Automatic penetration test information collection method and system based on large model technology

Abstract

The invention relates to the field of penetration test security, in particular to an automatic penetration test information collection method and system based on a large model technology, and the method comprises the steps: S1, collecting data information in a target network through a data collection module; s2, analyzing the data information through a large model analysis module, and identifying potential vulnerabilities and risk points to obtain an analysis result; s3, carrying out noise filtering and duplicate removal processing on an analysis result through an information screening and classification module; and S4, outputting the screened and classified data through an output module, and by adopting a large model to carry out deep analysis on data information, potential vulnerabilities and risk points can be efficiently identified based on semantic comprehension and a feature extraction technology. And meanwhile, through an information screening and classifying module, false alarm information is eliminated, and repeated information is removed, so that the accuracy of an identification result is further improved, the false alarm rate and the missing report rate are effectively controlled, and the overall detection performance is improved.

Description

Technical Field

[0001] The present invention relates to the field of penetration test security, and in particular to an automated penetration test information collection method and system based on large model technology. Background Art

[0002] Penetration test information collection is a crucial part of network security assessment, and its quality and efficiency are directly related to the effectiveness of the overall security test. However, traditional information collection methods mainly rely on vulnerability scanning tools and manual analysis. Although these methods have been widely used, the limitations of existing technologies have become increasingly prominent as the scale of networks continues to expand and the means of attack become increasingly complex.

[0003] Current mainstream penetration testing tools such as Nessus and OpenVAS are based on predefined vulnerability libraries for scanning. By comparing the configuration of the target system with known vulnerability features, these tools can quickly discover common security issues. However, this method relies on the timely update of the vulnerability library, and has limited detection capabilities when facing new vulnerabilities and attack methods. At the same time, the tools have poor adaptability to complex network environments, especially when facing dynamically changing cloud environments or IoT devices, and often show high false positive and false negative rates.

[0004] Security experts often need to manually check network configurations, analyze system logs, and review application code during penetration testing. This method is highly flexible and can dig deep into specific scenarios to uncover potential security risks. However, manual methods are highly dependent on the experience of experts, which is not only time-consuming and labor-intensive, but also prone to missing critical vulnerabilities due to human negligence.

[0005] In large-scale network environments, both traditional vulnerability scanning tools and manual methods have efficiency bottlenecks. Taking scanning tools as an example, if a network contains N nodes, each node takes an average of T time to complete the scan, and the total time is N*T. As the number of nodes increases, the scanning time increases linearly, which is difficult to meet the real-time detection needs. Manual information collection is even more time-consuming, especially in complex scenarios, requiring a lot of manpower and time. Summary of the invention

[0006] In order to solve the problems of the prior art, the present invention proposes an automated penetration test information collection method based on large model technology.

[0007] The present invention is achieved through the following technical solutions: An automated penetration test information collection method based on large model technology comprises the following steps: S1, collect data information in the target network through the data acquisition module; S2. Analyze data information through the large model analysis module, identify potential vulnerabilities and risk points, and obtain analysis results; S3, filtering noise and removing duplicates from the analysis results through the information screening and classification module; S4. Output the filtered and classified data through the output module.

[0008] Furthermore, the data information in step S1 includes network traffic, system logs, and configuration files; Through the collection efficiency formula Determine the amount of data collected per unit time, where The amount of data representing the data information, Indicates the collection time.

[0009] Furthermore, the LLaMA model is used to analyze the data information in step S2, which specifically includes the following sub-steps: S201, preprocessing the data information, wherein the preprocessing includes standardized coding and data structure unification; S202, inputting the preprocessed data information into the LLaMA model, wherein the LLaMA model matches the text features and data patterns of the data information based on semantic understanding and feature extraction; S203, output the results of potential vulnerabilities and risk points of data information; S204, through the accuracy formula Determine the performance of the large model analysis module in identifying vulnerabilities and risk points, including Indicates the number of correctly identified vulnerabilities and risk points, Indicates the actual number of vulnerabilities and risk points.

[0010] Furthermore, the step S3 specifically includes the following sub-steps: S301. Identify text descriptions and data status features that are easily misjudged as vulnerabilities but are normal in a specific environment based on prior experience; S302, defining the results determined to meet the characteristics as false positive information and eliminating them; S303, extracting features from the data after removing false positive information, wherein the features include vulnerability names, key code snippets, and corresponding network ports; S304, using a hash algorithm or a similarity comparison algorithm to compare the features; S305: When the similarity of key features of two or more results reaches a preset threshold, they are determined to be duplicate information, and only one valid information is retained.

[0011] Furthermore, the step S3 also includes classifying the valid information after eliminating false positives and duplicate information according to vulnerability type and risk level; The classification results are obtained through the proportion formula Indicates that It indicates the accuracy after screening and classification. Indicates the accuracy after large model analysis.

[0012] An automated penetration test information collection system based on large model technology, including a data acquisition module, a large model analysis module, an information screening and classification module and an output module; The data collection module is used to collect data information in the target network, the data information includes network traffic, system logs and configuration files, and the data collection efficiency is determined by the collection efficiency formula; The large model analysis module is used to analyze the collected data information and identify potential vulnerabilities and risk points. The large model analysis module uses the LLaMA model to process data, performs standardized coding and preprocesses the data information to unify the data structure, and then inputs the preprocessed data into the LLaMA model for semantic understanding and feature extraction, thereby identifying potential vulnerabilities and risk points, and evaluating the vulnerability identification performance through the accuracy formula; The information screening and classification module is used to perform noise filtering, deduplication processing and classification on the results output by the large model analysis module, and the accuracy rate after classification is expressed by a proportional formula; The output module is used to output valid information after screening and classification, and provide the valid information to the penetration test and security protection system.

[0013] Beneficial effects of the present invention: (1) The present invention proposes an automated penetration test information collection method based on big model technology. By using big models to conduct in-depth analysis of data information, based on semantic understanding and feature extraction technology, it can efficiently identify potential vulnerabilities and risk points. At the same time, through the information screening and classification module, false positive information is eliminated and duplicate information is removed, which further improves the accuracy of the recognition results, realizes effective control of the false positive rate and the false negative rate, and improves the overall detection performance; (2) The present invention proposes an automated penetration test information collection method based on large model technology, which greatly shortens the time required for information collection through the efficient collaboration of the data collection module and the automated analysis module. During the data collection process, the collection efficiency formula is used to evaluate the collection efficiency so that the data collection is optimized within a unit time. Compared with traditional manual analysis or tool-driven methods, it significantly reduces time and labor costs and can quickly adapt to large-scale network environments; (3) The present invention proposes an automated penetration test information collection method based on big model technology. Through the big model, it conducts in-depth analysis of multiple data sources, can identify unknown vulnerabilities and new attack methods, and solve the limitation of traditional methods that rely on predefined vulnerability libraries. Through the self-learning mechanism of the big model, the system can dynamically update the knowledge base, adapt to the ever-changing network security threats, and further improve the coverage capability; (4) The present invention proposes an automated penetration test information collection method based on large model technology, which enables complex and diverse data formats to be efficiently processed through standardized processing of data information and unified feature extraction. At the same time, the hash algorithm or similarity comparison algorithm is used to achieve data deduplication and feature comparison, ensuring the uniqueness and pertinence of the output information, providing high-quality support for subsequent penetration testing.

[0014] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0015] Figure 1 A flowchart of an automated penetration test information collection method based on large model technology proposed by the present invention; Figure 2 A schematic diagram of a terminal device for an automated penetration test information collection method based on large model technology proposed by the present invention; Figure 3 A schematic diagram of a readable storage medium of an automated penetration test information collection method based on large model technology proposed by the present invention; In the figure, 200-terminal device, 210-memory, 211-RAM, 212-cache memory, 213-ROM, 214-program / utility, 215-program module, 220-processor, 230-bus, 240-external device, 250-I / O interface, 260-network adapter, 300-program product. DETAILED DESCRIPTION

[0016] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0017] Example 1 An automated penetration test information collection method based on large model technology comprises the following steps: 1. Collect data information in the target network through the data acquisition module; The data information in step 1 includes network traffic, system logs, and configuration files; the collection efficiency formula Determine the amount of data collected per unit time, where The amount of data representing the data information, Indicates the collection time.

[0018] 2. Analyze data information through the large model analysis module, identify potential vulnerabilities and risk points and obtain analysis results; In step 2, the LLaMA model is used to analyze the data information, which specifically includes the following sub-steps: 201. Preprocessing the data information, wherein the preprocessing includes standardized coding and unified data structure; Specifically include: Preprocessing of network traffic data: Extract key fields from network traffic records, such as source / destination IP address, source / destination port, transport protocol, data size, and timestamp, and unify the format of the extracted field values. For example, IP addresses are stored in standard string form, and timestamps are uniformly converted to UTC format to ensure consistency of data from different time sources. Each traffic record is organized into a unified structure with predefined field names to facilitate model understanding and analysis.

[0019] Preprocessing of system log data: remove irrelevant or noisy logs, including heartbeat detection or background task logs, to reduce analysis interference, extract and unify important fields in the logs, including event types such as login attempts, file access, time, user ID, and operation results. Make fields of different log types consistent to ensure that fields are comparable during subsequent analysis, clean up redundant information in the log content, remove invalid characters or useless descriptions, and retain only key information related to security.

[0020] Preprocessing of configuration file data: Extract key parameters that affect system security from the configuration file, including access permission settings, user permission allocation, port configuration, etc., convert the configuration content into a structured format, and convert parameters in configuration files of different formats such as INI, XML, and YAML into a consistent data format.

[0021] 202. Input the preprocessed data information into the LLaMA model, and the LLaMA model matches the text features and data patterns of the data information based on semantic understanding and feature extraction; Specifically, for each piece of data, the LLaMA model uses natural language understanding technology to identify the events or behaviors described in the data. The LLaMA model automatically identifies security-related keywords or phrases in the data text, such as "failed login", "port scan", "access denied", etc. These keywords are the basis for preliminary judgment of the event type. In addition, the model can identify and associate data in multiple fields, such as IP address, user name, event type, and timestamp. By analyzing the correlation of these fields, the model can extract more information related to the event. That is, combine fields such as "source IP address" and "number of failed logins" to determine whether the IP has abnormal behavior.

[0022] The specific pattern matching process of the LLaMA model is as follows: (1) Set several rules based on known attack patterns or common security events, and the model can quickly match these rules. If the same IP tries different ports multiple times in a short period of time, the model will match this behavior with the "port scan" pattern.

[0023] (2) The LLaMA model can also identify abnormal patterns without clear rules. Through training with a large amount of sample data, the model is able to detect patterns that deviate from normal behavior. For example, if a user login activity occurs during an abnormal time period or is initiated from an abnormal geographical location, the model will identify potential anomalies based on these features.

[0024] (3) The model can analyze both network traffic data and system log data. If an IP address appears in both traffic records and login attempts in system logs, the model can correlate this information and mark the IP address as a potential threat.

[0025] (4) The model analyzes behavioral changes in data based on timestamps. If a user logs in from multiple IP addresses in a short period of time, the model can detect this abnormal time series pattern and determine whether there is a risk of account hijacking.

[0026] 203. Output the results of potential vulnerabilities and risk points of data information; Specifically, the model uses trained weights and feature libraries to semantically match input data with known vulnerability patterns or risk points to generate risk results: LLaMA converts input data such as log entries or configuration parameters into high-dimensional semantic vectors and compares them with vulnerability feature vectors in the training data, using distance metrics such as cosine similarity or probability distribution to determine the similarity of the input data with known risk features.

[0027] Based on semantic understanding and context analysis, the model annotates the input data as: Attack type (such as SQL injection, brute force cracking, unauthorized access, etc.).

[0028] Event characteristics (such as IP address, time period, and operation behavior).

[0029] Contextual association (such as multiple chains of events associated with the attack source).

[0030] LLaMA classifies risks through the classifier layer and outputs the corresponding classification results.

[0031] Classification labels: Risk type and vulnerability category (e.g., network attack, configuration vulnerability, application layer security issue).

[0032] Risk level: divided into "high risk", "medium risk" and "low risk" through classification layers or probability value calculation.

[0033] High risk: Directly affects the availability, security, or integrity of the system.

[0034] Medium risk: may cause indirect harm, but does not meet the conditions for direct use.

[0035] Low risk: potential problem, but low harm in the short term.

[0036] The model in this embodiment can add a confidence score when outputting each vulnerability or risk point. For example: Confidence = 0.95 means that the model is very sure about the current judgment.

[0037] Confidence level = 0.60 indicates that further verification may be needed.

[0038] Confidence formula: Based on the matching probability or classification accuracy of the model training, a score between 0 and 1 is generated to quantify the credibility of the analysis.

[0039] 204. Through the accuracy formula Determine the performance of the large model analysis module in identifying vulnerabilities and risk points, including Indicates the number of correctly identified vulnerabilities and risk points, Indicates the actual number of vulnerabilities and risk points.

[0040] The accuracy formula is used to quantify model performance, analyze shortcomings, optimize system capabilities, and support technology comparison. The accuracy formula is not only the core measure of model quality, but also provides a clear basis for subsequent model improvement, technology selection, and system evaluation.

[0041] 3. Use the information screening and classification module to filter noise and remove duplicates from the analysis results; 301. Based on prior experience, identify text descriptions and data status features that are easily misjudged as vulnerabilities but are normal in a specific environment; 302. Defining the results determined to meet the characteristics as false positive information and eliminating them; 303. Extracting features from the data after removing false positive information, wherein the features include vulnerability names, key code snippets, and corresponding network ports; 304. Use hash algorithm or similarity comparison algorithm to compare features, including calculating hash value MD5 or SHA256 of extracted features such as code snippets and vulnerability names; If a direct match is not possible, a similarity comparison algorithm is used: Text Similarity: Compare vulnerability descriptions using cosine similarity or Jaccard similarity.

[0042] Code Similarity: Compare code snippets using edit distance or semantic analysis tools.

[0043] Output similarity score (0~1), similarity 0.95 is considered highly similar, and similarity 0.50 is considered non-duplicate.

[0044] In this embodiment, a duplication judgment threshold can be set according to business requirements, such as similarity>0.9 is considered a duplication.

[0045] 305. When the similarity of key features of two or more results reaches a preset threshold, they are determined to be duplicate information, and only one valid information is retained.

[0046] The deduplication logic of this embodiment is to merge two or more records with similar features into one, retain the record with higher confidence or retain the latest record in chronological order.

[0047] Furthermore, the step 3 also includes classifying the valid information after eliminating false positives and duplicate information according to vulnerability type and risk level; The classification results are obtained through the proportion formula Indicates that It indicates the accuracy after screening and classification. Indicates the accuracy after large model analysis.

[0048] 4. Output the filtered and classified data through the output module.

[0049] Furthermore, the step S3 specifically includes the following sub-steps: An automated penetration test information collection system based on large model technology, including a data acquisition module, a large model analysis module, an information screening and classification module and an output module; The data collection module is used to collect data information in the target network, the data information includes network traffic, system logs and configuration files, and the data collection efficiency is determined by the collection efficiency formula; The large model analysis module is used to analyze the collected data information and identify potential vulnerabilities and risk points. The large model analysis module uses the LLaMA model to process data, performs standardized coding and preprocesses the data information to unify the data structure, and then inputs the preprocessed data into the LLaMA model for semantic understanding and feature extraction, thereby identifying potential vulnerabilities and risk points, and evaluating the vulnerability identification performance through the accuracy formula; The information screening and classification module is used to perform noise filtering, deduplication processing and classification on the results output by the large model analysis module, and the accuracy rate after classification is expressed by a proportional formula; The output module is used to output valid information after screening and classification, and provide the valid information to the penetration test and security protection system.

[0050] Example 2 refer to Figure 2 Based on Example 1, this example proposes a terminal device for an automated penetration test information collection method based on large model technology. The terminal device 200 includes at least one memory 210, at least one processor 220, and a bus 230 connecting different platform systems.

[0051] The memory 210 may include a readable medium in the form of a volatile memory, such as a RAM 211 and / or a cache memory 212 , and may further include a ROM 213 .

[0052] Among them, the memory 210 also stores a computer program, and the computer program can be executed by the processor 220, so that the processor 220 executes any of the above-mentioned methods for collecting information of automated penetration testing based on large model technology in the embodiments of the present application, and its specific implementation method is consistent with the implementation method and the technical effect achieved in the embodiments of the above-mentioned application, and some contents are not repeated. The memory 210 may also include a program / utility 214 having a group (at least one) of program modules 215, such program modules include but are not limited to: an operating system, one or more application programs, other program modules, and program data, each of these examples or some combination may include the implementation of a network environment.

[0053] Accordingly, the processor 220 may execute the above-mentioned computer programs, and may execute the program / utility 214 .

[0054] The bus 230 may be a bus representing one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0055] The terminal device 200 may also communicate with one or more external devices 240 such as keyboards, pointing devices, Bluetooth devices, etc., and may also communicate with one or more devices that can interact with the terminal device 200, and / or communicate with any device (such as a router, a modem, etc.) that enables the terminal device 200 to communicate with one or more other computing devices. Such communication may be performed through an I / O interface 250. In addition, the terminal device 200 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 260. The network adapter 260 may communicate with other modules of the terminal device 200 through a bus 230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the terminal device 200, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms, etc.

[0056] Example 3 refer to Figure 3 This embodiment proposes a computer-readable storage medium for an automated penetration test information collection method based on large model technology. Instructions are stored on the computer-readable storage medium. When the instructions are executed by the processor, any one of the automated penetration test information collection methods based on large model technology is implemented. The specific implementation method is consistent with the implementation method and the technical effect achieved in the above-mentioned application embodiment, and some contents will not be repeated here.

[0057] Figure 3 The program product 300 provided in this embodiment for implementing the above-mentioned application is shown, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product 300 of the present invention is not limited to this. In this embodiment, the readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. The program product 300 can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0058] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium may also be any readable medium other than the readable storage medium, which may send, propagate, or transmit a program used by or in combination with an instruction execution system, an apparatus, or a device. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above. The program code for performing the operation of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on a user computing device, partially on a user device, as an independent software package, partially on a user computing device, partially on a remote computing device, or entirely on a remote computing device or server. Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0059] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. An automated penetration test information collection method based on large model technology, characterized in that: The following steps are involved: S1, collect data information in the target network through the data acquisition module; S2. Analyze data information through the large model analysis module, identify potential vulnerabilities and risk points, and obtain analysis results; S3, filtering noise and removing duplicates from the analysis results through the information screening and classification module; S4. Output the filtered and classified data through the output module.

2. According to claim 1, the method for collecting information of automated penetration testing based on large model technology is characterized in that: The data information in step S1 includes network traffic, system logs, and configuration files; Through the collection efficiency formula Determine the amount of data collected per unit time, where The amount of data representing the data information, Indicates the collection time.

3. According to the method for collecting automated penetration test information based on large model technology in claim 1, it is characterized in that the LLaMA model is used to analyze the data information in step S2, which specifically includes the following sub-steps: S201, preprocessing the data information, wherein the preprocessing includes standardized coding and data structure unification; S202, inputting the preprocessed data information into the LLaMA model, wherein the LLaMA model matches the text features and data patterns of the data information based on semantic understanding and feature extraction; S203, output the results of potential vulnerabilities and risk points of data information; S204, through the accuracy formula Determine the performance of the large model analysis module in identifying vulnerabilities and risk points, including Indicates the number of correctly identified vulnerabilities and risk points, Indicates the actual number of vulnerabilities and risk points.

4. The method for collecting automated penetration test information based on large model technology according to claim 1 is characterized in that: The step S3 specifically includes the following sub-steps: S301. Identify text descriptions and data status features that are easily misjudged as vulnerabilities but are normal in a specific environment based on prior experience; S302, defining the results determined to meet the characteristics as false positive information and eliminating them; S303, extracting features from the data after removing false positive information, wherein the features include vulnerability names, key code snippets, and corresponding network ports; S304, using a hash algorithm or a similarity comparison algorithm to compare the features; S305: When the similarity of key features of two or more results reaches a preset threshold, they are determined to be duplicate information, and only one valid information is retained.

5. The method for collecting automated penetration test information based on large model technology according to claim 1 is characterized in that: The step S3 also includes classifying the valid information after eliminating false positives and duplicate information according to vulnerability type and risk level; The classification results are obtained through the proportion formula Indicates that It indicates the accuracy after screening and classification. Indicates the accuracy after large model analysis.

6. An automated penetration test information collection system based on large model technology, characterized in that: The method according to any one of claims 1 to 5 comprises a data acquisition module, a large model analysis module, an information screening and classification module and an output module; The data collection module is used to collect data information in the target network, the data information includes network traffic, system logs and configuration files, and the data collection efficiency is determined by the collection efficiency formula; The large model analysis module is used to analyze the collected data information and identify potential vulnerabilities and risk points. The large model analysis module uses the LLaMA model to process data, performs standardized coding and preprocesses the data information to unify the data structure, and then inputs the preprocessed data into the LLaMA model for semantic understanding and feature extraction, thereby identifying potential vulnerabilities and risk points, and evaluating the vulnerability identification performance through the accuracy formula; The information screening and classification module is used to perform noise filtering, deduplication processing and classification on the results output by the large model analysis module, and the accuracy rate after classification is expressed by a proportional formula; The output module is used to output valid information after screening and classification, and provide the valid information to the penetration test and security protection system.

Images