exp availability verification method, device, electronic device and readable storage medium

Abstract

The present application provides an exp availability verification method, device, electronic device and readable storage medium, which determines the target exp from multiple exps contained in the public vulnerability library according to the project requirement information, and writes based on the target exp to obtain the corresponding writing exp, which is written in the programming language required by the project. And use the pre-trained model obtained in advance to analyze and process the target exp to obtain the corresponding return message, construct the return message of the writing exp, and compare the return message of the target exp and the return message of the writing exp to determine the availability of the writing exp. In the present application, the pre-trained model obtained by training is used to generate a return message, which can cope with the batch processing of a wide variety of exps and a large number of exps, reduce the technical requirements for technicians, and improve the verification processing efficiency.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an exp availability verification method, device, electronic device and readable storage medium. Background Art

[0002] When security industry practitioners test target sites and find historical vulnerabilities in target services, they will generally look for vulnerability verification programs exp corresponding to the services in public vulnerability libraries. However, security personnel need to verify the availability of exp before using it, or there are corresponding departments that specialize in handling exp in public vulnerability libraries. Since the public vulnerability library is written in a complicated language and has different usage methods, and the POCs included in the vulnerability library are not reviewed by professionals, once the uploaded exp has problems such as incorrect numbering, syntax problems, too complicated incoming parameters, and cannot meet the actual combat needs of security personnel, it will cause security personnel to spend a lot of time and cost on handling the availability of exp.

[0003] There are two main ways to verify the availability of exp in the prior art. One way is to build an environment for verification. However, since a large number of services currently do not provide historical version downloads, the method of building an environment for verification is limited in many scenarios. Another way is to verify the availability of exp through tools such as mock servers or similar tools. However, since the vulnerability library is contributed by security personnel from different regions and there are many types of programming languages, this method requires technicians to have the ability to process exp in multiple languages, which places high demands on technicians. In addition, when faced with complex data interactions or large data verification requirements, there is a defect of low efficiency due to the lack of effective batch processing methods. Summary of the invention

[0004] The purpose of the present application includes, for example, providing an exp availability verification method, device, electronic device and readable storage medium, which can cope with batch processing of a wide variety and large number of exps and improve verification processing efficiency.

[0005] The embodiments of the present application can be implemented as follows:

[0006] In a first aspect, the present application provides an exp availability verification method, the method comprising:

[0007] According to the project requirements, determine the target exp from multiple vulnerability verification program exps contained in the public vulnerability library;

[0008] Compile based on the target exp to obtain a corresponding compilation exp, wherein the compilation exp is compiled in a programming language required by the project;

[0009] Analyze and process the target exp using the pre-trained model to obtain the corresponding return message;

[0010] Construct a return message of the written exp, and compare the return message of the target exp with the return message of the written exp to determine the availability of the written exp.

[0011] In an optional embodiment, the method further includes a step of pre-training to obtain the pre-trained model, the step comprising:

[0012] Selecting some exps from multiple exps included in the public vulnerability library as a data set;

[0013] Dividing the data set into a training set and a test set;

[0014] The pre-training model is trained using the training set, and the result accuracy of the pre-training model is tested using the test set. When the result accuracy reaches a preset threshold, the training of the pre-training model is stopped.

[0015] In an optional implementation, the step of training the pre-trained model using the training set includes:

[0016] For each exp included in the training set, construct a return message of the exp;

[0017] Input the content of each exp into the pre-trained model for processing, and output the return message of the exp;

[0018] The difference between the return message output by the pre-trained model and the constructed return message is compared, and the model parameters of the pre-trained model are adjusted and then the training is continued until the difference is lower than a preset value and the training is stopped.

[0019] In an optional implementation, the step of inputting the content of each exp into the pre-trained model for processing and outputting the return message of the exp includes:

[0020] Obtain the language type of the exp, the content of the exp, and the return message type of the exp;

[0021] The language type, content and return message type of each exp are input into the pre-trained model for processing, and the return message of the exp is output.

[0022] In an optional implementation, before the step of using the training set to train the pre-trained model, the step of pre-training to obtain the pre-trained model further includes:

[0023] For each exp in the data set, the annotation content contained in the exp is cleared.

[0024] In an optional implementation manner, the step of comparing the return message of the target exp with the return message of the written exp to determine the availability of the written exp includes:

[0025] Interacting with the server based on the target exp to obtain a first request message, and interacting with the server based on the written exp to obtain a second request message;

[0026] When the first request message and the return message of the target exp are respectively consistent with the second request message and the return message of the writing exp, it is determined that the writing exp is available.

[0027] In an optional implementation, the step of analyzing and processing the target exp using the pre-trained model obtained in advance to obtain a corresponding return message includes:

[0028] Obtain the language type of the target exp and the return message type of the target exp;

[0029] The language type, content and return message type of the target exp are input into a pre-trained model obtained by pre-training to obtain the return message of the target exp.

[0030] In a second aspect, the present application provides an exp availability verification device, the device comprising:

[0031] The determination module is used to determine the target exp from multiple vulnerability verification program exps contained in the public vulnerability library according to the project requirement information;

[0032] A writing module, used to write based on the target exp to obtain a corresponding writing exp, wherein the writing exp is written in a programming language required by the project;

[0033] A processing module, used to analyze and process the target exp using a pre-trained model to obtain a corresponding return message;

[0034] The judgment module is used to construct the return message of the written exp, and compare the return message of the target exp with the return message of the written exp to judge the availability of the written exp.

[0035] In a third aspect, the present application provides an electronic device comprising one or more storage media and one or more processors communicating with the storage media, wherein the one or more storage media store machine-executable instructions executable by the processor, and when the electronic device is running, the processor executes the machine-executable instructions to perform the method steps described in any one of the aforementioned embodiments.

[0036] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed, the method steps described in any one of the aforementioned embodiments are implemented.

[0037] The beneficial effects of the embodiments of the present application include, for example:

[0038] The present application provides an exp availability verification method, device, electronic device and readable storage medium, which determines the target exp from multiple exps contained in the public vulnerability library according to the project requirement information, and writes based on the target exp to obtain the corresponding writing exp, which is written in the programming language required by the project. And use the pre-trained model obtained in advance to analyze and process the target exp to obtain the corresponding return message, construct the return message of the writing exp, and compare the return message of the target exp and the return message of the writing exp to determine the availability of the writing exp. In the present application, the pre-trained model obtained by training is used to generate a return message, which can cope with the batch processing of a wide variety of exps and a large number of exps, reduce the technical requirements for technicians, and improve the verification processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A flowchart of the exp availability verification method provided in an embodiment of the present application;

[0041] Figure 2 A flowchart of a pre-training model method in the exp availability verification method provided in an embodiment of the present application;

[0042] Figure 3 for Figure 2 Flow chart of sub-steps included in step S103;

[0043] Figure 4 for Figure 3Flow chart of sub-steps included in step S1032;

[0044] Figure 5 for Figure 1 Flow chart of sub-steps included in step S203;

[0045] Figure 6 for Figure 1 Flow chart of sub-steps included in step S204;

[0046] Figure 7 A structural block diagram of an electronic device provided in an embodiment of the present application;

[0047] Figure 8 This is a functional module block diagram of the exp availability verification device provided in an embodiment of the present application.

[0048] Icons: 110 - storage medium; 120 - processor; 130 - exp availability verification device; 131 - determination module; 132 - writing module; 133 - processing module; 134 - judgment module; 140 - communication interface. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0050] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0051] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0052] In the description of the present application, it should be noted that the terms "first", "second", etc., if used, are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0053] It should be noted that, in the absence of conflict, the features in the embodiments of the present application may be combined with each other.

[0054] Figure 1The flowchart of the exp availability verification method provided by the embodiment of the present application is shown, and the verification method can be applied to the terminal equipment, server, etc. used by the technician. It should be understood that in other embodiments, the order of some steps in the exp availability verification method of this embodiment can be interchanged according to actual needs, or some steps can be omitted or deleted. The detailed steps of the exp availability verification method are introduced as follows.

[0055] S201, according to the project requirement information, determine the target exp from multiple vulnerability verification program exps included in the public vulnerability library.

[0056] S202, compiling based on the target exp to obtain a corresponding compiling exp, wherein the compiling exp is compiled in a programming language required by the project.

[0057] S203, using the pre-trained model obtained in advance to analyze and process the target exp to obtain a corresponding return message.

[0058] S204, constructing a return message of the written exp, and comparing the return message of the target exp with the return message of the written exp to determine the availability of the written exp.

[0059] Network attack and defense is to conduct penetration testing on target assets with authorization. The attacker's goal is generally to find asset vulnerabilities, while the defender's goal is to protect the target assets and find and patch the vulnerabilities one step ahead of the attacker. Therefore, it is necessary to use an effective vulnerability verification program exp to detect whether there is a specific vulnerability.

[0060] The public vulnerability database is a vulnerability database that is created to promote the development of the technical security industry and urge manufacturers to fix vulnerabilities as soon as possible. For example, after a period of time after the vulnerability is fixed, security practitioners will put exp or analysis articles into the public vulnerability database for other people to extract and apply. Among them, exp is a vulnerability verification program, which is generally a script written in Python, Java, C and other languages, used to test whether the target service has vulnerabilities. The exp that already exists in the public vulnerability database can be considered to be available, that is, it can successfully implement the test of whether the target service has vulnerabilities.

[0061] When developers develop based on specific projects, they can obtain the required exp, i.e., the target exp, from the public vulnerability library. For example, if the project requirements include data verification, the exp in the public vulnerability library can be extracted to test whether the data verification service has vulnerabilities.

[0062] However, the target exp directly obtained from the public vulnerability library may not be compatible with the project, for example, it may lack some information or be incompatible with the programming language used in the project. Therefore, after obtaining the target exp from the public vulnerability library, you can write it based on the target exp according to the programming language required by the project to get the corresponding written exp.

[0063] Although the original exp in the public vulnerability library is available, the availability of the written exp is uncertain because the written exp is formed by writing. The verification method provided in this application is to verify the availability of the written exp.

[0064] In this embodiment, a pre-trained model can be obtained based on training samples in advance, and the pre-trained model can be a DeBERTa model (Decoding-enhanced BERT with Disentangled Attention). The pre-trained model can output a return message corresponding to exp based on the relevant information of the input model.

[0065] In actual applications, after knowing the content of a specific exp, the technician can construct the corresponding return message. However, due to the wide variety of exp types and various language types in the public database, the technician needs to be proficient in multiple language types, which places high demands on the technician. In addition, if faced with the processing of a large number of exp, it will require a lot of time and manpower costs.

[0066] In this embodiment, a pre-trained model capable of generating a return message is obtained by pre-training, and the return message of the exp can be obtained by using the pre-trained model. Exps of various language types can be processed, and a large number of exps can be processed in batches.

[0067] For example, for the above target exp, the pre-trained model obtained in advance can be used to obtain the return message of the target exp. The return message may include, for example, the http status code, a specific string, the length of the return message, the response time, etc.

[0068] As for the written exp written based on the target exp, since the written exp is written, and its language type is consistent with the project environment, it is a unified language type. In other words, the technical personnel of the project can handle the processing of programs of the language type such as the written exp. Therefore, the return message of the written exp can be obtained by construction.

[0069] In this embodiment, when verifying the availability of the written exp, the verification is mainly performed by comparing the return message of the written exp with the target exp before writing. That is, if the return messages of the exp before and after writing are consistent, it can be determined that the written exp is available.

[0070] In this embodiment, a pre-trained model is obtained by pre-training. The pre-trained model can be used to process various types of exps and can handle a large number of exps, thereby improving the efficiency of verification in applications that verify the availability of written exps.

[0071] Please refer to Figure 2 ,The following first introduces the process of pre-training ,models.

[0072] S101, selecting some exps from a plurality of exps included in the public vulnerability library as a data set.

[0073] S102, dividing the data set into a training set and a test set.

[0074] S103, using the training set to train the pre-trained model, and using the test set to test the result accuracy of the pre-trained model, and when the result accuracy reaches a preset threshold, stopping the training of the pre-trained model.

[0075] From the above, we can see that the exp in the public vulnerability library is available and can be used to train the model. You can get exp from public vulnerability libraries such as github and exploit-db by crawling. You can select some exp from the public vulnerability library as a data set according to your needs.

[0076] Since exp generally contains code part and comment part, the comment part is only for developers or users to quickly understand the program content, but it is not helpful for the actual execution process.

[0077] Therefore, after determining the data set, for each exp in the data set, the annotation content contained in the exp is cleared. In this way, the interference caused by irrelevant information in the exp to the subsequent model training can be reduced.

[0078] After the above cleaning process, the data set can be divided into a training set and a test set, wherein the training set and the test set can be divided according to a ratio set based on requirements.

[0079] First, the pre-trained model is trained using the training set. When the training reaches a certain requirement, the training process is stopped, and the accuracy of the pre-trained model is verified using the test set. If the accuracy of the pre-trained model reaches the preset threshold, the training can be stopped. Otherwise, the model can continue to be trained using the training set, or the training set can be updated and then the updated training set can be used to train the model.

[0080] During the model training process, you can adjust the model parameters, such as adjusting the pooling strategy, selecting other Encoder_layer, or optimizing the training set, to perform multiple iterations of training until the required accuracy is achieved under the test set test. Encoder_layer is the encoding layer in the Bert model, which can convert natural language into digital code and assign different weights, generally 12 / 24.

[0081] In the process of using the training set to train the model, please refer to Figure 3 Specifically, it can be achieved by:

[0082] S1031: For each exp included in the training set, construct a return message of the exp.

[0083] S1032, input the content of each exp into the pre-trained model for processing, and output the return message of the exp.

[0084] S1033, comparing the difference between the return message output by the pre-trained model and the constructed return message, and continuing the training after adjusting the model parameters of the pre-trained model, and stopping the training when the difference is lower than a preset value.

[0085] The input of the pre-trained model is the relevant information of exp, and the output of the model is the return message of exp. During the training process, for each exp input into the pre-trained model, it has a constructed return message, and the constructed return message can be used as the label of exp. After the content of each exp is input into the pre-trained model for processing, the model can output the return message of the exp.

[0086] The standard for judging the quality of pre-trained model training can be the difference between the output return message of the model and the actual return message of exp. That is, the smaller the difference between the output return message of the model and the actual return message of exp, or even if the two are the same, the better the trained model is.

[0087] Therefore, in addition to using the test set to verify the accuracy of the model's results and adjust the model parameters to continue training, you can also adjust the model parameters of the model based on the difference between the return message output by the pre-trained model in the training set and the constructed return message, and then continue training until the difference between the two is lower than the preset value.

[0088] In this embodiment, since the language types of exp in the public vulnerability library are diverse, and the types of return messages also include multiple types, in order to enable the model to learn the characteristic information of different types of exp in a targeted manner, and to subsequently generate return messages for specific types of exp. Therefore, please refer to Figure 4 When training the pre-trained model, the above step S2023 may include the following sub-steps:

[0089] S10321, obtaining the language type of the exp, the content of the exp, and the return message type of the exp.

[0090] S10322, input the language type, content and return message type of each exp into the pre-trained model for processing, and output the return message of the exp.

[0091] In this embodiment, in addition to training the model mainly based on the content of exp, the language type of exp and the return message type of exp can also be added to the input information. Among them, the language type of exp includes python, java, c and other types, and the return message type includes http, socket and other types. The socket connection is the so-called long connection. In theory, once the client and the server establish a connection, they will not be disconnected actively. The http connection is the so-called short connection, that is, the client sends a request to the server, and the connection will be disconnected after the server responds.

[0092] Before inputting the above information into the model, the format of the above information can be converted into the TSV format, and the information in the TSV format can be input into the model for training. Similarly, the format of the return message output after being processed by the model is also in the TSV format.

[0093] In this way, the pre-trained model obtained through training can learn the characteristic information of exps of different language types and different return message types, so that in the subsequent application stage, targeted processing can be formed based on the language type and return message type of the exp to be predicted, thereby improving the accuracy of the results.

[0094] The above process is the process of pre-training to obtain a pre-trained model. After the model training is completed, the pre-trained model can be built as a web service through bert-as-service to facilitate the subsequent batch export of returned message data packets. Among them, bert-as-service is a sentence encoding service that maps variable-length sentences to fixed-length vectors. With the help of its framework, the model can be quickly deployed as a cloud service.

[0095] The pre-trained model deployed as a web cloud service can be used to generate the return message of the exp in the actual prediction stage, such as the return message of the target exp mentioned above. For details, please refer to Figure 5 In the above step S203, when the target exp is predicted using the pre-trained model obtained in advance, it can be achieved by the following steps:

[0096] S2031, obtaining the language type of the target exp and the return message type of the target exp.

[0097] S2032, input the language type, content and return message type of the target exp into a pre-trained model to obtain a return message of the target exp.

[0098] Similar to the model training process, when you need to predict the return message of the target exp, you need to obtain the language type of the target exp and the return message type of the target exp. Then convert the language type, return message type and target exp content of the target exp into tsv format, and input the converted information into the pre-trained model. After being processed by the pre-trained model, the return message of the target exp can be output.

[0099] From the above, we can know that the written message based on the target exp needs to be constructed to get the return message. When verifying the availability of the written exp, you can make a judgment by comparing the return message of the written exp with the return message of the target exp. For details, please refer to Figure 6 , this step can be achieved by:

[0100] S2041, interacting with the server based on the target exp to obtain a first request message, and interacting with the server based on the written exp to obtain a second request message.

[0101] S2042: When the first request message and the return message of the target exp are respectively consistent with the second request message and the return message of the written exp, it is determined that the written exp is available.

[0102] In this embodiment, the system may include a mock server, which is a test method that uses a virtual object to create a test for some objects that are not easy to construct or obtain during the test process. Alternatively, the system may also include an http server built using Python.

[0103] Based on the target exp, the mock server or http server can be interacted with to obtain the first request message. For example, the return message can be sent to the server in yaml format to determine the first request message. Similarly, for writing exp, the mock server or http server can be interacted with to obtain the second request message based on the writing exp.

[0104] The first request message of the target exp and the second request message of the written exp, the return message of the target exp and the return message of the written exp can be compared respectively. If they are consistent, it can be judged that the written exp is available, otherwise, it can be judged that the written exp is not available.

[0105] The exp availability verification method provided in this embodiment can realize the generation of the return message of the exp by using the pre-trained model obtained through training, such as the DeBERTa model, in an artificial intelligence manner. Therefore, the availability of the written exp can be judged by comparing the return messages of the exp before and after writing. In this scheme, the return message is generated by using the pre-trained model, which can realize the processing of a wide variety of exps with a large number of types, and it is not necessary to require technical personnel to master the processing technology of exps of various language types, thereby reducing the technical requirements for technical personnel. In addition, batch processing can be realized, which greatly reduces labor costs, saves verification time, and improves the processing efficiency of verification. In addition, it can prevent malicious organizations and defenders from using false exps to attack security personnel.

[0106] See also Figure 7 , is a schematic diagram of an exemplary component of an electronic device provided in an embodiment of the present application, and the electronic device may be a terminal device or a server used by the above-mentioned technicians, etc. The electronic device may include a storage medium 110, a processor 120, an exp availability verification device 130 and a communication interface 140. In this embodiment, the storage medium 110 and the processor 120 are both located in the electronic device and the two are separately arranged. However, it should be understood that the storage medium 110 may also be independent of the electronic device and can be accessed by the processor 120 through a bus interface. Alternatively, the storage medium 110 may also be integrated into the processor 120, for example, it may be a cache and / or a general register.

[0107] The exp availability verification device 130 can be understood as the above-mentioned electronic device, or the processor 120 of the electronic device, and can also be understood as a software function module independent of the above-mentioned electronic device or processor 120 that implements the above-mentioned exp availability verification method under the control of the electronic device.

[0108] like Figure 8 As shown, the exp availability verification device 130 may include a determination module 131, a writing module 132, a processing module 133 and a judgment module 134. The functions of each functional module of the exp availability verification device 130 are described in detail below.

[0109] The determination module 131 is used to determine the target exp from multiple vulnerability verification program exps included in the public vulnerability library according to project requirement information.

[0110] It can be understood that the determination module 131 can be used to execute the above step S201. The detailed implementation of the determination module 131 can refer to the above content related to step S201.

[0111] The writing module 132 is used to write based on the target exp to obtain a corresponding writing exp, wherein the writing exp is written in a programming language required by the project.

[0112] It can be understood that the writing module 132 can be used to execute the above step S202. The detailed implementation of the writing module 132 can refer to the above content related to step S202.

[0113] The processing module 133 is used to analyze and process the target exp using the pre-trained model to obtain a corresponding return message.

[0114] It can be understood that the processing module 133 can be used to execute the above step S203. The detailed implementation of the processing module 133 can refer to the above content related to step S203.

[0115] The judgment module 134 is used to construct the return message of the written exp, and compare the return message of the target exp with the return message of the written exp to determine the availability of the written exp.

[0116] It can be understood that the judgment module 134 can be used to execute the above step S204. The detailed implementation of the judgment module 134 can refer to the above content related to step S204.

[0117] In a possible implementation, the device further includes a training module for pre-training to obtain the pre-trained model, and the training model can be specifically used for:

[0118] Selecting some exps from multiple exps included in the public vulnerability library as a data set;

[0119] Dividing the data set into a training set and a test set;

[0120] The pre-training model is trained using the training set, and the result accuracy of the pre-training model is tested using the test set. When the result accuracy reaches a preset threshold, the training of the pre-training model is stopped.

[0121] In a possible implementation, the training module may specifically train the pre-trained model using the training set in the following manner:

[0122] For each exp included in the training set, construct a return message of the exp;

[0123] Input the content of each exp into the pre-trained model for processing, and output the return message of the exp;

[0124] The difference between the return message output by the pre-trained model and the constructed return message is compared, and the model parameters of the pre-trained model are adjusted and then the training is continued until the difference is lower than a preset value and the training is stopped.

[0125] In a possible implementation, the above training module may be specifically used for:

[0126] Obtain the language type of the exp, the content of the exp, and the return message type of the exp;

[0127] The language type, content and return message type of each exp are input into the pre-trained model for processing, and the return message of the exp is output.

[0128] In a possible implementation, the above training module may also be used for:

[0129] For each exp in the data set, the annotation content contained in the exp is cleared.

[0130] In a possible implementation manner, the above-mentioned determination module 134 may be specifically used for:

[0131] Interacting with the server based on the target exp to obtain a first request message, and interacting with the server based on the written exp to obtain a second request message;

[0132] When the first request message and the return message of the target exp are respectively consistent with the second request message and the return message of the writing exp, it is determined that the writing exp is available.

[0133] In a possible implementation manner, the processing module 133 may be specifically used for:

[0134] Obtain the language type of the target exp and the return message type of the target exp;

[0135] The language type, content and return message type of the target exp are input into a pre-trained model obtained by pre-training to obtain the return message of the target exp.

[0136] In an embodiment of the present application, corresponding to the above-mentioned exp availability verification method, a computer-readable storage medium is also provided, in which a computer program is stored, and when the computer program is run, each step of the above-mentioned exp availability verification method is executed.

[0137] Among them, the steps executed when the aforementioned computer program is running will not be described one by one here, and reference can be made to the explanation of the exp availability verification method in the previous article.

[0138] In summary, the exp availability verification method, device, electronic device and readable storage medium provided in the embodiments of the present application determine the target exp from multiple exps contained in the public vulnerability library according to the project requirement information, and write based on the target exp to obtain the corresponding writing exp, which is written in the programming language required by the project. And use the pre-trained model obtained in advance to analyze and process the target exp to obtain the corresponding return message, construct the return message of the writing exp, and compare the return message of the target exp and the return message of the writing exp to determine the availability of the writing exp. In the present application, the pre-trained model obtained by training is used to generate a return message, which can cope with the batch processing of a wide variety of exps and a large number of exps, reduce the technical requirements for technicians, and improve the verification processing efficiency.

[0139] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for verifying the availability of exp, characterized in that: The method comprises: According to the project requirements, determine the target exp from multiple vulnerability verification program exps contained in the public vulnerability library; Compile based on the target exp to obtain a corresponding compilation exp, wherein the compilation exp is compiled in a programming language required by the project; Analyze and process the target exp using the pre-trained model to obtain the corresponding return message; Construct a return message of the written exp, and compare the return message of the target exp with the return message of the written exp to determine the availability of the written exp.

2. The exp availability verification method according to claim 1, characterized in that: The method further comprises a step of pre-training to obtain the pre-trained model, the step comprising: Selecting some exps from multiple exps included in the public vulnerability library as a data set; Dividing the data set into a training set and a test set; The pre-training model is trained using the training set, and the result accuracy of the pre-training model is tested using the test set. When the result accuracy reaches a preset threshold, the training of the pre-training model is stopped.

3. The exp availability verification method according to claim 2, characterized in that: The step of using the training set to train the pre-trained model comprises: For each exp included in the training set, construct a return message of the exp; Input the content of each exp into the pre-trained model for processing, and output the return message of the exp; The difference between the return message output by the pre-trained model and the constructed return message is compared, and the model parameters of the pre-trained model are adjusted and then the training is continued until the difference is lower than a preset value and the training is stopped.

4. The exp availability verification method according to claim 3, characterized in that: The step of inputting the content of each exp into the pre-trained model for processing and outputting the return message of the exp includes: Obtain the language type of the exp, the content of the exp, and the return message type of the exp; The language type, content and return message type of each exp are input into the pre-trained model for processing, and the return message of the exp is output.

5. The exp availability verification method according to claim 2, characterized in that: Before the step of using the training set to train the pre-trained model, the step of pre-training to obtain the pre-trained model also includes: For each exp in the data set, the annotation content contained in the exp is cleared.

6. The exp availability verification method according to claim 1, characterized in that: The step of comparing the return message of the target exp with the return message of the written exp to determine the availability of the written exp includes: Interacting with the server based on the target exp to obtain a first request message, and interacting with the server based on the written exp to obtain a second request message; When the first request message and the return message of the target exp are respectively consistent with the second request message and the return message of the writing exp, it is determined that the writing exp is available.

7. The exp availability verification method according to claim 1, characterized in that: The step of analyzing and processing the target exp using the pre-trained model to obtain a corresponding return message includes: Obtain the language type of the target exp and the return message type of the target exp; The language type, content and return message type of the target exp are input into a pre-trained model obtained by pre-training to obtain the return message of the target exp.

8. An exp availability verification device, characterized in that: The device comprises: The determination module is used to determine the target exp from multiple vulnerability verification program exps contained in the public vulnerability library according to the project requirement information; A writing module, used to write based on the target exp to obtain a corresponding writing exp, wherein the writing exp is written in a programming language required by the project; A processing module, used to analyze and process the target exp using a pre-trained model to obtain a corresponding return message; The judgment module is used to construct the return message of the written exp, and compare the return message of the target exp with the return message of the written exp to judge the availability of the written exp.

9. An electronic device, characterized in that: The electronic device comprises one or more storage media and one or more processors communicating with the storage media, wherein the one or more storage media store machine executable instructions executable by the processor, and when the electronic device is running, the processor executes the machine executable instructions to perform the method steps described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine-executable instructions, and when the machine-executable instructions are executed, the method steps described in any one of claims 1 to 7 are implemented.

Images