Web 0Day vulnerability detection and mining method and platform based on security agent

Abstract

The invention discloses a Web 0Day vulnerability detection and mining method and platform based on a security agent, and relates to the field of network security, and the method comprises the following steps: collecting and preprocessing massive network security related data; training a security big model in the vertical network security field; taking the large security model as a core, combining with a self-defined memory module, a tool module and a planning module, and constructing a security agent by utilizing agent characteristics of the large model; based on cross-language integration and a front-end visualization technology, a Web visualization platform is constructed in combination with a security agent; vulnerability analysis of Web page content, generation and effect verification of vulnerability test cases and visual display of security professional knowledge questions and answers are realized based on a Web visual platform. According to the method, deep dynamic analysis and multi-dimensional feature mining of the Web application are realized, and the mining capability and the detection efficiency of Web0Day vulnerabilities are improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and relates to the construction of a security intelligent body, and specifically is a Web 0Day vulnerability detection and mining method and platform based on a security intelligent body. Background Art

[0002] With the rapid development of Internet technology, Web applications have become an important part of enterprise and personal information. However, the rapid iteration and complexity of Web applications also bring potential security risks, especially 0Day vulnerabilities. These vulnerabilities refer to security defects that have not been publicly disclosed or patched. Once maliciously exploited, they may lead to serious consequences such as data leakage and system intrusion, posing a huge threat to network security.

[0003] Traditional Web vulnerability mining methods are mainly divided into two categories: manual analysis and automated tool detection. Manual analysis relies on the experience and skills of security experts, and has problems such as low detection efficiency and high cost. Although automated tools can cover some known vulnerabilities, their ability to mine unknown vulnerabilities (such as 0Day vulnerabilities) is limited, and they often lack an in-depth understanding of complex vulnerability characteristics. In addition, existing methods often cannot adapt in time when facing emerging attack technologies, resulting in a lag in vulnerability detection.

[0004] In recent years, breakthroughs in artificial intelligence (AI) technology have brought new opportunities to the security field, and security big models have emerged. They combine advanced artificial intelligence algorithms and the training of massive security data, and can accurately identify various security threats, vulnerabilities and risks, providing strong support for network security. Furthermore, the development of security big models has led to the birth of security agents, which combine the powerful analytical capabilities and autonomous decision-making capabilities of security big models, and can intelligently formulate and execute corresponding security policies based on real-time security situations. The emergence of security agents marks the transition of network security protection from passive defense to active intelligent defense, providing a strong guarantee for building a more secure and reliable network environment. However, the direct application of security agent technology to vulnerability mining still faces the following challenges:

[0005] 1. The sample data of Web 0Day vulnerabilities is scarce, which makes it difficult for traditional AI models to effectively learn vulnerability features.

[0006] 2. Complexity and diversity: The structure and development technology of Web applications are complex and diverse, involving multiple programming languages, frameworks and protocols, which requires the model to have cross-language and cross-domain understanding capabilities.

[0007] 3. Real-time and adaptability: The mining of 0Day vulnerabilities requires real-time response capabilities to cope with dynamic changes in vulnerability exploitation methods. Summary of the invention

[0008] Based on the above challenges, the present invention proposes a Web 0Day vulnerability detection and mining method and platform based on security intelligence. By training a large security model and building a security intelligence agent, deep dynamic analysis and multi-dimensional feature mining of Web applications are achieved, thereby improving the mining capability and detection efficiency of Web 0Day vulnerabilities.

[0009] In order to achieve the above object, the technical solution specifically adopted by the present invention is as follows:

[0010] A Web 0Day vulnerability detection and mining method based on security intelligence includes the following steps:

[0011] S1. Collection and preprocessing of massive network security related data;

[0012] S2. Train a large security model in the vertical network security field;

[0013] S3. Taking the security big model as the core, combined with the customized memory module, tool module, and planning module, a security agent is constructed using the agent characteristics of the big model itself. The security agent is used for Web 0Day vulnerability detection and mining tasks, including analyzing possible vulnerability injection points on Web pages, generating test cases for vulnerability mining verification, etc.

[0014] S4, based on cross-language integration and front-end visualization technology, combined with security intelligence to build a Web visualization platform;

[0015] S5. Based on the Web visualization platform, the vulnerability analysis of Web page content, the generation and effect verification of vulnerability test cases, and the visual display of security professional knowledge Q&A functions are realized.

[0016] Furthermore, the massive network security related data collected in the step S1 mainly include vulnerability information and exploit scripts in vulnerability libraries (such as CVE, NVD), attack samples (such as SQL injection, cross-site scripting attacks) and traffic logs, security research papers and technical reports, as well as project materials of Web frameworks and open source code libraries. By integrating these diverse data sources, solid and comprehensive data support is provided for the training of large security models and the construction of security intelligence. The collection of massive network security related data includes two parts: one is to use the Scrapy framework to crawl network security related data from search engines, open source libraries and other channels; the other is to obtain information such as e-books and collections of papers in the field of network security through manual collection.

[0017] Furthermore, in the step S1, the preprocessing of massive network security-related data includes formatting the crawled data into a structured format, removing irrelevant noise information, and cleaning up duplicate, useless or redundant data according to the data type; extracting text from manually collected PDF documents using OCR technology, improving accuracy through image preprocessing and recognition correction, and finally structuring the text and saving it in a standard format.

[0018] Furthermore, in the step S2, based on the LLama-Factory framework, Qwen 7B is used as the base model, 400,000 Web vulnerability security data are used for 10 rounds of incremental pre-training, and 4,000 self-constructed question-answer pairs are used for supervised instruction fine-tuning to obtain a large security model in the vertical network security field; the training process includes an incremental pre-training stage and a supervised instruction fine-tuning stage; in the incremental pre-training stage, the base model is trained with a large amount of data in the security field, so as to learn rich vertical field knowledge and expand its knowledge boundaries; in the supervised instruction fine-tuning stage, the model is trained with self-constructed instruction question-answer pairs, so that the model's answers are more vertical to the security field and aligned with the human answer logic, and finally a large security model in the vertical network security field is obtained, which shows significant advantages in network security-related tasks, especially in tasks such as vulnerability analysis and test case generation, its professionalism and accuracy have been significantly improved, providing model support for the subsequent construction of security intelligent agents.

[0019] Furthermore, in step S3, the construction of the security intelligent body is implemented based on the Dify framework, and the security intelligent body includes:

[0020] The underlying big model uses the security big model to provide professional security decision support. It provides more in-depth professional security knowledge and can more accurately support the detection and mining of Web0Day vulnerabilities compared to the general model.

[0021] The memory module consists of long-term memory and short-term memory. The long-term memory is used to assist in the execution of RAG retrieval enhancement generation tasks, which liberates the time dependency in the model training process and enables it to answer cutting-edge knowledge in the security field. The short-term memory temporarily stores information related to the current conversation, thereby improving the agent's memory ability in the short term and enhancing the coherence and accuracy of the conversation.

[0022] The planning module is mainly responsible for converting user security issues into classification tasks. It guides the model to make accurate judgments through semantic understanding and context analysis of user input issues, combined with the designed prompt word engineering, so that the optimal path can be obtained for each issue processing, thereby achieving efficient and accurate task execution;

[0023] The tool module includes page analysis tools, test case generation tools and RAG retrieval enhancement generation tools, which are used to assist in analyzing security vulnerabilities of Web pages, generate vulnerability test cases, and extract the latest security information from external literature and databases, enhance the knowledge base of large models, and improve the accuracy and comprehensiveness of vulnerability detection and mining.

[0024] Furthermore, in the step S4, cross-language integration technology is used to call a Python-based security agent on a Java-based Web platform, and GRPC technology is used to build a high-performance, distributed, cross-language service architecture between the security agent and the Web system; the front-end visualization technology uses VUE and Element-UI to build a Web visualization framework, combines HTML5 and CSS to design the web page structure and style, and uses JavaScript to achieve dynamic interaction, supporting vulnerability analysis, test case generation and verification, and visual display of security knowledge questions and answers and other functions.

[0025] The present invention also provides a Web 0Day vulnerability detection and mining platform based on security intelligence, which adopts the above-mentioned Web 0Day vulnerability detection and mining method based on security intelligence to realize Web 0Day vulnerability detection and mining.

[0026] The present invention has the following characteristics and beneficial effects:

[0027] The present invention trains a security big model in the vertical network security field. Different from the existing security big models on the market, such as SecGPT, HackMentor, AutoAud it, etc., the model of the present invention improves its capabilities through more comprehensive and forward-looking data sources. In addition to common open source data sets and public data obtained through crawlers, it further integrates high-quality e-books purchased and the latest academic papers in the field of network security. Therefore, the big model trained by the present invention performs better in security knowledge questions and answers, test case generation, etc.

[0028] The present invention builds a security agent based on a self-trained security model. Compared with existing mainstream large language models such as GPT-4 and GLM-4, which cannot directly perform vulnerability analysis on the URL provided by the user, the security agent of the present invention can perform vulnerability analysis on the web page only through the URL provided by the user, generate effective test cases, and efficiently mine Web 0Day vulnerabilities.

[0029] The present invention builds a Web visualization platform that supports visualization of multiple functions such as vulnerability analysis, test case generation and verification, and security knowledge question and answer. Through interactive dialogue, users can easily perform Web vulnerability detection and analysis, generate test cases, and verify them. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 This is the overall framework diagram of the Web 0Day vulnerability detection and mining method based on security intelligence;

[0031] Figure 2 This is the result diagram of the security agent's Web 0Day vulnerability detection and mining verification;

[0032] Figure 3 Provide users with a flowchart for Web 0Day vulnerability mining and verification based on a Web visualization platform. DETAILED DESCRIPTION

[0033] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0034] The overall framework of the Web 0Day vulnerability detection and mining method based on security intelligence of the present invention is shown in the figure below: Figure 1 As shown, it includes 5 steps: data collection and preprocessing, large security model training, security intelligent agent construction, Web visualization platform construction, and Web visualization platform application.

[0035] 1. Data collection and preprocessing

[0036] In data collection and pre-processing process of the present invention, a part adopts Scrapy framework to carry out efficient data crawling, collects a large amount of knowledge related to network security through multiple channels such as search engine, blog forum, open source knowledge base. Specifically, the main data sources crawled include vulnerability information and utilization script in vulnerability library (such as CVE, NVD), attack sample (such as SQL injection, cross-site scripting) and flow log, security research paper and technical report, and project data of Web framework and open source code base. First, the Spider crawler of Scrapy framework is used to automatically crawl target data from these websites, such as vulnerability description, attack method, utilization script, flow log, technical documentation, etc., and extract corresponding information (such as, the numbering of vulnerability, the system affected, the vulnerability type, the code of attack sample, the offensive behavior in the flow log, the safety suggestion in the technical report, etc.) according to the structure of data. In order to adapt to the crawling of dynamic web content, the tools such as Middleware and Selenium of Scrapy are used in combination, and the page rendered by JavaScript is processed to ensure that complete web page data can be obtained.

[0037] Next, when cleaning the initially extracted security knowledge, you first need to format the crawled data and convert it into a structured format suitable for subsequent analysis and storage. For text data, first remove the noise information, including advertisements, page navigation, comments, and other parts that are not related to security knowledge. Then, apply targeted cleaning strategies for different types of data. For example, for vulnerability information, remove duplicate vulnerability descriptions and resolved vulnerability records, unify the naming conventions of vulnerability types, clean up irrelevant fields, and ensure that the description of each vulnerability item is concise and clear. For attack samples, such as SQL injection or cross-site scripting code snippets, it is necessary to remove useless comments and format information, and standardize the code format for subsequent analysis. For traffic logs, remove irrelevant request and response content, extract key attack behavior features, such as IP, port, request path, attack parameters, and other information, and unify the format to avoid redundant redundant data.

[0038] Another part of the data is collected manually. For manually collected e-books and papers in PDF format, OCR technology is needed to extract text information. First, PDF pages are converted into images using PDF2Image, and then text recognition is performed through the Tesseract OCR engine. In order to improve the recognition accuracy, the image can be preprocessed, including steps such as denoising, binarization, and rotation correction. The extracted text may contain recognition errors, so post-processing is required to correct common errors, clean up redundant characters, and structure the content such as paragraphs and titles. Finally, the cleaned text is saved in a standard format for subsequent storage and analysis.

[0039] 2. Security large model training

[0040] The security large model training process of the present invention mainly includes two stages: incremental pre-training stage and supervised instruction fine-tuning stage. In the incremental pre-training stage, the base model is trained with a large amount of data in the security field, so as to learn rich vertical field knowledge and expand its knowledge boundary. In the supervised instruction fine-tuning stage, the model is trained with self-constructed instruction question-answer pairs, so that the model's answers are more vertical to the security field and aligned with the human answer logic.

[0041] By comparing with other open source large models (such as Llama3, ChatGLM3, etc.), it is found that the Qwen 7B model shows a better effect when the number of parameters is similar, so Qwen7B is selected as the base model for subsequent training. The entire training process is based on the LLama-Factory framework, and the graphics card used is A10 with 32GB of video memory.

[0042] In the incremental pre-training stage, the model training time is relatively long, and each training takes about 25 hours. For more than 400,000 training data, the model needs to undergo about 10 rounds of incremental pre-training to ensure that the base model has sufficient knowledge accumulation in the security field. After completing the incremental pre-training, the next supervised instruction fine-tuning stage uses 4,000 self-built question-answer pairs for training, which takes about 13 hours. The data in this stage not only contains instruction question-answer pairs in the security field, but also deliberately mixes 20% of general knowledge. This design can effectively avoid catastrophic forgetting and maintain the model's general knowledge ability beyond security field knowledge.

[0043] In terms of training methods, the large security model trained by the present invention uses the Lora training method, which can significantly reduce the number of trainable parameters, reduce memory requirements, and improve training efficiency and computing efficiency. The Lora training method is also flexible and can save multiple small adapters for different tasks, thereby reducing the risk of overfitting and improving the generalization ability of the model under multiple tasks.

[0044] 3. Construction of secure intelligent entities

[0045] The construction of a safe agent is the core of this method. By using the agent characteristics of the large language model, Dify, an AI integrated development platform, and combining self-written tool components, a safe agent is constructed. The safe agent consists of four parts: the underlying large model, the memory module, the planning module, and the tool module.

[0046] The underlying big model uses the big security model obtained through the above training. Compared with the general big model, our model has deeper and richer knowledge in the security field. It focuses on vertical applications in the security field and can provide more accurate and professional security-related services. Specifically, the model access process first uses the convert_hf_to_gguf.py script in the llama.cpp tool to merge and convert the format of the trained big security model, merge multiple safetytensors files into a convert.bin file, and then use the quantization tool llama-quantize compiled from llama.cpp to quantize the convert.bin file to get quantized.bin, then write the Modelfile file, use the create command in Ollama to connect the big security model to Ollama, and finally connect Ollama to Dify.

[0047] In the tool module of the intelligent agent, three tool components are written by ourselves, namely RAG search enhancement generation tool, page analysis tool, and test case generation tool:

[0048] (1) RAG Retrieval Enhancement Generation Tool: This tool is mainly used to retrieve matching auxiliary information from the knowledge base based on user questions, and enhance the knowledge boundary of the large model without retraining the model or modifying the model parameters, so that the page analysis tool model can answer the cutting-edge knowledge of network security and the latest knowledge in the field. Specifically, the text data is segmented and quantized and stored in the vector database, and the semantic similarity is compared in the knowledge base according to the user's question, and the highly relevant content is recalled and re-ranked. Finally, the large model uses this part of the content as known auxiliary information and gives an answer in combination with the user's own question.

[0049] (2) Page analysis tool: This tool is used to crawl the content of web pages and perform cleaning and filtering. Specifically, it first uses the requests library to crawl static page content, which is suitable for pages that do not rely on JavaScript rendering. If the target page needs to load content dynamically, the tool will switch to Selenium, which can simulate user operations and load dynamic content generated by JavaScript to ensure that the complete information of the page is captured. After the page content is crawled, the tool will use the lxml library to parse and clean the page, which provides faster parsing speed and more powerful XPath support. During the parsing process, the tool will clean up redundant advertisements, navigation bars, footers and other irrelevant content, and only retain key page information related to security.

[0050] (3) Test case generation tool: When a vulnerability that needs further verification is found, the agent will request the large model to generate the corresponding test case code. Then the agent will call the test case generation tool to combine the URL provided by the user with the generated test case code. The splicing method is mainly to use regular expressions to dynamically identify and locate potential injection points in the URL. Through regular expression matching, different types of injection points can be automatically identified, including query parameters, path parts and even request headers. Then, the malicious payload will be inserted into the corresponding position according to the results of the regular expression matching, and finally a complete and executable test case set will be formed to help security testers verify whether the vulnerability really exists.

[0051] In the planning module of the intelligent agent, a route selection or question classifier is constructed, the purpose is to regard the question raised by the user as a classification task, and dynamically plan the appropriate execution path by combining the prompt word engineering of the large model and the characteristics of the intelligent agent itself, and call the corresponding tools to complete the task. In the design of the present invention, the underlying implementation of the route selection module relies on the powerful reasoning ability of the large model itself. Through the semantic understanding and context analysis of the user input question, combined with the designed prompt word engineering to guide the model to make accurate judgments, so that each problem processing can obtain the optimal path, thereby achieving efficient and accurate task execution.

[0052] The core model prompt words written by the present invention are as follows:

[0053]

[0054]

[0055] The memory module of the agent is divided into two parts: long-term memory and short-term memory. Long-term memory is achieved by vectorizing and encoding text information and storing it in a vector database; while short-term memory is achieved by using memory storage, cache, etc. In the present invention, long-term memory is used to assist in the execution of RAG retrieval enhancement generation tasks, liberating the time dependency in the model training process, so that it can answer cutting-edge knowledge about the security field. Short-term memory improves the agent's memory ability in the short term by temporarily storing information related to the current conversation, thereby enhancing the coherence and accuracy of the conversation.

[0056] The pseudo code of the model algorithm for this example is as follows:

[0057]

[0058]

[0059] The pseudo code is explained as follows:

[0060] The security agent determines the type of input question by selecting a route and generates the corresponding answer using different strategies. The core of the operation is to accurately classify the questions and select the most appropriate processing flow based on the characteristics of the questions.

[0061] First, when the input question is classified as a common sense question (including basic knowledge of network security), the intelligent body will directly reason and answer by calling the self-trained security big model. It is pre-trained on a large amount of security data, has the ability to handle common security problems and retains the ability to answer general knowledge. Therefore, it can quickly and accurately generate answers by relying on the big model's own question-answering capabilities.

[0062] For cutting-edge cybersecurity issues, the agent adopts a more complex processing flow. In this case, the RAG retrieval enhancement generation tool is first used to match and recall the content with the highest similarity to the question from the external knowledge base as supplementary information. Finally, the large model combines this supplementary information with the original question reasoning to generate a more accurate answer, especially when facing emerging security threats and complex technical backgrounds.

[0063] In the scenario of Web 0Day vulnerability mining, the intelligent body will first extract the URL from the question, crawl the corresponding page content through the page analysis tool and perform content filtering, and finally hand over the cleaned page content to the security big model to analyze the potential security vulnerabilities in the page and generate the corresponding vulnerability report. If a vulnerability that needs further verification is detected, the intelligent body will request the big model to continue to generate test case code, and then call the test case generation tool to splice and integrate the URL given by the user with the test case code to generate a complete and usable test case set. This process can not only identify potential security vulnerabilities on the page, but also generate test cases for vulnerability verification, improving the efficiency and accuracy of security analysis.

[0064] Finally, for questions that cannot be classified, the agent returns a default message of “cannot handle this question”. This design ensures that the agent can give clear feedback even when the input cannot be classified, avoiding situations where the agent does not respond or responds with the wrong answer due to hallucination questions.

[0065] After testing, existing mainstream large language models, such as GPT-4 and GLM-4, are unable to directly perform vulnerability analysis on URLs provided by users. Figure 2 As shown, the security agent constructed based on the self-trained security big model of the present invention can effectively analyze the vulnerabilities of Web pages and generate effective test cases, thereby efficiently mining Web 0Day vulnerabilities.

[0066] 4. Construction of Web Visualization Platform

[0067] The present invention adopts GRPC technology to build a high-performance, distributed, cross-language service architecture between the security agent and the Web system. First, the service and message format are defined through Protocol Buffers (protobuf), the corresponding Python server and Java client code are generated, and the RPC API is exposed. Then, the defined RPC service is implemented on the Python side, and the GRPC server is started; on the Java side, the client code is generated, the GRPC channel is created and connected to the server. Finally, through GRPC technology, the Java Web front-end system can effectively call the security agent written in Python to realize interaction with users.

[0068] Then, VUE and Element-UI technologies are used to build a Web visualization framework, HTML5 and CSS are combined to complete the web page structure and style design, and JavaScript is used to realize dynamic interaction of Web services.

[0069] 5. Application of Web visualization platform

[0070] Based on the Web visualization platform, users can easily interact with security agents to detect and mine Web 0Day vulnerabilities. The page is analyzed according to the URL provided by the user, potential vulnerabilities are identified, and corresponding test cases are generated on demand based on the analysis results. In addition, the Web platform also provides a test case verification function, which can batch verify the effects of test cases and present the detection results in a visual way, that is, the rendering of the page after sending the test case. The overall process is as follows: Figure 3 shown.

[0071] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments. The above embodiments and descriptions are only preferred examples of the present invention and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A Web 0Day vulnerability detection and mining method based on security intelligence, characterized in that: The following steps are involved: S1. Collection and preprocessing of massive network security related data; S2. Train a large security model in the vertical network security field; S3. Taking the aforementioned security big model as the core, combined with the customized memory module, tool module, and planning module, a security agent is constructed by utilizing the agent characteristics of the big model itself; S4, based on cross-language integration and front-end visualization technology, combined with security intelligence to build a Web visualization platform; S5. Based on the Web visualization platform, implement vulnerability analysis of Web page content, generation and effect verification of vulnerability test cases, and visual display of security professional knowledge questions and answers.

2. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 1, characterized in that: In the step S1, the collection of massive network security related data includes two parts: first, using the Scrapy framework to crawl network security related data from search engines and open source libraries; The second is to obtain e-books and paper collections in the field of network security through manual collection.

3. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 1, characterized in that: In the step S1, the preprocessing includes formatting the crawled data into a structured format, removing irrelevant noise information, and cleaning up duplicate, useless or redundant data according to the data type; extracting text from manually collected PDF documents using OCR technology, improving accuracy through image preprocessing and recognition correction, and finally structuring the text and saving it in a standard format.

4. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 1, characterized in that: In the step S2, based on the LLama-Factory framework, Qwen 7B is used as the base model, 400,000 Web vulnerability security data are used for 10 rounds of incremental pre-training, and 4,000 self-built question-answer pairs are used for supervised instruction fine-tuning to obtain a large security model in the vertical network security field.

5. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 4, characterized in that: The training process of step S2 includes an incremental pre-training stage and a supervised instruction fine-tuning stage; in the incremental pre-training stage, the base model is trained with a large amount of data from the security field, thereby learning rich vertical field knowledge and expanding its knowledge boundaries; in the supervised instruction fine-tuning stage, the model is trained with self-constructed instruction question-answer pairs, so that the model's answers are more vertical to the security field and aligned with the logic of human answers, and finally a large security model in the vertical network security field is obtained.

6. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 1, characterized in that: In step S3, the construction of the security agent is based on the Dify framework, and the security agent includes: The underlying big model uses the security big model to provide professional security decision support; The memory module consists of long-term memory and short-term memory. The long-term memory is used to assist in the execution of the RAG retrieval enhancement generation task, which frees up the time dependency in the model training process and enables it to answer cutting-edge knowledge in the security field. The short-term memory is used to temporarily store information related to the current conversation. The planning module is responsible for converting user security questions into classification tasks. It guides the model to make accurate judgments through semantic understanding and context analysis of user input questions, combined with the designed prompt word engineering, so that the optimal path can be obtained for each problem handling; The tool module includes page analysis tools, test case generation tools and RAG retrieval enhancement generation tools, which are used to assist in analyzing security vulnerabilities of Web pages, generate vulnerability test cases, and extract the latest security information from external literature and databases, enhance the knowledge base of large models, and improve the accuracy and comprehensiveness of vulnerability detection and mining.

7. The method for detecting and mining Web 0Day vulnerabilities based on security intelligence according to claim 1, characterized in that: In the step S4, the cross-language integration technology is used to call the Python-based security agent on the Java-based Web platform, and the GRPC technology is used to build a high-performance, distributed, cross-language service architecture between the security agent and the Web system; the front-end visualization technology uses VUE and Element-UI to build a Web visualization framework, combines HTML5 and CSS to design the web page structure and style, and uses JavaScript to achieve dynamic interaction, supporting vulnerability analysis, test case generation and verification, and visual display of security knowledge questions and answers.

8. A Web 0Day vulnerability detection and mining platform based on security intelligence, characterized by: The Web 0Day vulnerability detection and mining method based on security intelligence as described in any one of claims 1 to 7 is adopted to realize Web 0Day vulnerability detection and mining.

Images