequences (i.e., damage manifestations of SCADA master station process crashes or being remotely controlled). These three dimensions of natural language text segments are concatenated and merged, marked as assertion text data objects. To maintain the correspondence between source code fragments and assertion text data in subsequent processing, a binary tuple data structure is created. The source code fragment data object is used as the first element of the tuple, and the assertion text data object is used as the second element. After tuple encapsulation, a binary split modal group is obtained.

[0031] In step S33, the binary split modal group is unpacked, mapped, and encapsulated into a key-value pair dictionary to obtain a candidate vulnerability sample set. It should be noted that although the binary split modal group maintains the pairwise relationship between source code fragments and assertion text data through a tuple structure, this tuple structure lacks a globally unique identifier. When a large language model generates multiple vulnerability samples in batches or processes multiple generation tasks concurrently, the code and assertions generated in different batches may become misaligned or confused during data flow. Furthermore, the simple tuple structure is not convenient for subsequent index queries and verification operations based on sample identifiers. Therefore, the technical solution of this application further unpacks, maps, and encapsulates the binary split modal group into a key-value pair dictionary. Through the above processing, a globally unique identifier can be assigned to each candidate sample to prevent data misalignment during concurrent processing. By establishing a key-value pair dictionary structure, source code fragments and assertion text data are strongly bound at the logical level, and multiple dictionary objects are aggregated into a candidate vulnerability sample set, providing a structurally standardized and traceable input for subsequent cross-consistency verification.

[0032] More specifically, in a specific example of this application, a binary modal group generated by the aforementioned steps is received, which includes a C language exploit code snippet targeting the Modbus TCP protocol stack overflow and assertion text data describing the vulnerability triggering mechanism and the consequences of the SCADA master station crash. The source code snippet data object located at the first element position and the assertion text data object located at the second element position are parsed from the memory address of the tuple data structure. The snowflake algorithm is then called to generate a globally unique identifier. This algorithm generates a 64-bit integer UUID based on a combination of timestamp, machine identifier, and serial number to ensure that the sample identifiers generated in different batches in a distributed environment will not conflict. Create a JSON-formatted dictionary data structure, assigning the generated UUID as the primary key field. Create a code field and assign the unpacked source code fragment data object as its value. This code field stores complete C language exploit code containing key statements such as constructing an abnormal Modbus request message, setting the 0x7FFF offset, and injecting shellcode. Create an assertion field and assign the unpacked assertion text data object as its value. This assertion field stores natural language explanation text describing the Modbus protocol memory management defect mechanism, the triggering conditions of the 502 port abnormal message, and the consequences of the SCADA master station process crash. After completing the above field assignments, a complete dictionary object containing the UUID primary key, code field, and assertion field is obtained. The dictionary object is appended to the pre-initialized candidate sample temporary pool list structure. If the large language model generates multiple vulnerability samples in the same batch, the above unpacking, UUID generation and dictionary encapsulation operations are repeated for each sample. All dictionary objects are appended to the temporary pool list in sequence until all samples in the batch are encapsulated. The temporary pool list is then output as a candidate vulnerability sample set.

[0033] Specifically, in step S4, the candidate vulnerability sample set undergoes multimodal attribute graph self-consistency reverse verification to obtain the verification vulnerability sample set. It should be noted that although the large language model generates candidate samples containing source code fragments and mechanism assertion texts under the causal constraints of the structured thought chain, the model's autoregressive generation mechanism based on statistical probability still suffers from parameter illusion. This can lead to semantic deviations or causal gaps between the generated code fragments and the vulnerability triggering mechanism, execution path, and destructive consequences described by the accompanying assertion text in terms of actual control flow and data flow topology. Without verification, pseudo-defect samples with grammatically correct code on the surface but unable to reproduce the expected destructive effects in a real industrial environment will be mixed into the candidate sample set, severely limiting the practical application value of the sample library. Therefore, the technical solution of this application further performs multimodal attribute graph self-consistency reverse verification on the candidate vulnerability sample set. Through the above processing, code attribute graph static analysis tools can be used to reverse the control flow and data flow topology of source code fragments to extract the semantic vector representation of their actual execution logic. Simultaneously, a pre-trained natural language encoder is used to extract deep contextual features from the mechanism assertion text to obtain the semantic vector representation of its descriptive logic. Cross-consistency quantification is achieved by calculating the cosine similarity of two heterogeneous modal vectors in high-dimensional space. Based on a pre-set confidence threshold, pseudo-defect samples that are inconsistent between code behavior and assertion explanation logic are filtered out. This ensures that the executable payload and mechanism explanation of each sample in the final generated verification vulnerability sample set are highly consistent at the semantic level, providing high-fidelity and high-quality samples that can be used for practical defense verification for downstream vulnerability sample libraries.

[0034] Figure 5 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistent interpretation, according to an embodiment of this application, involving multimodal attribute map self-consistency reverse verification of a candidate vulnerability sample set to obtain a verification vulnerability sample set. Figure 5 As shown, step S4 includes: S41, performing control flow and data flow topology inversion on the source code fragments in the candidate vulnerability sample set to obtain code semantic vectors; S42, performing semantic vectorization encoding on the mechanism assertion text in the candidate vulnerability sample set to obtain assertion text vectors; S43, calculating the cross-consistency of the code semantic vectors and assertion text vectors, and filtering out logically inconsistent candidate samples according to a preset confidence threshold to obtain a verification vulnerability sample set.

[0035] In step S41, the source code fragments in the candidate vulnerability sample set undergo control flow and data flow topology inversion to obtain code semantic vectors. It should be noted that although the source code fragments in the candidate vulnerability sample set conform to programming language specifications at the syntactic level, their actual control flow transfer paths and data flow taint propagation logic still exist in string text form. It is impossible to directly quantify and evaluate whether the code truly implements the vulnerability triggering mechanism and destructive consequences described in the accompanying assertion text during execution. Furthermore, the text-based code cannot be used for similarity calculation with the vectors obtained by semantically encoding the assertion text in subsequent steps within the same mathematical space. Based on this, the technical solution of this application further performs control flow and data flow topology inversion on the source code fragments in the candidate vulnerability sample set. Through the above processing, the abstract syntax tree, control flow graph, and program dependency graph of the source code can be extracted in reverse using code attribute graph static analysis tools. These graph structures are then spatially aggregated and encoded using graph neural networks, reducing the dimensionality of the actual execution logic of the code to a dense semantic vector representation, providing numerical input from the code side for subsequent cross-consistency verification with assertion text vectors.

[0036] More specifically, in a concrete example of this application, a candidate vulnerability sample set generated by the aforementioned steps, including a C language exploit code snippet targeting a Modbus TCP protocol stack overflow and accompanying mechanism assertion text, is received. Each sample dictionary object in the set is iteratively traversed, and a source code snippet is extracted from the dictionary's code field. This code snippet contains key statements such as constructing an abnormal Modbus request message, setting the data length field to an offset of 0x7FFF, and injecting shellcode to overwrite the return address. This code snippet is then input into a pre-set code attribute graph static analysis tool. This tool first performs lexical analysis on the code to analyze the characters... The code is segmented into a sequence of lexical units, followed by syntactic analysis to construct an abstract syntax tree (AST) to represent the hierarchical structure of the code. Based on the AST, a control flow graph is constructed by analyzing function call relationships and conditional branch statements to depict the execution path transfer logic of the code. Simultaneously, a program dependency graph is constructed by analyzing variable definitions and using relationships and data dependencies to depict the taint propagation path of malicious input data such as the offset 0x7FFF in the code. The AST, control flow graph, and program dependency graph are then merged and aligned at the node level to generate a unified code attribute graph structure. In this graph structure, nodes represent statements or expressions in the code, and edges represent control flow transfers or data dependencies. A spatial aggregation encoder based on a graph neural network is invoked to extract features from the code attribute graph. This encoder performs multiple rounds of information aggregation among the nodes of the graph through a message-passing mechanism. Each node aggregates the feature vectors of its neighbors and updates its own representation. After multiple aggregations, the feature vector of each node integrates its local topological structure information and global semantic information in the graph. Pooling is performed on the feature vectors of all nodes to obtain a graph-level global representation. This global representation is then dimensionality-reduced and mapped to a dense vector of fixed dimensions through a fully connected layer, resulting in a code semantic vector that encodes the control flow and data flow logic of the C language exploit code. To prevent data flow breakage in subsequent steps, the generated code semantic vector, the unprocessed mechanism assertion text extracted from the sample dictionary, and the original sample dictionary object itself are jointly packaged to create a transitional intermediate data structure containing the above three types of data, resulting in a hybrid set of code vectors and assertions.

[0037] In step S42, the mechanism assertion text in the candidate vulnerability sample set is semantically vectorized to obtain assertion text vectors. It should be noted that although the code vector and assertion hybrid set contains code semantic vectors encoding the control flow and data flow logic of the code, the mechanism assertion text within it still exists as natural language strings and has not yet been converted into a numerical representation in the same mathematical space as the code semantic vectors. Therefore, it is impossible to directly calculate the similarity between vectors to quantitatively evaluate the semantic alignment between the actual execution logic of the code and the assertion description mechanism. Based on this, the technical solution of this application further performs semantic vectorization encoding on the mechanism assertion text in the candidate vulnerability sample set. Through the above processing, the deep contextual features of the assertion text can be extracted using a pre-trained Transformer natural language encoder, transforming the natural language explanation describing the vulnerability triggering mechanism, execution path, and damage consequences into a dense vector representation. This assertion text vector is then aligned and bound with the code semantic vectors generated in the aforementioned steps, constructing a unified data structure containing dual-channel vectors from both the code and assertion sides. This provides complete input for subsequent cross-consistency quantitative evaluation within the same vector space.

[0038] More specifically, in a specific example of this application, the system receives a mixed set of code vectors and assertions generated in the aforementioned steps, which includes semantic vectors of C language exploit code targeting Modbus TCP protocol stack overflow, mechanism assertion text describing the triggering mechanism of the vulnerability and the consequences of SCADA master station crash, and original sample dictionary objects. The system unpacks and extracts the mechanism assertion text in natural language form from this mixed set data structure. This text contains three dimensions of natural language explanation: a memory management defect mechanism describing the Modbus protocol's failure to perform boundary checks on the data length field when processing function code 0x06, leading to stack buffer overflow; a description of the triggering condition for sending an abnormal message with the data length field set to an offset of 0x7FFF to port 502; and a description of the destructive consequences of the SCADA master station process crashing or being remotely controlled after the stack frame is overwritten by malicious data and the return address points to shellcode. The mechanistic assertion text is input into a Transformer encoder pre-trained on a large-scale corpus. This encoder first segments the input text into a sequence of tokens, assigning each token a corresponding word embedding vector and positional encoding vector. The word embeddings and positional encodings are then added and fed into a multi-layer Transformer encoder. Each layer uses a multi-head self-attention mechanism to calculate the dependencies between tokens, ensuring that the representation of each token incorporates its contextual information within the text. After multi-layer encoding, a deep contextual feature vector sequence for each token is obtained. Average pooling is then applied to this token feature vector sequence, averaging the feature vectors of all tokens across their dimensions to obtain a fixed-dimensional dense vector representing the global semantics of the entire assertion text. This vector encodes the semantic information of the vulnerability principle, triggering conditions, and destructive consequences described in the mechanistic assertion text, and is denoted as the assertion text vector. Extract the code semantic vectors generated in the previous steps from the mixed set of code vectors and assertions. Align and bind the code semantic vectors with the assertion text vectors generated in this step according to the sample identifier to ensure that the code vectors and assertion vectors from the same candidate sample maintain a pairing relationship. Simultaneously extract the original candidate sample dictionary object. Encapsulate and merge the code semantic vectors, assertion text vectors and the original sample dictionary object into a unified data structure. Construct a high-dimensional tensor-level data object containing dual-channel vector representation and original sample information to obtain a dual-channel aligned vector set.

[0039] In step S43, the cross-consistency of the code semantic vector and assertion text vector is calculated, and logically inconsistent candidate samples are filtered out based on a preset confidence threshold to obtain a vulnerability verification sample set. It should be noted that although the dual-channel aligned vector set contains code semantic vectors encoding the code control flow and data flow logic respectively, and assertion text vectors encoding the vulnerability triggering mechanism and damage consequences description, the two vectors are only paired and bound at the data structure level. Their alignment in the high-dimensional semantic space has not been quantitatively evaluated at the mathematical level. Furthermore, the parameter illusion phenomenon in the generation process of the large language model may lead to semantic deviations or causal gaps between the actual execution logic of some candidate samples and the mechanism described by the accompanying assertions. Without quantitative verification and setting a quality threshold for filtering, logically inconsistent pseudo-defect samples will be mixed into the final sample library, severely limiting the application value of the sample library in industrial field defense verification. Based on this, the technical solution of this application further calculates the cross-consistency of the code semantic vector and assertion text vector, and filters out logically inconsistent candidate samples based on a preset confidence threshold. Through the above processing, the degree of semantic alignment between two heterogeneous modalities can be accurately quantified by calculating the cosine similarity between the code semantic vector and the assertion text vector in high-dimensional space. Based on a preset confidence threshold, the self-consistency score is judged. Samples with scores below the threshold are judged as pseudo-defects caused by large model illusion and discarded, while samples with scores reaching or exceeding the threshold are judged as high-fidelity self-consistent samples and retained. This ensures that the executable code payload and mechanism explanation assertion of each sample in the final generated verification vulnerability sample set are highly consistent at the semantic level, providing high-quality samples for downstream vulnerability sample libraries that can be directly used for industrial field defense verification.

[0040] Figure 6 This is a flowchart illustrating a method for generating destructive vulnerability samples based on self-consistency interpretation, according to an embodiment of this application. The method involves calculating the cross-consistency of code semantic vectors and assertion text vectors, and filtering out logically inconsistent candidate samples based on a preset confidence threshold to obtain a set of verification vulnerability samples. Figure 6 As shown, step S43 includes: S431, calculating the basic self-consistency score of the code semantic vector and the assertion text vector within a single sample to obtain a basic self-consistent score sequence; S432, quantifying the causal connection strength of the damage consequence sub-vector and the triggering condition sub-vector of the assertion text vector and assigning directed edge weights to obtain a cascaded dependency adjacency matrix; S433, performing link propagation enhancement fusion on the basic self-consistent score sequence and the cascaded dependency adjacency matrix to obtain an enhanced self-consistent score sequence; S434, comparing and filtering the enhanced self-consistent score sequence and discarding substandard samples based on a preset confidence threshold to obtain a verification vulnerability sample set.

[0041] In step S431, a basic self-consistency score is calculated for the code semantic vector and assertion text vector to obtain a basic self-consistency score sequence. It should be noted that, given that subsequent link propagation enhancement calculations require the self-consistency of each independent sample as an anchoring benchmark, and although the code semantic vector and assertion text vector of each candidate sample in the dual-channel aligned vector set have been paired and bound, their internal binary alignment degree has not yet been mathematically quantified to establish an initial evaluation baseline. Therefore, the technical solution of this application further calculates a basic self-consistency score for the code semantic vector and assertion text vector for each sample. Through the above processing, the semantic consistency between the code behavior and the mechanism assertion of each sample from an isolated perspective can be calculated using the cosine similarity algorithm, providing a numerical anchor for the subsequent introduction of cascade enhancements, ensuring that the improved mechanism provides a reliable numerical basis for enhancement calculations at the attack chain dimension while retaining the existing discrimination granularity.

[0042] More specifically, in a specific example of this application, a dual-channel aligned vector set generated by the aforementioned steps is received, containing a semantic vector of C language exploit code targeting the Modbus TCP protocol stack overflow and an assertion text vector describing the vulnerability's triggering mechanism and the consequences of the SCADA master station crash. Each candidate sample in this set is traversed, and for the sample with index k, the code semantic vector is extracted from its data structure. With assertion text vector The cosine similarity algorithm is used to calculate the angle-normalized inner product of the two samples in high-dimensional space, and the basic self-consistency score of the sample is obtained through the following formula: in, Let represent the basic self-consistency score of the k-th candidate vulnerability sample. It is a scalar between -1 and 1, where the closer it is to 1, the higher the semantic consistency between the code behavior and the mechanism assertion from an isolated perspective. This represents the code semantic vector of the k-th sample. The numerator represents the assertion text vector of the k-th sample. For the inner product operation of two vectors, the denominator The product of the L2 norms of the two vectors is used to normalize the angle cosine. This base score reflects the semantic alignment between the code behavior and the mechanistic assertion of each sample from an isolated perspective, providing a numerical anchor for subsequent cascaded enhancements. The base scores of all samples are arranged in index order to generate a base self-consistent score sequence, which serves as the input benchmark for subsequent attack chain cascaded dependency enhancement calculations.

[0043] For example, the semantic vector of C language exploit code containing key statements such as constructing abnormal Modbus request messages, setting the data length field to an offset of 0x7FFF, and injecting shellcode to overwrite the return address, and the assertion text vector describing the memory management defect mechanism of the Modbus protocol in handling function code 0x06 without boundary verification of the data length field leading to stack buffer overflow, the triggering condition for sending abnormal messages to port 502, and the destructive consequences of the SCADA master station process crashing or being remotely controlled, are used to obtain a basic self-consistency score through the above cosine similarity calculation. If the score is 0.82, it indicates that the stack overflow execution logic of the code and the memory management defect mechanism described by the assertion have high semantic consistency from the perspective of a single sample. This score will be used as a benchmark reference value for subsequent judgment on whether the sample is an intermediate bridging node in the attack chain.

[0044] In step S432, the assertion text vector is subjected to causal connection strength quantification of the damage consequence sub-vector and trigger condition sub-vector, and directed edge weights are assigned to obtain a cascaded dependency adjacency matrix. It should be noted that, given that the first embodiment treats each candidate vulnerability sample as an independent, unrelated entity for independent judgment, the fundamental reason is the lack of a topological structure that can explicitly express the causal transmission relationship between samples. In real-world damage attack scenarios in power industry control systems, a complete exploitation process for a destructive vulnerability is rarely achieved independently by a single isolated vulnerability. In actual industrial settings, the triggering of damage consequences depends on the cascaded attack chain dependency relationship formed between multiple vulnerabilities. That is, the triggering result of vulnerability A constitutes the precondition for vulnerability B, and the execution result of vulnerability B further activates the damage payload of vulnerability C, thus forming a logically coupled multi-level causal transmission link. Based on this, the technical solution of this application further quantifies the causal connection strength of the damage consequence sub-vector and trigger condition sub-vector of the assertion text vector and assigns directed edge weights. Through the above processing, the assertion text vectors of all candidate samples can be traversed. For any two different samples, the semantic sub-vectors corresponding to their damage consequence dimension and triggering condition dimension are extracted. The causal connection strength between the two is calculated, which is the probability measure that the attack result of the sample can be used as the pre-triggering condition of another sample. The connection strength value is written as the directed edge weight into the corresponding position of the adjacency matrix, thereby constructing a global cascaded dependency adjacency matrix. The candidate samples that were originally scattered as isolated points are reorganized into a directed causal topological network, enabling the system to have the structured ability to perceive the cascaded dependency relationship between samples for the first time, providing an accurate topological skeleton for subsequent link propagation enhancement calculation.

[0045] More specifically, in a specific example of this application, the system receives a basic self-consistent score sequence containing multiple candidate vulnerability samples and their corresponding basic self-consistent scores generated in the aforementioned steps. The cascaded dependency adjacency matrix is ​​initialized as a zero matrix, where the number of rows and columns is equal to the total number of candidate samples. The assertion text vectors of all candidate samples are traversed. For any two different samples k and l, the semantic sub-vectors corresponding to the damage consequences dimension in the assertion text of sample k and the semantic sub-vectors corresponding to the triggering conditions dimension in the assertion text of sample l are extracted. The damage consequences sub-vectors... Characterizing the state change of the system caused by the exploitation of the vulnerability described by sample k, triggering conditional subvectors. The preceding system state required for the vulnerability described by sample l to be activated is characterized. The causal connection strength between the two is calculated, which is the probability measure that the attack result of sample k can serve as a preceding triggering condition for sample l. The directed cascading dependency weight from sample k to sample l is quantified by the following formula: in, The directed cascade dependency weights from sample k to sample l, with values ​​ranging from 0 to 1, form the elements in the k-th row and l-th column of the cascade dependency adjacency matrix. The inner product operation of the damage consequence subvector and the triggering condition subvector characterizes the degree of matching between the two in the semantic space. The dimension scalar of the semantic subvector is used to scale the dot product magnitude to prevent gradient vanishing. The bias threshold parameter is used to filter out noisy connections with causal correlation below the baseline. The Sigmoid activation function maps the real number field to the interval between 0 and 1 to represent the directed concatenation probability. The calculated connection strength values ​​are then written as directed edge weights into the corresponding positions in the adjacency matrix. Assign the value to the element in the k-th row and l-th column of the adjacency matrix. After traversing all sample pairs and completing the above calculation, the complete cascaded dependency adjacency matrix is ​​obtained.

[0046] In a specific power control scenario, for the SCADA protocol field overflow leading to authentication bypass described by sample k, a damage consequence sub-vector is extracted from its assertion text vector. This sub-vector encodes state change information such as the authentication mechanism being bypassed and the system entering an unauthenticated state. For the triggering condition of injecting illegal control commands in an unauthenticated state described by sample l, a triggering condition sub-vector is extracted from its assertion text vector. This sub-vector encodes the precondition information that the system needs to be in an unauthenticated state for the vulnerability to be activated. The scaling dot product matching degree of the two sub-vectors is calculated using the above formula. Since the consequence state of sample k exactly satisfies the triggering condition of sample l, the inner product value of the two sub-vectors in the semantic space is high. After mapping with the Sigmoid function, a directed edge weight close to 0.9 is obtained. This weight is written into the k-th row and l-th column of the adjacency matrix, representing a strong causal cascade relationship between sample k and sample l. That is, the exploitation result of the authentication bypass vulnerability creates the necessary conditions for the triggering of the illegal control command injection vulnerability. Thus, this implicit attack chain propagation path is explicitly quantified as a directed graph edge weight.

[0047] In step S433, the basic self-consistent scoring sequence and the cascaded dependency adjacency matrix are fused using link propagation enhancement to obtain an enhanced self-consistent scoring sequence. It should be noted that, given that the basic self-consistent scoring sequence only reflects the binary alignment between code behavior and mechanistic assertions from an isolated perspective for each candidate sample, while the cascaded dependency adjacency matrix has already constructed the causal transmission relationship topology between samples, attack chain bridging nodes that are isolated and face erroneous rejection in the first embodiment can obtain score correction through the link support of their upstream high-confidence predecessor nodes. Without link propagation enhancement fusion, some samples with slightly lower basic scores than the threshold but playing a crucial bridging role in the attack chain will be incorrectly removed, damaging the integrity of the test link. Based on this, the technical solution of this application further performs link propagation enhancement fusion on the basic self-consistent scoring sequence and the cascaded dependency adjacency matrix. Through the above processing, for each candidate sample, the link support information propagated by all upstream nodes along the incoming edge direction can be aggregated on the cascade dependency graph. After being weighted by the incoming edge weights, the aggregated information is linearly fused with the sample's own basic score to obtain an enhanced self-consistency score that comprehensively considers the sample's internal self-consistency from an isolated perspective and the degree of support from upstream causal links from the perspective of attack chain cascading. When the basic self-consistency score of a vulnerability sample is slightly lower than the threshold, but there are multiple highly credible attack chain preceding nodes upstream that provide strong causal support, the link propagation enhancement will effectively improve the sample's comprehensive score, avoid the incorrect discarding of key bridging nodes in the middle of the attack chain, and ensure the integrity of the damage test link is preserved.

[0048] More specifically, in a concrete example of this application, the basic self-consistent scoring sequence and the cascaded dependency adjacency matrix are received simultaneously. For each candidate sample k, the link support information transmitted to it by all upstream nodes along the incoming edge direction is aggregated on the cascaded dependency graph. First, all non-zero elements in the k-th column are located from the cascaded dependency adjacency matrix. The row indices corresponding to these non-zero elements constitute the set of incoming edge source nodes pointing to node k. That is, the set of all upstream sample indices that could potentially be used as the preceding stage of an attack on sample k. For each upstream sample j in this set, the weights of the directed edges pointing from sample j to sample k in the adjacency matrix are extracted. and the basic self-consistent score of upstream sample j The weighted support contribution of the upstream node to sample k is obtained by multiplying the directed edge weight by the base score of the upstream sample. The total link support value is obtained by summing the weighted support contributions of all upstream nodes. At the same time, the weights of all incoming edges are summed and a minimal positive smoothing constant is added. To prevent the denominator from being zero, the total link support value is divided by the normalized denominator to obtain the average link propagation score. This score is then weighted by the incoming edge weights and linearly fused with the sample's own base score. The enhanced self-consistency score of the k-th candidate vulnerability sample is obtained using the following formula: in, The score represents an enhanced measure of the sample's internal consistency from an isolated perspective and its support from upstream causal links from an attack chain cascade perspective. The fusion weighting coefficient between the self-score and the link propagation score ranges from 0 to 1, used to adjust the emphasis ratio between internal consistency and cascading correlation. The basic self-consistent score for the k-th sample is derived from the corresponding element in the basic self-consistent score sequence. Let be the set of all source nodes of incoming edges pointing to node k in the directed graph defined by the cascaded dependency adjacency matrix. Let be the weight of the directed edge from sample j to sample k in the cascaded dependency adjacency matrix. The minimum positive smoothing constant is used to prevent numerical overflow caused by the denominator being zero when sample k has no incoming neighbors. After traversing all candidate samples and completing the above calculation, the enhancement scores of all samples are arranged in index order to generate an enhancement self-consistent score sequence.

[0049] In specific power control scenarios, the basic self-consistency score for the vulnerability described in sample j (SCADA protocol field overflow leading to authentication bypass) is 0.85. The basic self-consistency score for sample k (injection of illegal control commands in an unauthenticated state) is 0.72, slightly lower than the preset threshold of 0.75. If the isolated evaluation method of the first embodiment is used, this sample will be incorrectly discarded. However, in the cascaded dependency adjacency matrix, the directed edge weight from sample j to sample k is 0.9, representing a strong causal cascaded relationship. A fusion weight coefficient is set... The score is 0.5. The enhanced self-consistency score of sample k calculated by the above formula is about 0.785, which exceeds the threshold. This allows the attack chain bridging node, which was originally facing being discarded due to its slightly low base score, to be retained, ensuring that the complete attack chain from authentication bypass to illegal control command injection is not broken.

[0050] In step S434, based on a preset confidence threshold, the enhanced self-consistent scoring sequences are compared and screened, and substandard samples are discarded to obtain a vulnerability verification sample set. It should be noted that, given the progressive processing through the aforementioned three steps, each candidate sample has obtained an enhanced score that incorporates cascading link information. This enhanced score comprehensively reflects the internal consistency of the sample from an isolated perspective and the degree to which it is supported by upstream causal links from an attack chain cascading perspective. However, a confidence threshold still needs to be set for final quality control to filter out samples that still do not meet the score requirements, while ensuring that key bridging samples with cascading linkage value in the attack chain dimension are retained. Based on this, the technical solution of this application further compares and screens the enhanced self-consistent scoring sequences and discards substandard samples based on a preset confidence threshold. Through the above processing, each candidate sample can be traversed, its enhanced self-consistency score can be compared with the preset enhanced confidence threshold, and the retention or rejection can be determined according to the decision conditions. All sample entities that pass the decision are aggregated and output as a verification vulnerability sample set, completing the closed-loop decision of the improvement mechanism. This ensures that the final generated verification vulnerability sample set not only contains high-quality samples with internal semantic self-consistency, but also retains key bridging samples with cascading linkage value in the attack chain dimension, providing downstream industrial vulnerability feature libraries with the ability to directly connect and chain damage tests.

[0051] More specifically, in a specific example of this application, the enhanced self-consistency score sequence containing all candidate sample enhanced self-consistency scores generated in the aforementioned steps is received, the verification vulnerability sample set is initialized as an empty list structure, and an enhanced confidence threshold is set. The threshold is 0.75. Compared to the fixed threshold in the first embodiment, this threshold implicitly incorporates cascading relationships into the evaluation criterion, traversing each candidate sample k to enhance its self-consistent scoring. The score is compared with a preset confidence enhancement threshold. If the confidence enhancement score is greater than or equal to the threshold, then... If the sample passes the verification, the complete original data entity of the sample is extracted from the original candidate sample set. This data entity contains a unique identifier for the sample, source code fragments, mechanism assertion text, and related metadata. This data entity is appended to the list of verified vulnerability samples. If the enhanced self-consistency score is less than a threshold, then... If the sample fails the verification, it is determined that the sample has failed and is marked as an empty set. This means the sample is physically discarded and will not proceed to the next step. After iterating through all candidate samples and completing the above decision, the list of verified vulnerability sample sets will be the final output.

[0052] For the vulnerability described in sample k, which involves injecting unauthorized control commands without authentication, its enhanced self-consistency score of 0.785 exceeds the preset threshold of 0.75. This sample passes verification and is retained in the verification vulnerability sample set. However, another sample describes an isolated configuration error vulnerability with a basic self-consistency score of 0.68 and no upstream node providing link support. Its enhanced score is still 0.68, which is below the threshold. This sample is judged to have failed verification and is discarded. The final verified vulnerability sample set includes high-quality samples with internal semantic self-consistency, such as authentication bypass vulnerabilities, as well as unauthorized control command injection vulnerabilities that play a bridging role in the attack chain. This ensures that the complete attack chain from authentication bypass to unauthorized control command injection to SCADA master station crash can be directly used for cascade damage testing in industrial fields.

[0053] Specifically, in step S5, the vulnerability sample set is reshaped into a multi-dimensional vulnerability feature library and encapsulated in a closed loop to obtain a vulnerability sample library. It should be noted that although the vulnerability sample set has undergone cross-consistency verification and cascading dependency enhancement filtering to ensure high consistency between the sample's code logic and assertion descriptions and to retain the attack chain bridging nodes, the data in this sample set still exists in the original dictionary structure. It lacks metadata tags necessary for downstream security devices to perform threat detection and defense decisions, such as attack surface features, environmental constraints, and key attack payload parameters. Furthermore, the data format does not conform to the standardized reading specifications of heterogeneous security devices such as industrial firewalls, intrusion detection systems, and situational awareness platforms, making it impossible to directly deploy to industrial sites for practical defense verification. Based on this, the technical solution of this application further reshapes and encapsulates the vulnerability sample set into a multi-dimensional vulnerability feature library. Through the above processing, attack surface tags can be extracted through the rule engine and mounted to the sample structure tree, converting the samples into a standardized format conforming to the threat intelligence interaction protocol. The samples are then persistently stored through hash deduplication and incremental writing mechanisms, generating a vulnerability sample library that can be directly used for multi-level damage scenario cascading testing in industrial sites.

[0054] More specifically, in a specific example of this application, the system receives a set of verification vulnerability samples generated by the aforementioned steps, which has undergone cross-consistency verification and cascading dependency enhancement filtering. A pre-built rule engine based on abstract syntax is then activated. This engine incorporates an expert regular expression library and an industrial communication protocol feature dictionary. It iterates through each sample in the verification vulnerability sample set. For samples containing C language exploit code snippets targeting Modbus TCP protocol stack overflows, the rule engine performs a static scan of the sample's source code snippet. Based on predefined network port feature pattern matching in the expert regular expression library, it identifies the hard-coded 502 port in the code as the target port. Based on the industrial communication protocol feature dictionary, it identifies the constructed Modbus TCP protocol request message and its function code 0x06 field in the code. Based on memory operation feature patterns, it identifies the 0x7FFF offset set in the code as a key attack payload parameter triggering the stack overflow. Simultaneously, it extracts the specific platform version restrictions required for the vulnerability to be exploited from the sample's mechanism assertion text, such as the operating system version and Modbus protocol stack version running on the target SCADA master station. The extracted target port 502 and protocol type Modbus are then used in conjunction with this information. The multi-dimensional attributes, such as TCP, function code 0x06, attack payload parameter 0x7FFF, and platform version restrictions, are converted into key-value pairs with a fixed structure. A structured tag set data object is created, and the tag set is attached to the tree node of the original data entity of the corresponding sample. After the tag is attached, a set of tagged vulnerability samples is obtained.

[0055] As described above, the destructive vulnerability sample generation method based on self-consistent interpretation according to embodiments of this application can be implemented in various network security protection and vulnerability detection platforms, such as power system network security operation centers, industrial control system security testing units, or critical infrastructure threat intelligence analysis terminals. In one possible implementation, this method can be integrated into a network security intelligent defense system or an industrial control system security monitoring platform as a multimodal self-consistent verification engine or a cascading dependency enhanced inference component. For example, the method can be an independent vulnerability sample generation application running on a security operation center server, or it can be a large language model-driven analysis plugin and cross-self-consistent verification module of an existing vulnerability detection system, or it can be an intelligent security operation and maintenance middleware service deployed in the cloud and distributed through edge collaboration. Of course, the structured thinking chain construction, multimodal cross-verification, and cascading dependency-based link propagation enhancement modules in this method can also run in edge security gateways, field protection terminals, or distributed threat detection units equipped with limited computing power, serving as the underlying real-time analysis foundation of this multi-level network security protection system.

[0056] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for generating destructive vulnerability samples based on self-consistent interpretation, characterized in that, include: S1. Entity extraction and scenario association network construction are performed on the situational data stream containing device system log text, industrial vulnerability test scripts and device crash memory snapshots to obtain the damage scenario matrix. S2. By using structured thinking chain prompt templates and word embedding models, multi-dimensional causal logic constraint mapping and tensor space encoding are performed on the vulnerability meta-information and equipment environment attributes in the damage scenario matrix to obtain a self-consistent prompt tensor set. S3. Based on the vertical domain large language model, the self-consistent prompt tensor set is decoded and generated in a controlled manner and the vulnerability modality is segmented. The obtained source code fragments are then paired with the corresponding mechanism assertion text key value binding relationship to obtain a candidate vulnerability sample set. S4. Perform multimodal attribute graph self-consistency reverse verification on the candidate vulnerability sample set to obtain the verification vulnerability sample set; S5. Reshape and encapsulate the vulnerability sample set into a multi-dimensional vulnerability feature library to obtain a vulnerability sample library.

2. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Step S4 includes: Control flow and data flow topology inversion is performed on source code fragments in the candidate vulnerability sample set to obtain code semantic vectors; Semantic vectorization encoding is performed on the mechanism assertion text in the candidate vulnerability sample set to obtain assertion text vectors; Cross-consistency is calculated between the code semantic vector and the assertion text vector, and candidate samples with logical inconsistency are filtered out according to a preset confidence threshold to obtain a sample set of verification vulnerabilities.

3. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Step S1 includes: Noise removal and unified encoding format conversion are performed on the situational data stream to obtain a clean heterogeneous text set; Based on a bidirectional coding model and a conditional random field, entity node lexical extraction and global semantic vector binding are performed on a pure heterogeneous text set to obtain a multidimensional entity feature set. The damage scenario matrix is ​​obtained by linearly weighting the node association weights of the multidimensional entity feature set and reducing the dimensionality of the network graph edge matrix.

4. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Step S2 includes: Using a text feature matching component, information slices are read from the damage scenario matrix and placeholder slots are assigned and replaced to obtain a filling template. Based on the preset three-part logical deduction rules, the filling template is deduced sequentially and the text layer is spliced ​​and merged to obtain a structured thinking chain. The structured thought chain is subjected to discrete word serialization and feature space superposition transformation to obtain a self-consistent cue tensor set.

5. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Step S3 includes: Non-standard log-conditional probability calculation and autoregressive discrete sampling are performed on the self-consistent cue tensor set to obtain the original mixed output sequence; The original mixed output sequence is subjected to modal data regularization and extraction by a multi-modal syntax tree matching engine to obtain binary split modal groups. The binary splitting modal group is unpacked, mapped, and encapsulated into a dictionary of key-value pairs to obtain a candidate vulnerability sample set.

6. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Step S5 includes: By using a detection rule engine that includes an expert dictionary, the vulnerability sample set is subjected to load key parameter extraction and hierarchical mounting of the structure tree node to obtain a tagged vulnerability sample set. The labeled vulnerability sample set is paired with envelope information and translated into a structured tree protocol to obtain a standardized record set; A vulnerability sample library is obtained by performing database cross-collision probe detection and storage engine index reshaping scheduling on a standardized record set.

7. The method for generating destructive vulnerability samples based on self-consistent interpretation according to claim 1, characterized in that, Cross-consistency calculation is performed on the code semantic vector and assertion text vector, and logically inconsistent candidate samples are filtered out according to a preset confidence threshold to obtain a vulnerability verification sample set, including: A basic self-consistency score sequence is obtained by performing a single-sample internal self-consistency score on the code semantic vector and the assertion text vector. The causal connection strength between the damage consequence subvector and the triggering condition subvector of the assertion text vector is quantified and the directed edge weights are assigned to obtain the cascaded dependency adjacency matrix. Link propagation enhancement fusion is performed on the basic self-consistent scoring sequence and the cascaded dependency adjacency matrix to obtain the enhanced self-consistent scoring sequence; Based on a pre-set reliability threshold, the enhanced self-consistency scoring sequences are compared and screened, and substandard samples are discarded to obtain a verification vulnerability sample set.

Images