Vulnerability utilization method and system based on large language model driving

Abstract

The invention relates to the field of network security, in particular to a vulnerability utilization method based on large language model driving, which comprises the following steps of: scanning a target system and an application program by utilizing a vulnerability detection module, and extracting potential vulnerability features; analyzing a result of the vulnerability detection module by using a pre-trained large language model; based on an analysis result of the large language model, utilizing a vulnerability utilization strategy generation module to generate an attack vector and a utilization code snippet; according to the system and the method, the target system and the application program can be quickly scanned, the potential vulnerability features can be extracted and intelligently analyzed by utilizing the vulnerability detection module and the pre-trained large language model, and the time cost of manual vulnerability analysis is greatly reduced. Meanwhile, a vulnerability utilization strategy is automatically generated through a method combining a heuristic algorithm and reinforcement learning, the vulnerability utilization process is further optimized, and efficient vulnerability utilization is achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a vulnerability exploitation method and system driven by a large language model. Background Art

[0002] Currently, vulnerability exploitation is a critical but challenging task in the field of network security. Traditional vulnerability exploitation methods mainly rely on manual analysis by security experts and tool support based on fixed patterns. However, with the increasing complexity of information systems and network environments, traditional methods face many problems such as low efficiency, lack of adaptability and low accuracy, which makes it difficult to meet the needs of modern network security protection.

[0003] First, in terms of efficiency, the process of manually analyzing vulnerabilities and using traditional tools is usually very time-consuming. Faced with an enterprise-level network environment containing a large number of servers and applications, traditional tools need to scan and verify the vulnerabilities of each system component one by one, and the time cost increases linearly with the growth of the network scale. For example, for a network with a large number of system components, the average analysis time for each component is T, and the total time cost is 𝑁×𝑇. When 𝑁 is extremely large, the overall time cost may reach weeks or even months. Such low efficiency seems to be unable to cope with the rapidly developing attack technology, and it is difficult to discover and exploit vulnerabilities in time to take protective measures.

[0004] Secondly, in terms of adaptability, traditional vulnerability exploitation tools are usually designed based on known vulnerability patterns and fixed attack vectors, and are only applicable to the types of vulnerabilities that have been widely studied. This limitation makes them obviously insufficient when facing new vulnerabilities or complex vulnerabilities in specific system environments. For example, for newly emerging zero-day vulnerabilities, traditional tools may not be able to identify or generate effective exploitation strategies. In different operating systems, applications or special configurations, traditional tools are not versatile enough, making it difficult to effectively exploit vulnerabilities in complex environments.

[0005] In addition, the accuracy problem also limits the practicality of traditional methods. Due to the lack of in-depth understanding of vulnerability characteristics, traditional tools are prone to misjudgment or incorrect vulnerability exploitation behavior. For example, incorrect exploitation of a vulnerability may cause the target system to crash or data loss, further exacerbating the security risk of the system. Assuming the misjudgment rate is 𝑃err, the overall accuracy is 1−𝑃err, but in traditional methods, this accuracy is often low. Low accuracy not only increases the risk of failure of vulnerability exploitation, but may also cause additional security risks.

[0006] In general, traditional vulnerability exploitation methods have obvious deficiencies in efficiency, adaptability and accuracy, and are difficult to meet the needs of modern network security. Therefore, there is an urgent need for an efficient, intelligent and accurate technical solution to improve the efficiency of vulnerability exploitation, reduce time costs, enhance the adaptability to emerging vulnerabilities and complex environments, and reduce the risk of misjudgment during vulnerability exploitation, so as to better cope with the increasingly severe network security challenges. Summary of the invention

[0007] In order to solve the problems of low efficiency, insufficient adaptability and low accuracy in the vulnerability exploitation process, the technical solution of the present invention proposes a vulnerability exploitation method and system driven by a large language model, which improves the efficiency of vulnerability exploitation, reduces time cost, enhances the adaptability to new vulnerabilities and complex environments, and improves the accuracy of vulnerability exploitation, reduces the misjudgment rate and system security risks, thereby better meeting the needs of modern network security protection and coping with increasingly complex network security threats.

[0008] The present invention is achieved through the following technical solutions: The vulnerability exploitation method driven by the large language model includes the following steps: 1. The vulnerability exploitation method driven by the large language model includes the following steps: S1. Scan the target system and application using the vulnerability detection module to extract potential vulnerability features. The scanning includes: a. Send specific probe packets to multiple ports of the target system through port scanning, and analyze the responses to determine whether there are known vulnerability-related services; b. Compare the system component features with the vulnerability features in the vulnerability database. When the predetermined threshold is exceeded, it is determined that a corresponding vulnerability exists; S2. Analyze the results of the vulnerability detection module using a pre-trained large language model, wherein the analysis includes: a. Vulnerability feature vector Process and output analysis vector , the conversion process is: in represents a large language model function, represents the model parameters; b. Predict vulnerability type, severity, and exploitation method based on input vulnerability features; S3. Based on the analysis results of the large language model, the vulnerability exploitation strategy generation module is used to generate attack vectors and exploit code snippets, wherein the generation includes: a. Generate preliminary strategies based on heuristic algorithms combined with vulnerability type and severity; b. Optimize the strategy by maximizing the cumulative reward based on the reinforcement learning algorithm; S4. Verify the validity of the generated vulnerability exploitation strategy by executing the module, wherein the verification includes: a. Execute vulnerability exploitation strategies in a simulated environment and calculate the success rate of simulated attacks ; b. Take appropriate security measures after successful verification, including fixing vulnerabilities or deploying protection mechanisms.

[0009] Furthermore, the scanning time of the vulnerability detection module The calculation formula is: in, Indicates the number of ports scanned. Indicates the scan time for each port.

[0010] Furthermore, the vulnerability database stores known vulnerability features, including service types and vulnerability descriptions, and compares them with system component features to calculate the matching degree. .

[0011] Furthermore, the large language model is based on the Transformer architecture in deep learning and uses a multi-head attention mechanism to perform semantic understanding and in-depth analysis of vulnerability features.

[0012] Furthermore, the large language model predicts the vulnerability type accurately. Calculated by the following formula: in, is the number of correctly predicted vulnerability types, The actual total number of vulnerability types.

[0013] Furthermore, the vulnerability exploitation strategy generation module combines the heuristic algorithm and the reinforcement learning algorithm, and assumes that the strategy effectiveness is , the calculation formula is: in, is the number of effective vulnerability exploitation strategies, is the total number of policies generated.

[0014] Furthermore, the reinforcement learning algorithm is implemented in the strategy space , state space , Action Space Interactive optimization strategy to maximize cumulative rewards ,in is the discount factor, is the reward value.

[0015] Furthermore, the execution module tests the vulnerability exploitation strategy in a virtual machine environment to verify the success rate The calculation formula is: in, is the number of successful simulated attacks, is the total number of simulated attacks.

[0016] 9. This solution also proposes a vulnerability exploitation system driven by a large language model, including: Vulnerability detection module, used to scan target systems and applications to find potential vulnerabilities; The large language model analysis module is used to receive the results of the vulnerability detection module and analyze the vulnerability type, severity and exploitation method; A vulnerability exploitation strategy generation module, used to generate vulnerability exploitation strategies based on analysis results; The execution module is used to verify the effectiveness of the vulnerability exploitation strategy and take corresponding security measures.

[0017] Beneficial effects of the present invention: (1) The vulnerability exploitation method based on large language model drive proposed in this invention can quickly scan the target system and application, extract potential vulnerability features and perform intelligent analysis by using the vulnerability detection module and the pre-trained large language model, which greatly reduces the time cost of manual vulnerability analysis. At the same time, the vulnerability exploitation strategy is automatically generated by combining heuristic algorithms and reinforcement learning, further optimizing the vulnerability exploitation process and achieving efficient vulnerability exploitation; (2) The vulnerability exploitation method based on the large language model proposed in this invention relies on the deep learning ability of the large language model to perform semantic understanding and pattern analysis on unknown vulnerabilities. It is no longer limited to known vulnerability types and significantly improves the adaptability to new vulnerabilities. In addition, for different system configurations and environmental characteristics, the model can generate more targeted exploitation strategies, making vulnerability exploitation more flexible and reliable in complex and changing environments; (3) The vulnerability exploitation method based on the large language model driven by the present invention can more accurately predict the vulnerability type, severity and exploitation method by learning a large amount of vulnerability feature data through the large language model, thereby reducing the risk of incorrect operation caused by misjudgment during the vulnerability exploitation process. At the same time, by verifying the effectiveness of the vulnerability exploitation strategy in a simulated environment, the risk of failure and potential safety hazards in the actual system operation can be further reduced; (4) The vulnerability exploitation method based on large language model drive proposed in the present invention can automatically take corresponding security measures, including vulnerability repair or protection mechanism deployment, after generating and verifying the vulnerability exploitation strategy, forming a closed-loop process of vulnerability exploitation and protection, effectively shortening the response time from vulnerability discovery to repair, and improving the overall security protection capability of the system; (5) The vulnerability exploitation method based on large language model drive proposed in the present invention is not only applicable to traditional vulnerability exploitation scenarios, but also can cover complex network environments and highly dynamic system applications. It has wide applicability and can effectively meet the security requirements of enterprise-level networks and critical infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0019] Figure 1 A flowchart of a vulnerability exploitation method based on a large language model drive proposed by the present invention; Figure 2 A schematic diagram of a terminal device for the vulnerability exploitation method driven by a large language model proposed by the present invention; Figure 3 A schematic diagram of a readable storage medium for the vulnerability exploitation method driven by a large language model proposed in the present invention; In the figure, 200-terminal device, 210-memory, 211-RAM, 212-cache memory, 213-ROM, 214-program / utility, 215-program module, 220-processor, 230-bus, 240-external device, 250-I / O interface, 260-network adapter, 300-program product. DETAILED DESCRIPTION

[0020] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0021] Example 1 refer to Figure 1 , based on the vulnerability exploitation method driven by the large language model, including: The vulnerability detection module scans the system and applications to find potential vulnerabilities. This embodiment uses a variety of technical means, such as port scanning, vulnerability database comparison, and protocol analysis. This embodiment uses an algorithm based on port scanning to send specific detection data packets to different ports of the target system and analyze the response to determine whether there are known vulnerability-related services. Assume that the number of ports scanned is , the scan time for each port is , the total scan time can be expressed as At the same time, we use the known vulnerability database for comparison. For each detected system component, let its feature match the vulnerability feature in the database as ,when When it exceeds a certain threshold, it is determined that a corresponding vulnerability may exist.

[0022] The large language model analysis module receives the results of the vulnerability detection module and uses the pre-trained large language model to analyze the vulnerability. The large language model can establish complex semantic understanding and pattern recognition capabilities by learning a large amount of security data and vulnerability patterns. This embodiment adopts the Transformer architecture in deep learning and uses the multi-head attention mechanism to perform in-depth analysis of vulnerability features. Suppose the input vulnerability feature vector is , after being processed by the large language model, the output vector is obtained , the conversion process can be expressed as ,in is the function representation of the large language model, is the model parameter. To minimize a specific loss function , thereby improving the accuracy of the model.

[0023] When analyzing vulnerability types, severity, and possible exploits, the large language model performs semantic understanding and reasoning based on the specific features of the vulnerability, such as code snippets, system configuration information, etc. For buffer overflow vulnerabilities, the model can predict possible attack vectors and exploitation scenarios based on the input related code and memory allocation information.

[0024] Assume that the prediction accuracy of vulnerability type is ,in is the number of correctly predicted vulnerability types, The actual total number of vulnerability types.

[0025] The vulnerability exploitation strategy generation module automatically generates vulnerability exploitation strategies based on the analysis results of the large language model. A combination of heuristic algorithms and reinforcement learning algorithms can be used. Heuristic algorithms can quickly generate preliminary strategies based on some empirical rules and prior knowledge, such as selecting common attack modes based on vulnerability types and severity. Reinforcement learning algorithms continuously optimize strategies through interaction with the environment. Let the strategy space be , the state space is , the action space is , at each time step , the agent is based on the current state Select an action , and get rewards based on environmental feedback . Maximize cumulative rewards by continuously optimizing strategies ,in is the discount factor.

[0026] The generated strategy can include attack vectors, exploit code snippets, etc. Let the generated strategy validity be ,in is the number of effective vulnerability exploitation strategies, is the total number of policies generated.

[0027] The execution module is responsible for executing the vulnerability exploitation strategy, verifying the exploitability of the vulnerability, and taking corresponding security measures, such as repairing the vulnerability or strengthening system protection. During the execution process, you can use simulated attacks to verify without affecting the actual system operation. For example, use a virtual machine environment to test the vulnerability exploitation strategy, and set the success rate of the simulated attack to ,in is the number of successful simulated attacks, is the total number of simulated attacks. If the verification is successful, corresponding security measures can be taken, such as notifying the system administrator to fix the vulnerability or automatically deploying a protection mechanism.

[0028] Example 2 This embodiment proposes an alternative implementation of a vulnerability exploitation method driven by a large language model based on Embodiment 1.

[0029] Based on the vulnerability exploitation method driven by the large language model, the efficiency can be expressed by the above formula, and the accuracy can also be measured by the corresponding formula using the small language model combined with manual analysis.

[0030] This implementation aims to use a small language model to assist manual analysis, which not only fully utilizes the efficiency advantage of the small language model, but also uses manual analysis to improve the accuracy and adaptability of vulnerability exploitation, thereby achieving more efficient and reliable vulnerability exploitation. The following are the specific steps: Vulnerability detection and feature extraction 1. Use a small language model for preliminary vulnerability detection. The small language model is trained to analyze the basic vulnerability characteristics of the system or application. Use its fast scanning and feature extraction capabilities to complete the following tasks: 1.1. Port scanning: by sending detection packets to different ports of the target system and analyzing the responses to determine whether there are known vulnerability-related services; the scanning time can be calculated by the formula calculate.

[0031] 1.2. Feature comparison: Match the extracted system component features with the known vulnerability features stored in the vulnerability database and calculate the matching degree ,like If it exceeds the preset threshold, the vulnerability feature is marked as "possible vulnerability" and a specific vulnerability report is generated.

[0032] Manual review of preliminary test results 2. Provide the detection results of the small language model to the manual security analyst to perform the following operations: 2.1. Review of high priority vulnerabilities: Based on the prediction confidence of the small language model (such as matching ) High-priority vulnerabilities are screened out and confirmed by manual analysis.

[0033] 2.2. Supplement low confidence results: For low confidence vulnerabilities (such as matching Close to but not exceeding the threshold) for manual analysis to make up for the shortcomings of the small language model.

[0034] Vulnerability type and severity analysis 3. Preliminary analysis of the small language model. For the detected vulnerabilities, the small language model performs a preliminary analysis of the following information: 3.1. Vulnerability type prediction: Generate a prediction label of the vulnerability type (such as "buffer overflow" or "privilege escalation") based on the input vulnerability features. The prediction accuracy can be calculated by the formula measure.

[0035] 3.2. Vulnerability severity score: Based on the CVSS (Common Vulnerability Scoring System) model, the severity of the vulnerability is scored in combination with feature information, providing a quantitative value of 0-10.

[0036] 4. Manual analysis to further review and verify the output of the small language model 4.1. Confirmation of vulnerability type: Verify the vulnerability type label generated by the small language model based on the actual vulnerability code snippet, log information, etc., and make corrections if necessary.

[0037] 4.2. Supplementary contextual information: Manual analysis provides additional contextual information for vulnerability features and exploit scenarios through in-depth research (such as viewing relevant configuration files or memory data) to make up for the limitations of the small language model.

[0038] 5. Initial Utilization Strategy for Small Language Model Generation The small language model generates vulnerability exploitation strategies based on heuristic rules, including: 5.1. Attack vector: Generate potential attack vectors through existing vulnerability knowledge base and empirical rules, such as input patterns of buffer overflow or injection statements of SQL injection.

[0039] 5.2. Exploit code snippet: Automatically generate basic exploit code (such as Shell code for privilege escalation) based on vulnerability features.

[0040] 6. Manual analysis to optimize and adjust the strategy for generating small language models 6.1. Strategy evaluation: Manual analysis and evaluation of the effectiveness and risk of the generated strategy to eliminate exploit codes that may cause system crashes or malfunctions.

[0041] 6.2. Vulnerability environment adaptation: Manually adjust the attack vector and exploit code according to the specific environment of the target system (such as operating system version or application configuration) to improve the targetedness of the strategy.

[0042] 7. Verify the vulnerability exploitation strategy 7.1. Simulation environment verification: test the generated vulnerability exploitation strategy in a virtualized environment (such as Docker or virtual machine) and calculate the success rate of the simulated attack. 7.2. Manual analysis combined with feedback from the simulation environment to further optimize and verify the vulnerability exploitation strategy: Verify success rate: Confirm whether the simulated attack achieves the expected goal. If the success rate is low, retest by manually adjusting the strategy.

[0043] Risk assessment: Manually assess the additional risks that may be introduced during the verification process to avoid unnecessary damage to the target system.

[0044] 8. Implementation and safety measures 8.1. Execute verified vulnerability exploitation strategies in the target system to ensure the effectiveness of vulnerability exploitation.

[0045] 8.2. After the vulnerability is exploited, manual analysis combined with the small language model recommends taking the following security measures: Vulnerability remediation involves notifying system administrators to fix the vulnerability, such as upgrading software or adjusting configurations.

[0046] Security protection includes automated deployment of protection mechanisms, such as deploying firewall rules on target ports or enabling intrusion detection systems.

[0047] Example 3 This embodiment proposes an alternative implementation of a vulnerability exploitation method driven by a large language model based on Embodiment 1.

[0048] The implementation method combines the maturity of traditional vulnerability exploitation tools with the optimization capabilities of machine learning algorithms to improve the efficiency and accuracy of vulnerability exploitation, while at the same time alleviating the limitations of traditional tools in terms of adaptability to a certain extent. The specific steps are as follows: 1. Vulnerability detection and feature extraction 1.1. Preliminary scanning using traditional tools Use mature vulnerability scanning and detection tools such as Nessus, OpenVAS or Metasploit to scan the target system and generate vulnerability feature reports. This includes the following operations: Port scanning: Scans the target system's open ports and marks potential vulnerable services. The scanning time can be calculated using the following formula: .

[0049] Vulnerability matching: Compare the scan results with vulnerability databases (such as CVE or Exploit-DB) and mark the matching vulnerabilities. The matching degree of each vulnerability .

[0050] 1.2 Machine learning algorithms optimize scanning results Use machine learning algorithms to optimize and filter the scanning results of traditional tools: Classification algorithm filters results: Based on the scanned vulnerability features, use pre-trained classification models (such as decision trees, random forests, or support vector machines) to classify the scan results and eliminate possible false positives.

[0051] Input: vulnerability feature data generated by the scanning tool (such as service name, version number, etc.); Output: vulnerability classification labels (such as high-risk vulnerabilities, low-risk vulnerabilities, false positives).

[0052] Prioritization: Prioritize vulnerabilities using a regression algorithm, based on vulnerability matching, severity score (CVSS), etc. The scoring formula is: in, and is the weight parameter.

[0053] 2. Vulnerability Analysis 2.1. Traditional tools provide preliminary vulnerability analysis Traditional tools generate preliminary information about vulnerabilities through predefined rules or plug-ins, including vulnerability type, impact scope, and possible attack vectors.

[0054] 2.2. Machine Learning Algorithm Optimization Vulnerability Analysis Vulnerability type prediction: Use machine learning models (such as deep neural networks or logistic regression) to analyze vulnerability feature data and predict vulnerability types.

[0055] Severity analysis: Calculate the severity score of the vulnerability based on vulnerability feature data (such as system version and historical vulnerability exploitation) to optimize the analysis results of traditional tools.

[0056] 2.3. Manual review of key vulnerabilities Manual analysis and confirmation are performed on high-priority vulnerabilities after machine learning optimization to further improve the accuracy of the analysis.

[0057] 3. Vulnerability Exploitation Strategy Generation 3.1. Generate preliminary exploit strategy using traditional tools Traditional tools provide vulnerability exploit templates or scripts (such as exploit modules in Metasploit) to provide preliminary strategies for vulnerability exploitation, including: Attack vector: Generates attack paths or input patterns that exploit vulnerabilities; Exploit Code: Provides predefined vulnerability exploit scripts for direct execution or reference.

[0058] 3.2 Machine Learning Algorithm Optimization Strategy Strategy screening: Based on historical attack data and target environment characteristics, machine learning models are used to screen strategies generated by traditional tools to eliminate inefficient or high-risk strategies.

[0059] Strategy recommendation: recommend the best strategy combination through collaborative filtering algorithm or reinforcement learning algorithm. For example, the strategy optimization goal of reinforcement learning is to maximize the attack success rate. .

[0060] in, is the number of successful attacks, is the total number of attempts.

[0061] 3.3 Manual Adjustment and Adaptation Security analysts manually adjust the optimized policies to ensure that they adapt to the special configuration of the target environment, including operating system version or network topology.

[0062] 4. Verify the vulnerability exploitation strategy 4.1 Simulation environment verification Execute the vulnerability exploit strategy in a virtualized environment (such as a Docker container or sandbox environment) to verify its effectiveness. Verification success rate 4.2. Manual Verification Manual analysis combined with simulation results is used to review vulnerability exploitation strategies and eliminate strategies that may cause system crashes or other unacceptable risks.

[0063] 5. Implementation and safety measures 5.1 Execution of vulnerability exploitation strategy Execute proven exploit strategies on target systems to ensure successful exploitation of vulnerabilities.

[0064] 5.2. Security repair and protection Leverage the combined power of traditional tools and machine learning to provide automated remediation recommendations or directly deploy protection mechanisms: Vulnerability repair: automatically generate patches or adjust configurations, including but not limited to shutting down services with vulnerabilities or upgrading related components).

[0065] Security protection: Generate protection rules for vulnerabilities, including but not limited to IDS / IPS rules or firewall policies, and deploy them to the target system.

[0066] Example 4 refer to Figure 2 Based on Example 1, this embodiment proposes a terminal device based on a vulnerability exploitation method driven by a large language model. The terminal device 200 includes at least one memory 210, at least one processor 220, and a bus 230 connecting different platform systems.

[0067] The memory 210 may include a readable medium in the form of a volatile memory, such as a RAM 211 and / or a cache memory 212 , and may further include a ROM 213 .

[0068] Among them, the memory 210 also stores a computer program, and the computer program can be executed by the processor 220, so that the processor 220 executes any of the above-mentioned vulnerability exploitation methods driven by a large language model in the embodiments of the present application, and its specific implementation method is consistent with the implementation method and the technical effect achieved in the embodiments of the above-mentioned applications, and some contents are not repeated. The memory 210 may also include a program / utility 214 having a set (at least one) of program modules 215, such program modules include but are not limited to: an operating system, one or more application programs, other program modules, and program data, each of these examples or some combination may include the implementation of a network environment.

[0069] Accordingly, the processor 220 may execute the above-mentioned computer programs, and may execute the program / utility 214 .

[0070] The bus 230 may be a bus representing one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0071] The terminal device 200 may also communicate with one or more external devices 240 such as keyboards, pointing devices, Bluetooth devices, etc., and may also communicate with one or more devices that can interact with the terminal device 200, and / or communicate with any device (such as a router, a modem, etc.) that enables the terminal device 200 to communicate with one or more other computing devices. Such communication may be performed through an I / O interface 250. In addition, the terminal device 200 may also communicate with one or more networks (such as a local area network (LAN), a wide area network (WAN) and / or a public network, such as the Internet) through a network adapter 260. The network adapter 260 may communicate with other modules of the terminal device 200 through a bus 230. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the terminal device 200, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage platforms, etc.

[0072] Example 4 refer to Figure 3 This embodiment proposes a computer-readable storage medium for a vulnerability exploitation method driven by a large language model. The computer-readable storage medium stores instructions. When the instructions are executed by a processor, the specific implementation method of implementing any of the above-mentioned vulnerability exploitation methods driven by a large language model is consistent with the implementation method and the technical effect achieved in the above-mentioned application embodiment, and some contents are not repeated here.

[0073] Figure 3The program product 300 provided in this embodiment for implementing the above-mentioned application is shown, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product 300 of the present invention is not limited to this. In this embodiment, the readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it. The program product 300 can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0074] Computer-readable storage media may include data signals propagated in baseband or as part of a carrier wave, wherein readable program codes are carried. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable storage medium may also be any readable medium other than the readable storage medium, which may send, propagate, or transmit a program used by or in combination with an instruction execution system, an apparatus, or a device. The program code contained on the readable storage medium may be transmitted with any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above. The program code for performing the operation of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and also conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on a user computing device, partially on a user device, as an independent software package, partially on a user computing device, partially on a remote computing device, or entirely on a remote computing device or server. Where a remote computing device is involved, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0075] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A vulnerability exploitation method driven by a large language model, characterized in that: The following steps are involved: S1. Scan the target system and application using the vulnerability detection module to extract potential vulnerability features. The scanning includes: a. Send specific probe packets to multiple ports of the target system through port scanning, and analyze the responses to determine whether there are known vulnerability-related services; b. Compare the system component features with the vulnerability features in the vulnerability database. When the predetermined threshold is exceeded, it is determined that a corresponding vulnerability exists; S2. Analyze the results of the vulnerability detection module using a pre-trained large language model, wherein the analysis includes: Vulnerability feature vector Process and output analysis vector , the conversion process is: ； in represents a large language model function, represents the model parameters; Predict vulnerability type, severity, and exploitation method based on input vulnerability features; S3. Based on the analysis results of the large language model, the vulnerability exploitation strategy generation module is used to generate attack vectors and exploit code snippets, wherein the generation includes: a. Generate preliminary strategies based on heuristic algorithms combined with vulnerability type and severity; b. Optimize the strategy by maximizing the cumulative reward based on the reinforcement learning algorithm; S4. Verify the validity of the generated vulnerability exploitation strategy by executing the module, wherein the verification includes: a. Execute vulnerability exploitation strategies in a simulated environment and calculate the success rate of simulated attacks ; b. Take appropriate security measures after successful verification, including fixing vulnerabilities or deploying protection mechanisms.

2. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: Scan time of the vulnerability detection module The calculation formula is: ； in, Indicates the number of ports scanned. Indicates the scan time for each port.

3. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: The vulnerability database stores known vulnerability features, including service types and vulnerability descriptions, and compares them with system component features to calculate the matching degree. .

4. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: The large language model is based on the Transformer architecture in deep learning and uses a multi-head attention mechanism to perform semantic understanding and in-depth analysis of vulnerability features.

5. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: Prediction accuracy of vulnerability types by large language model Calculated by the following formula: ； in, is the number of correctly predicted vulnerability types, The actual total number of vulnerability types.

6. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: The vulnerability exploitation strategy generation module combines heuristic algorithms and reinforcement learning algorithms, assuming that the strategy effectiveness is , the calculation formula is: ； in, is the number of effective vulnerability exploitation strategies, is the total number of policies generated.

7. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: The reinforcement learning algorithm passes through the policy space , state space , Action Space Interactive optimization strategy to maximize cumulative rewards ,in is the discount factor, is the reward value.

8. The vulnerability exploitation method based on large language model drive according to claim 1, characterized in that: The execution module tests the vulnerability exploitation strategy in the virtual machine environment to verify the success rate The calculation formula is: ； in, is the number of successful simulated attacks, is the total number of simulated attacks.

9. A vulnerability exploitation system driven by a large language model, characterized in that: The vulnerability exploitation method according to any one of claims 1 to 8 comprises: Vulnerability detection module, used to scan target systems and applications to find potential vulnerabilities; The large language model analysis module is used to receive the results of the vulnerability detection module and analyze the vulnerability type, severity and exploitation method; A vulnerability exploitation strategy generation module, used to generate vulnerability exploitation strategies based on analysis results; The execution module is used to verify the effectiveness of the vulnerability exploitation strategy and take corresponding security measures.

Images