Attack tool automatic mapping and calling method and device based on MITRE ATTCK framework and large language model

Abstract

The invention discloses a method based on MITRE ATTamp; the invention discloses an automatic mapping and calling method and device for an attack tool of a CK framework and a large language model. The method comprises the following steps: based on a function and a use document of the attack tool and MITRE ATTamp; data collection is carried out on the technical description in the CK framework, vector representation and cosine similarity calculation are carried out, so that the similarity between the attack tool description and the technical description is accurately captured, and the attack tool is automatically mapped to MITRE ATTamp; the technology of CK; an attack scene input by a user is analyzed by using a large language model, an attack tool is automatically selected and called, an attack tool execution command is generated, and subsequent automatic attacks are supported; the large model real-time calling attack tool comprises the following steps: collecting data; performing pretreatment; vector representation of an attack tool; calculating cosine similarity; and calling the large model in real time. According to the method, the attack scene input by the user is analyzed by using the large language model, the tool is automatically selected and called, the tool execution command is generated, and a variable network attack environment can be quickly responded and adapted.

Description

Technical Field

[0001] The present invention belongs to the technical field of machine learning, and in particular relates to an automatic mapping and calling method and device for attack tools based on the MITRE ATT&CK framework and a large language model. Background Art

[0002] With the continuous evolution of network attack technology, network attack and defense confrontation has become more and more complex. In the current network attack and defense environment, there are many types of attack tools, and the functions and usage of each tool are also different. Traditional attack tool selection and strategy design usually rely on the experience and manual analysis of security experts. This method is not only inefficient, but also prone to analysis omissions. As a knowledge base that systematically describes attacker behavior, the MITRE ATT&CK framework provides a standardized technical reference for attack simulation and defense. Although there have been many studies in the prior art that map attack paths or attack activities to the ATT&CK framework, there are relatively few technologies that map specific attack tools to the MITRE ATT&CK framework, and realizing automated calls is still a complex and time-consuming problem. With the development of big data and artificial intelligence technologies, analyzing and calling attack tools through automated means can significantly improve the efficiency and effectiveness of attacks, and provide basic support for the subsequent construction of network attack and defense automated orchestration systems.

[0003] Looking at the development of the MITRE ATT&CK mapping field, research on related technologies can be divided into the following categories. i: Manual mapping: Early research mainly relied on manual analysis by security experts to map attack behaviors to the MITRE ATT&CK framework. Although this method is accurate, it is inefficient and error-prone, and cannot meet the needs of rapid response. ii: Rule-based automated mapping: Information in threat intelligence is automatically mapped to MITRE ATT&CK technology through preprocessing technology and traditional machine learning algorithms. Although these tools can process large amounts of text data, they are insufficient in capturing text dependencies and contextual understanding. iii: Large-scale language model-assisted mapping: In recent years, researchers have begun to use large-scale language models to automatically map vulnerabilities to MITRE ATT&CK technology, improving the accuracy of mapping. IV: Integrated tools and platforms: Use centralized platforms to display and explore the mapping of security capabilities and ATT&CK technologies. However, none of these methods involve automated mapping of attack tools to MITRE ATT&CK technologies.

[0004] Looking at the development trends in the field of automated attacks based on large language models, research on related technologies can be divided into the following categories: i: Early stage attack automation: Using large models to generate phishing emails, malicious code, and social engineering attacks. Although this method can improve the concealment and success rate of attacks, it is difficult to control the generated content and is prone to generating misleading or invalid attack content. ii: Attack behavior and path mapping: Using large models to automatically map attack behaviors and paths to the MITRE ATT&CK framework. This method is insufficient in capturing text dependencies and context understanding, and cannot fully understand complex attack behaviors. iii: Late stage attack automation: Using LLMs to automatically execute complex attack steps in different network environments, and can generate commands executed by attack tools to adapt to different network environments, but it only simulates the simple part of ATT&CK and does not realize automatic selection and calling of attack tools. Summary of the invention

[0005] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and provide an automatic mapping and calling method and device for attack tools based on the MITRE ATT&CK framework and a large language model. The present invention uses a large language model to parse the attack scenarios input by the user, automatically selects and calls tools, generates tool execution commands, and can quickly respond to and adapt to the changing network attack environment.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] The present invention provides an automatic mapping and calling method for attack tools based on the MITRE ATT&CK framework and a large language model, comprising the following steps:

[0008] Data is collected based on the functions and usage documents of attack tools and the technical descriptions in the MITRE ATT&CK framework. Vector representation and cosine similarity calculation are performed on this basis to accurately capture the similarities between attack tool descriptions and technical descriptions, and automatically map attack tools to MITRE ATT&CK technologies.

[0009] Use a large language model to parse the attack scenarios input by the user, automatically select and call attack tools, generate attack tool execution commands, and support subsequent automated attacks; the real-time call of attack tools by the large model includes: data collection; preprocessing; vector representation of the attack tool, which is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; and real-time call of the large model.

[0010] As a preferred technical solution, the step of automatically mapping the attack tool to the MITRE ATT&CK technology also includes the following:

[0011] Removing irrelevant information through preprocessing techniques, and using word frequency-inverse document frequency technology and Word2vec technology to convert text descriptions into vector representations;

[0012] Automatically map tools to ATT&CK techniques by calculating cosine similarity between vectors.

[0013] As a preferred technical solution, the data collection is specifically as follows:

[0014] Collect the functional description and usage documentation of the attack tools, as well as the description of the technology in the MITRE ATT&CK framework, which are represented as text sets D tool and D tech .

[0015] As a preferred technical solution, the pretreatment is specifically:

[0016] The "Description" of MITRE techniques and the "Description" of attack tools contain pause words that appear frequently in the text but do not contribute to its meaning;

[0017] The stop word list is the same as the list defined in the NLTK library, denoted as S stopwords ;

[0018] Added some domain-specific words to the list;

[0019] Remove low-occurrence words whose frequency is below a predefined threshold;

[0020] Filter out punctuation and numbers, put verbs in their original form, and convert all text to lowercase.

[0021] As a preferred technical solution, the vector representation is specifically:

[0022] First, we calculate the TF-IDF scores of all words in the full description of each attack tool and extract nouns with scores above a predefined threshold. These words are called keywords K. tool ;

[0023] Second, we enrich each description using a Word2vec model trained on MITRE technical descriptions and tool descriptions. Word2vec is a word embedding model that represents words with vectors of multiple dimensions based on word co-occurrence. In the Word2vec vector representation, words that co-occur highly in the training text will get similar vectors to find words similar to those in the full description of the attack tool. We extend the full description of each attack tool by adding words that are similar to the description keywords and have a similarity above a predefined threshold.

[0024] Finally, the TF-IDF vector and Word2Vec vector of each attack tool are combined to generate the final vector representation; a weighted summation method is used: V final =α·V TF-IDF +β·V Word2Vec , where α and β are weight parameters that adjust the contribution of TF-IDF vectors and Word2Vec vectors, and each tool outputs a vector V tool .

[0025] As a preferred technical solution, the cosine similarity calculation is specifically as follows:

[0026] Let the vector of the attack tool be represented as V tool , the vector representation of MITRE ATT&CK technology is V tech , then the cosine similarity calculation formula between them is:

[0027]

[0028] Among them, V tool ·V tech represents the dot product of two vectors, ||V tool || and ||V tech || respectively represent the Euclidean norm of the vector, that is, the length of the vector;

[0029] Output all MITRE ATT&CK techniques based on their similarity to the attack tool, map the attack tool to the technique with the highest similarity, or adjust it based on the actual situation and map it to several techniques.

[0030] As a preferred technical solution, the real-time calling of the large model is specifically as follows:

[0031] First, it receives and parses the attack scenarios or specific requirements input by the user, and uses a large language model to understand and extract the attack intent, key targets, and context information.

[0032] Next, these intentions are matched with the techniques in the MITRE ATT&CK framework. By querying the matching relationships obtained above, attack tools that are highly relevant to the user's target technology are prioritized.

[0033] Then, generate corresponding attack tools and strategies as well as execution commands to support automated attacks;

[0034] Finally, monitor in real time and adjust attack tool selection and attack strategy based on feedback.

[0035] In the second aspect, the present invention proposes an attack tool automatic mapping and calling system based on the MITRE ATT&CK framework and the large language model, which is applied to the attack tool automatic mapping and calling method based on the MITRE ATT&CK framework and the large language model, including an attack tool automatic mapping module and a large model real-time calling attack tool module;

[0036] The attack tool automated mapping module is used to collect data based on the function and usage documentation of the attack tool and the technical description in the MITRE ATT&CK framework, and perform vector representation and cosine similarity calculation on this basis, so as to accurately capture the similarity between the attack tool description and the technical description, and automatically map the attack tool to the technology of MITRE ATT&CK;

[0037] The large model real-time calling attack tool module is used to use the large language model to parse the attack scenario input by the user, automatically select and call the attack tool, generate the attack tool execution command, and support subsequent automated attacks; the large model real-time calling attack tool includes: data collection; preprocessing; vector representation of the attack tool, the vector representation of the attack tool is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; large model real-time calling.

[0038] In a third aspect, the present invention provides an electronic device, comprising:

[0039] at least one processor; and,

[0040] a memory communicatively connected to the at least one processor; wherein,

[0041] The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the attack tool automation mapping and calling method based on the MITRE ATT&CK framework and the large language model.

[0042] In a fourth aspect, the present invention provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the automated mapping and calling method of attack tools based on the MITRE ATT&CK framework and large language model.

[0043] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0044] 1. The process of automatic mapping of attack tools to the MITRE ATT&CK framework is relatively detailed in this invention. Through natural language processing technologies such as TF-IDF and Word2vec, the similarities between tool descriptions and ATT&CK technical descriptions are accurately captured, greatly improving the automation and accuracy of the mapping process.

[0045] 2. In terms of tool calling, the present invention uses a large language model to parse the attack scenarios input by the user, automatically selects and calls tools, generates tool execution commands, and can quickly respond to and adapt to changing network attack environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0047] Figure 1 A flowchart of an automatic mapping and calling method of attack tools based on the MITRE ATT&CK framework and a large language model according to an embodiment of the present invention;

[0048] Figure 2 The block diagram of the attack tool automatic mapping and calling system based on the MITRE ATT&CK framework and the large language model according to an embodiment of the present invention.

[0049] Figure 3 4 is a structural diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0051] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0052] like Figure 1 As shown, this embodiment provides an automatic mapping and calling method for attack tools based on the MITRE ATT&CK framework and the large language model. First, the method collects data based on the function and usage documents of the attack tool and the MITRE ATT&CK technical description, and then performs vector representation and cosine similarity calculation on this basis, so as to accurately capture the similarity between the tool description and the technical description, and automatically map the tool to the MITRE ATT&CK technology; secondly, the large language model is used to parse the attack scenario input by the user, automatically select and call the tool, generate the tool execution command, and support subsequent automated attacks; specifically, the method includes the following steps:

[0053] S1. Attack tool automation mapping to MITRE ATT&CK techniques;

[0054] Specifically, we first collected the functions and usage documents of the attack tools, as well as the detailed descriptions of the technologies in the MITRE ATT&CK framework; then, we used preprocessing technology to remove irrelevant information, and used the word frequency-inverse document frequency (TF-IDF) technology and Word2vec technology to convert the text description into a vector representation; in addition, we calculated the cosine similarity between vectors to achieve automatic mapping from tools to ATT&CK technologies. This process not only improves the degree of automation of the mapping, but also improves the accuracy of the matching, providing a basis for subsequent tool calls.

[0055] S2. Real-time call tool of large model, using large language model to parse attack scenarios input by users, automatically select and call attack tools, generate attack tool execution commands, and support subsequent automated attacks. Specifically include:

[0056] S2.1, data collection;

[0057] Specifically, data collection mainly collects the functional description and usage documentation of attack tools, as well as the description of technologies in the MITRE ATT&CK framework, which are represented as text sets D tool and D tech

[0058] S2.2 Preprocessing;

[0059] Specifically, the “Description” of the MITRE technique and the “Description” of the attack tool contain many non-essential words that may negatively affect the mapping. These words are called stop words and are defined as words that appear frequently in the text but do not contribute to its meaning. Examples of stop words are verbs (e.g., do) and prepositions (e.g., about, in, and, below). Our list of stop words is the same as the one defined in the NLTK library, denoted as S stopwords. We also added some domain-specific words to the list, such as "windows" and "c". We also cleaned out low-occurrence words whose frequency was below a predefined threshold, which we denote as the minimum word frequency. Low-occurrence words increase the spatial complexity of our task but do not contribute to the overall result. Finally, we filtered out punctuation and numbers, put verbs in their original form, and converted all text to lowercase.

[0060] We represent each MITRE technique by its main description and a description of a procedural example. The procedural example of a technique is a brief description of the process of using the corresponding technique and how to use it. For a technique with sub-techniques, we merge the descriptions of all sub-techniques and append them to the description of the parent technique. We merge the attack tool’s functionality and usage documentation as the textual description of the attack tool. The final standardized textual representation is D′ tool and D ′t e ch.

[0061] S2.3, vector representation;

[0062] We represent each MITRE technology with a vector. Each index of the vector corresponds to a word, and its value is the TF-IDF score of the word. The TF-IDF score reflects the importance of a word in a document relative to other documents. This importance is measured by how often the word appears in the current document compared to other documents. The TF-IDF score of word w in document d in document set S is:

[0063] tf-idf(w,d,S)=tf(w,d).idf(w,S)

[0064] in:

[0065] tf(w,d)=log(1+freq(w,d))

[0066]

[0067] Where freq(w, d) is the number of times word w appears in document d, count(d∈S:ω∈d) is the number of documents containing word ω, and N is the number of documents in the document set S. Therefore, the TF score corresponds to the frequency of a word in a document, and the IDF score corresponds to the number of documents containing the word. The TF score is proportional to the frequency of occurrence, while the IDF score is inversely proportional to the number of documents containing the word. Use the filtered text description D′ tech To generate the TF-IDF vector, the vector representation of MITRE technology m1 is:

[0068]

[0069] We only keep the words with the highest scores in each technical representation and set the scores of the other words to zero.

[0070] We extract the vector representation of each attack tool through three steps: keyword extraction, expansion, and TF-IDF extraction. First, we calculate the TF-IDF scores of all words in the full description of each attack tool and extract nouns with scores above a predefined threshold. These words are called keywords K. tool . Secondly, we enrich each description using a Word2vec model trained on MITRE technical descriptions and tool descriptions. Word2vec is a word embedding model that represents words with vectors of multiple dimensions based on word co-occurrence. In the Word2vec vector representation, words that co-occur highly in the training text will get similar vectors. This behavior helps us find words that are similar to the words in the full description of the tool. We extend the full description of each tool by adding words that are similar to the description keywords and whose similarity is higher than a predefined threshold. The Word2vec vector representation is: Among them, M Word2Vec is the Word2Vec model, K′ tool is the expanded keyword list. Finally, we combine the TF-IDF vector of each tool with the Word2Vec vector to generate the final vector representation. Using weighted summation: V final =α·V TF-IDF +β·V Word2Vec , where α and β are weight parameters that adjust the contribution of TF-IDF vectors and Word2Vec vectors. Finally, a vector V is output for each tool. tool , similar to the previous MITRE technology vector representation.

[0071] The vector representation of an attack tool is generated by calculating the average of all feature vectors in the tool description. When calculating the average vector, all elements with a value of 0 are ignored. For example, suppose an attack tool contains 3 descriptive features, and the first element of each feature vector has a value of 20%, 30%, and 0, respectively, then the first element of the generated tool vector will have a value of 25%.

[0072] S2.4, cosine similarity calculation;

[0073] Next, calculate the cosine similarity between the tool vector and all MITRE ATT&CK technique vectors. The higher the similarity, the more likely the tool is mapped to a specific technique. The cosine similarity is calculated as follows:

[0074] Suppose the vector of the attack tool is represented by V tool , the vector representation of MITRE ATT&CK technology is V tech, then the cosine similarity calculation formula between them is:

[0075]

[0076] Among them, V tool ·V tech represents the dot product of two vectors, ||V tool || and ||V tech || respectively represent the Euclidean norm of the vector, that is, the length of the vector.

[0077] Finally, all MITRE ATT&CK techniques are output based on their similarity to the tool, and the tool is mapped to the technique with the highest similarity. It can also be adjusted according to the actual situation and mapped to several techniques. This method ensures an accurate match between the tool description and the ATT&CK technique, thereby improving the automation and accuracy of the mapping.

[0078] S2.5, Real-time call of large models

[0079] First, the attack scenario or specific requirements input by the user are received and parsed, and the attack intent, key targets, and context information are understood and extracted through the large language model. Then, these intentions are matched with the technologies in the MITRE ATT&CK framework. Here, by querying the matching relationship obtained above, attack tools that are highly related to the user's target technology are preferentially selected. The tool selection formula is:

[0080]

[0081] T is a collection of all available attack tools. tool is a specific tool in this set. The formula will traverse all available tool sets and calculate the cosine similarity between each tool and the relevant MITRE ATT&CK technology obtained above, and then select the tool set T with the highest similarity. tools .

[0082] Then, the corresponding tools, strategies and execution commands are generated to support automated attacks; finally, real-time monitoring is performed and tool selection and attack strategies are adjusted based on feedback to ensure the flexibility and accuracy of the simulation process. These steps enable intelligent calling and dynamic adjustment of attack tools.

[0083] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0084] Based on the same idea as the automatic mapping and calling method of attack tools based on the MITRE ATT&CK framework and large language model in the above-mentioned embodiment, the present invention also provides an automatic mapping and calling system for attack tools based on the MITRE ATT&CK framework and large language model, which can be used to execute the automatic mapping and calling method for attack tools based on the MITRE ATT&CK framework and large language model. For ease of explanation, the structural diagram of the embodiment of the automatic mapping and calling system for attack tools based on the MITRE ATT&CK framework and large language model only shows the parts related to the embodiment of the present invention. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than the illustrated structure, or combine certain components, or arrange the components differently.

[0085] See also Figure 2 In another embodiment of the present application, there is provided an attack tool automation mapping and calling system 100 based on the MITRE ATT&CK framework and the large language model, the system comprising an attack tool automation mapping module 101 and a large model real-time calling attack tool module 102;

[0086] The attack tool automated mapping module 101 is used to collect data based on the function and usage documents of the attack tool and the technical description in the MITRE ATT&CK framework, and perform vector representation and cosine similarity calculation on this basis, so as to accurately capture the similarity between the attack tool description and the technical description, and automatically map the attack tool to the technology of MITRE ATT&CK;

[0087] The large model real-time calling attack tool module 102 is used to use the large language model to parse the attack scenario input by the user, automatically select and call the attack tool, generate the attack tool execution command, and support subsequent automated attacks; the large model real-time calling attack tool includes: data collection; preprocessing; vector representation of the attack tool, the vector representation of the attack tool is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; large model real-time calling.

[0088] It should be noted that the attack tool automatic mapping and calling system based on the MITRE ATT&CK framework and large language model of the present invention corresponds one to one with the attack tool automatic mapping and calling method based on the MITRE ATT&CK framework and large language model of the present invention. The technical features and beneficial effects described in the embodiment of the attack tool automatic mapping and calling method based on the MITRE ATT&CK framework and large language model are applicable to the embodiment of the attack tool automatic mapping and calling based on the MITRE ATT&CK framework and large language model. For specific contents, please refer to the description in the embodiment of the method of the present invention, which will not be repeated here. Hereby declared.

[0089] In addition, in the implementation of the attack tool automatic mapping and calling system based on the MITRE ATT&CK framework and the large language model in the above-mentioned embodiment, the logical division of each program module is only an example. In actual applications, the above-mentioned functions can be assigned to different program modules as needed, for example, for the convenience of corresponding hardware configuration requirements or software implementation. That is, the internal structure of the attack tool automatic mapping and calling system based on the MITRE ATT&CK framework and the large language model is divided into different program modules to complete all or part of the functions described above.

[0090] See also Figure 3 In one embodiment, an electronic device that implements an automatic mapping and calling method for attack tools based on the MITRE ATT&CK framework and a large language model is provided. The electronic device 200 may include a first processor 201, a first memory 202, and a bus, and may also include a computer program stored in the first memory 202 and executable on the first processor 201, such as an automatic mapping and calling program 203 for attack tools based on the MITRE ATT&CK framework and a large language model.

[0091] The first memory 202 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, mobile hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), magnetic memory, disk, optical disk, etc. In some embodiments, the first memory 202 may be an internal storage unit of the electronic device 200, such as a mobile hard disk of the electronic device 200. In other embodiments, the first memory 202 may also be an external storage device of the electronic device 200, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 200. Further, the first memory 202 may also include both an internal storage unit of the electronic device 200 and an external storage device. The first memory 202 can not only be used to store application software and various types of data installed in the electronic device 200, such as the code of the automatic mapping and calling program 203 of the attack tool based on the MITRE ATT&CK framework and the large language model, but also can be used to temporarily store data that has been output or is to be output.

[0092] In some embodiments, the first processor 201 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips, etc. The first processor 201 is the control core (Control Unit) of the electronic device, and uses various interfaces and lines to connect various components of the entire electronic device, and executes various functions and processes data of the electronic device 200 by running or executing programs or modules stored in the first memory 202, and calling data stored in the first memory 202.

[0093] Figure 3 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 3 The structure shown does not constitute a limitation on the electronic device 200 , and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0094] The attack tool automatic mapping and calling program 203 based on the MITRE ATT&CK framework and the large language model stored in the first memory 202 of the electronic device 200 is a combination of multiple instructions. When running in the first processor 201, it can achieve:

[0095] Data is collected based on the functions and usage documents of attack tools and the technical descriptions in the MITRE ATT&CK framework. Vector representation and cosine similarity calculation are performed on this basis to accurately capture the similarities between attack tool descriptions and technical descriptions, and automatically map attack tools to MITRE ATT&CK technologies.

[0096] Use a large language model to parse the attack scenarios input by the user, automatically select and call attack tools, generate attack tool execution commands, and support subsequent automated attacks; the real-time call of attack tools by the large model includes: data collection; preprocessing; vector representation of the attack tool, which is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; and real-time call of the large model.

[0097] Furthermore, if the module / unit integrated in the electronic device 200 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0098] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0099] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0100] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. An automated attack tool mapping and calling method based on the MITRE ATT&CK framework and large language model, characterized in that: The steps include: Data is collected based on the functions and usage documents of attack tools and the technical descriptions in the MITRE ATT&CK framework. Vector representation and cosine similarity calculation are performed on this basis to accurately capture the similarities between attack tool descriptions and technical descriptions, and automatically map attack tools to MITRE ATT&CK technologies. Use a large language model to parse the attack scenarios entered by the user, automatically select and call attack tools, generate attack tool execution commands, and support subsequent automated attacks; The real-time calling of attack tools by a large model includes: data collection; preprocessing; vector representation of the attack tool, which is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; and real-time calling of the large model.

2. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1 is characterized in that: The steps of automatically mapping attack tools to MITRE ATT&CK technologies also include the following: Removing irrelevant information through preprocessing techniques, and using word frequency-inverse document frequency technology and Word2vec technology to convert text descriptions into vector representations; Automatically map tools to ATT&CK techniques by calculating cosine similarity between vectors.

3. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1 is characterized in that: The data collection specifically includes: Collect the functional description and usage documentation of the attack tools, as well as the description of the technology in the MITRE ATT&CK framework, which are represented as text sets D tool and D tech .

4. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1 is characterized in that: The pre-processing is specifically as follows: The "Description" of a MITRE technique and the "Description" of an attack tool contain pause words that appear frequently in the text but do not contribute to its meaning; The stop word list is the same as the list defined in the NLTK library, denoted as S stopwords ; Added some domain-specific words to the list; Remove low-occurrence words whose frequency is below a predefined threshold; Filter out punctuation and numbers, put verbs in their original form, and convert all text to lowercase.

5. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1 is characterized in that: The vector representation is specifically: First, we calculate the TF-IDF scores of all words in the full description of each attack tool and extract nouns with scores above a predefined threshold. These words are called keywords K. tool ; Second, we enrich each description using a Word2vec model trained on MITRE technical descriptions and tool descriptions. Word2vec is a word embedding model that represents words with vectors of multiple dimensions based on word co-occurrence. In the Word2vec vector representation, words that co-occur highly in the training text will get similar vectors to find words similar to those in the full description of the attack tool. We extend the full description of each attack tool by adding words that are similar to the description keywords and have a similarity above a predefined threshold. Finally, the TF-IDF vector and Word2Vec vector of each attack tool are combined to generate the final vector representation; a weighted summation method is used: V final =α·V TF-IDF +β·V Word2Vec , where α and β are weight parameters that adjust the contribution of TF-IDF vectors and Word2Vec vectors, and each tool outputs a vector V tool .

6. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1 is characterized in that: The cosine similarity calculation is specifically as follows: Suppose the vector of the attack tool is represented by V tool , the vector representation of MITRE ATT&CK technology is V tech , then the cosine similarity calculation formula between them is: Among them, V tool ·V tech represents the dot product of two vectors, ||V tool || and ||V tech || respectively represent the Euclidean norm of the vector, that is, the length of the vector; Output all MITRE ATT&CK techniques based on their similarity to the attack tool, map the attack tool to the technique with the highest similarity, or adjust it based on the actual situation and map it to several techniques.

7. The attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model according to claim 1, characterized in that: The real-time calling of the large model is specifically as follows: First, it receives and parses the attack scenarios or specific requirements input by the user, and uses a large language model to understand and extract the attack intent, key targets, and context information. Next, these intentions are matched with the techniques in the MITRE ATT&CK framework. By querying the matching relationships obtained above, attack tools that are highly relevant to the user's target technology are prioritized. Then, generate corresponding attack tools and strategies as well as execution commands to support automated attacks; Finally, monitor in real time and adjust attack tool selection and attack strategy based on feedback.

8. An automated attack tool mapping and calling system based on the MITRE ATT&CK framework and large language model, characterized by: An automatic attack tool mapping and calling method based on the MITRE ATT&CK framework and a large language model, applied to any one of claims 1 to 7, comprising an automatic attack tool mapping module and a large model real-time attack tool calling module; The attack tool automated mapping module is used to collect data based on the functions and usage documents of the attack tool and the technical descriptions in the MITRE ATT&CK framework, and perform vector representation and cosine similarity calculation on this basis, so as to accurately capture the similarity between the attack tool description and the technical description, and automatically map the attack tool to the technology of MITRE ATT&CK; The large model calls the attack tool module in real time, which is used to use the large language model to parse the attack scenario input by the user, automatically select and call the attack tool, generate the attack tool execution command, and support subsequent automated attacks; The real-time calling of attack tools by a large model includes: data collection; preprocessing; vector representation of the attack tool, which is generated by calculating the average value of all feature vectors in the tool description; cosine similarity calculation; and real-time calling of the large model.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, and the computer program instructions are executed by the at least one processor so that the at least one processor can execute the attack tool automated mapping and calling method based on the MITRE ATT&CK framework and large language model as described in any one of claims 1-7.

10. A computer-readable storage medium storing a program, characterized in that: When the program is executed by the processor, the automatic mapping and calling method of attack tools based on the MITRE ATT&CK framework and the large language model described in any one of claims 1 to 7 is implemented.

Images