A large language model-based penetration testing knowledge injection method and system

Abstract

This invention discloses a penetration testing knowledge injection method and system based on a large language model, belonging to the field of penetration testing knowledge injection technology. The method includes: acquiring penetration testing background knowledge using an open-source penetration testing platform; generating a penetration testing instruction dataset using the background knowledge and a large language model; dividing the penetration testing instruction dataset to determine a first and a second subset; fine-tuning the parameters of a small language model using the first subset; and using the fine-tuned small language model to perform penetration testing knowledge question answering and behavioral reasoning on questions in the second subset. This invention can enhance the model's adaptability and capability to penetration testing tasks while reducing model parameter deployment costs.

Description

Technical Field

[0001] This invention belongs to the field of penetration testing knowledge injection technology, and particularly relates to a penetration testing knowledge injection method and system based on a large language model. Background Technology

[0002] Knowledge injection is a method of incorporating domain-specific expertise or information into artificial intelligence (AI) models. It aims to improve the performance and understanding of AI models in specific tasks or domains, thereby empowering various industries. In general, knowledge injection holds immense potential in penetration testing, significantly enhancing the professional capabilities and adaptability of AI models.

[0003] Penetration testing refers to detecting security vulnerabilities in a target network system by simulating hacker attacks. This type of testing is authorized and aims to reveal and fix security flaws that could be maliciously exploited, thereby improving the network system's defense capabilities. Compared to traditional defense methods such as intrusion detection and firewall technology, penetration testing focuses more on comprehensively assessing the system's potential threats from the attacker's perspective. Completing a penetration test requires the operator to have a thorough understanding of the technical details and knowledge of penetration testing, as well as the ability to analyze and make decisions regarding situations arising at different stages of the penetration test. Therefore, penetration testing is a time-consuming and labor-intensive cybersecurity practice that urgently needs improvement and support.

[0004] As penetration testing progresses, models need a higher level of understanding and generalization of the penetration testing process, and existing methods often fall short of achieving ideal results. Currently, large language models are mainly used to assist penetration testing, but these models are generally closed-source, cannot be deployed locally, and have high deployment costs. The high deployment costs, coupled with the fact that penetration testing itself requires exploiting vulnerabilities, have led to large language models gradually becoming less effective in assisting penetration testing. Summary of the Invention

[0005] One of the objectives of this invention is to provide a penetration testing knowledge injection method based on a large language model. This penetration testing knowledge injection method can enhance the adaptability and capability of the model to penetration testing tasks while reducing the deployment cost of model parameters.

[0006] The second objective of this invention is to provide a penetration testing knowledge injection system based on a large language model.

[0007] To achieve one of the above objectives, the present invention employs the following technical solution:

[0008] A penetration testing knowledge injection method based on a large language model, the penetration testing knowledge injection method comprising:

[0009] Step S1: Use an open-source penetration testing platform to acquire background knowledge on penetration testing;

[0010] Step S2: Using the aforementioned penetration testing background knowledge, a large language model is used to generate a penetration testing instruction dataset;

[0011] Step S3: Divide the penetration test instruction dataset to determine a first penetration test instruction data subset and a second penetration test instruction data subset;

[0012] Step S4: Fine-tune the parameters of the small language model using the first subset of penetration test command data;

[0013] Step S5: Using the small language model with fine-tuned parameters, perform penetration testing knowledge question answering and behavioral reasoning on the questions in the second penetration testing instruction data subset.

[0014] Furthermore, the specific implementation process of step S1 includes:

[0015] Step S11: Collect knowledge texts related to penetration testing on open-source penetration testing platforms;

[0016] In step S11, the knowledge text includes penetration testing tool documents, vulnerability databases, security research papers, tutorials, and community discussion data;

[0017] Step S12: Filter the knowledge text to remove non-professional penetration testing knowledge;

[0018] In step S12, the non-professional penetration testing knowledge includes noisy data unrelated to penetration testing, non-penetration testing professional comments, and outdated penetration testing information;

[0019] Step S13: Classify the filtered knowledge texts to determine the background knowledge for penetration testing;

[0020] In step S13, the penetration testing background knowledge includes conceptual knowledge and practical knowledge of penetration testing.

[0021] Furthermore, in step S13, the conceptual knowledge includes basic principles, security concepts, and vulnerability types; the practical knowledge includes the usage methods of penetration testing tools and the implementation steps of the attack process.

[0022] Furthermore, in step S2, the specific process of generating the penetration testing instruction dataset includes:

[0023] Step S21: Based on the aforementioned penetration testing background knowledge, construct penetration testing input prompts using prompt engineering;

[0024] In S21, the penetration testing input prompts include the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set;

[0025] Step S22: Construct a penetration test example corresponding to the penetration test input prompt;

[0026] Step S23: Using the penetration test example, perform few-shot learning on the large language model to output a question-and-answer dataset for the penetration test;

[0027] Step S24: Verify the correctness of the penetration test question and answer dataset to generate a penetration test instruction dataset for executing penetration test tasks.

[0028] Furthermore, in step S24, the penetration test instruction data in the penetration test instruction dataset includes penetration test instructions, questions, and answers.

[0029] Furthermore, the specific implementation process of step S4 includes:

[0030] Step S41: Concatenate the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction;

[0031] Step S42: Perform word segmentation on the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model;

[0032] Step S43: Perform Chinese text vectorization on the sub-text unit sequence corresponding to each penetration test command to obtain the number sequence corresponding to each penetration test command;

[0033] Step S44: Input the numerical sequence corresponding to each penetration test command into the small language model for low-rank adaptive processing.

[0034] To achieve the second objective mentioned above, the present invention employs the following technical solution:

[0035] A penetration testing knowledge injection system based on a large language model, the penetration testing knowledge injection system comprising:

[0036] The acquisition module is used to acquire penetration testing background knowledge using an open-source penetration testing platform;

[0037] The generation module is used to generate a penetration testing instruction dataset by utilizing the aforementioned penetration testing background knowledge and employing a large language model.

[0038] A partitioning module is used to partition the penetration test instruction dataset to determine a first penetration test instruction data subset and a second penetration test instruction data subset;

[0039] The parameter fine-tuning module is used to fine-tune the parameters of the small language model using the first subset of penetration test command data;

[0040] The reasoning module is used to perform penetration testing knowledge question answering and behavioral reasoning on questions in the second subset of penetration testing command data using a small language model with fine-tuned parameters.

[0041] Furthermore, the acquisition module includes:

[0042] The collection submodule is used to collect knowledge texts related to penetration testing on open-source penetration testing platforms;

[0043] The knowledge texts include penetration testing tool documentation, vulnerability databases, security research papers, tutorials, and community discussion data.

[0044] The filtering submodule is used to filter the knowledge text to remove non-professional penetration testing knowledge;

[0045] The non-professional penetration testing knowledge includes noisy data unrelated to penetration testing, non-penetration testing professional comments, and outdated penetration testing information;

[0046] The classification submodule is used to classify the filtered knowledge text in order to determine the background knowledge for penetration testing;

[0047] The background knowledge on penetration testing includes both conceptual and practical knowledge of penetration testing.

[0048] Furthermore, the generation module includes:

[0049] A submodule is constructed to build penetration testing input prompts based on the aforementioned penetration testing background knowledge and using prompt engineering.

[0050] The penetration testing input prompts include the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set;

[0051] A construction submodule is used to construct a penetration test example corresponding to the penetration test input prompt words;

[0052] The few-shot learning module is used to perform few-shot learning on a large language model using the penetration test example to output a question-and-answer dataset for the penetration test.

[0053] The verification submodule is used to verify the correctness of the question-and-answer dataset for the penetration test in order to generate a dataset of penetration test instructions for executing the penetration test task.

[0054] Furthermore, the parameter fine-tuning module includes:

[0055] The splicing submodule is used to splice the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction;

[0056] The word segmentation processing submodule is used to segment the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model.

[0057] The Chinese text vectorization submodule is used to vectorize the Chinese text of the subtext unit sequence corresponding to each penetration test instruction to obtain the numerical sequence corresponding to each penetration test instruction.

[0058] The low-rank adaptive processing submodule is used to input the numerical sequences corresponding to each penetration test command into the small language model for low-rank adaptive processing.

[0059] In summary, the technical solution of the present invention has the following technical effects:

[0060] This invention utilizes penetration testing background knowledge and a penetration testing instruction dataset generated by a large language model to achieve parameter fine-tuning of a small language model. Through penetration testing knowledge question answering and behavioral reasoning of the small language model after parameter fine-tuning, it realizes the injection of penetration testing knowledge from the large language model and corresponding knowledge bases (such as open-source cybersecurity documents) into the local small language model. This significantly reduces the cost of deploying the model, increases the security of the large language model, and enhances the model's adaptability and capability to penetration testing tasks. It also utilizes the small language model for auxiliary decision-making during the penetration testing process. Attached Figure Description

[0061] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0062] Figure 1 This is a schematic diagram of the knowledge injection method for penetration testing based on a large language model according to an embodiment of the present invention. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] This embodiment presents a penetration testing knowledge injection method based on a large language model, referencing... Figure 1 The penetration testing knowledge injection method includes:

[0065] Step S1: Use an open-source penetration testing platform to acquire background knowledge on penetration testing.

[0066] This embodiment collects knowledge texts related to penetration testing on an open-source penetration testing platform. These knowledge texts include penetration testing tool documentation, vulnerability databases, security research papers, tutorials, and community discussion data. Collecting these materials (i.e., knowledge texts) is to obtain the theoretical foundation and practical guidance required for penetration testing, providing rich information resources for subsequent analysis and learning.

[0067] After collecting a large amount of text data, this step requires filtering this data to remove content irrelevant to penetration testing (i.e., non-professional penetration testing knowledge). During the filtering process, noisy data unrelated to penetration testing (such as advertisements), unprofessional comments (i.e., non-penetration testing professional comments), and outdated information (i.e., outdated penetration testing information) are removed to ensure that the remaining text contains only the essential penetration testing content, laying a solid foundation for subsequent classification and utilization.

[0068] The selected knowledge texts are categorized into conceptual knowledge and practical knowledge. Conceptual knowledge includes the basic principles of penetration testing, security concepts, and vulnerability types, while practical knowledge includes the usage of penetration testing tools and the implementation steps of attack techniques (i.e., the steps of the attack process). This categorization helps to better organize the materials and makes it easier for users to quickly find relevant learning resources as needed.

[0069] Based on the above, the specific implementation process of this step includes:

[0070] Step S11: Collect knowledge texts related to penetration testing on open-source penetration testing platforms;

[0071] The knowledge text in this embodiment includes penetration testing tool documentation, vulnerability databases, security research papers, tutorials, and community discussion data.

[0072] Step S12: Filter the knowledge text to remove non-professional penetration testing knowledge;

[0073] The non-professional penetration testing knowledge in this embodiment includes noisy data unrelated to penetration testing, non-expert penetration testing commentary, and outdated penetration testing information. For example, in the descriptions of different functional modules of Metasploit (the industry's most open-source and user-friendly penetration testing platform), the full name of the module, applicable platforms, description, related usage methods, reference URLs, author information, etc., are included. In order to generate only data that guides penetration testing, information such as author information and reference URLs that are not needed for the penetration testing behavior itself is filtered out.

[0074] Step S13: Classify the filtered knowledge texts to determine the background knowledge for penetration testing;

[0075] The background knowledge of penetration testing includes both conceptual and practical aspects. Conceptual knowledge includes basic principles, security concepts, and vulnerability types. Practical knowledge includes the usage of penetration testing tools and the implementation steps of the attack process.

[0076] Step S2: Using the aforementioned penetration testing background knowledge, a large language model is employed to generate a penetration testing instruction dataset.

[0077] By leveraging the prompting engineering of a large language model, effective input prompts are designed to guide the large language model in generating the expected output (i.e., the output penetration testing instruction dataset). The specific process includes:

[0078] Step S21: Based on the aforementioned penetration testing background knowledge, construct penetration testing input prompts using prompt engineering.

[0079] This embodiment utilizes prompt engineering in the large language model to construct a penetration testing input prompt, which includes the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set.

[0080] In this embodiment, the penetration testing role is: 1. You are an expert proficient in penetration testing; 2. This expert has extensive knowledge and can broadly expand upon given background information to create a diverse and high-quality set of questions and answers about penetration testing; 3. This set of questions and answers is presented as an instruction dataset in a specific JSON format for fine-tuning small models to significantly improve their performance in the field of penetration testing.

[0081] The skills for generating penetration testing questions and answers in this embodiment are: 1. Generating question and answer data; 2. Constructing a question and answer set of penetration testing knowledge based on the background information and specific categories (i.e., penetration testing background knowledge) provided by the user; 3. Ensuring that the generated penetration testing question and answer data is highly practical, accurate, and professional.

[0082] The penetration testing instruction set in this embodiment has the following limitations: 1. The generated JSON format data must include a data sequence number (id), a data category, an input (question), and an output (answer), and the JSON format data must be coherent and ordered; 2. The question and answer content should be closely focused on the penetration testing domain and strictly avoid irrelevant topics; 3. The content should be generated according to the category given by the user and strictly adhere to the expected number of data entries.

[0083] By setting up penetration testing roles, large language models can be more quickly integrated into the scenario and generate penetration testing-related content. Designing skills and constraints helps the large language model clarify the task's objectives and detailed requirements.

[0084] Step S22: Construct a penetration test example corresponding to the penetration test input prompt.

[0085] Few-shot learning (i.e., small-few-shot learning) involves providing a large language model with a small number of samples or examples (i.e., penetration test examples). The large language model can then generate similar sentences based on the context and relevant information in the samples. Before generating instruction data each time, samples are input during the dialogue. In this embodiment, the examples (penetration test examples) in the input samples are as follows:

[0086] {

[0087] ID: 129

[0088] "Category": "Reconnaissance"

[0089] "Input": "Describes how to scan an entire network segment using NMAP."

[0090] "Output": "To scan an entire network segment using NMAP, specify the target network segment using CIDR notation (e.g., 192.168.1.0 / 24) or an IP address range (e.g., 192.168.1.1-254)."

[0091] }

[0092] Step S23: Using the penetration test example, perform few-shot learning on the large language model to output a question-and-answer dataset for the penetration test.

[0093] Considering the limitations of the number of samples and the understanding of the target task, the generation process will adopt a few-sample (i.e., small-sample) learning design, requiring manual completion of several correct question-and-answer examples, so that the large language model can learn and generate high-quality answers even with a small number of samples.

[0094] Using a pre-trained (few-shot learning) large language model, instruction data will be generated based on previously categorized and organized penetration testing background knowledge and textual materials. This instruction data (question-answer dataset) is a crucial part of training the large language model, guiding it to learn how to execute penetration testing-related tasks based on specific instructions. For example, it generates instruction data on how to perform port scanning using specific tools and how to exploit known vulnerabilities. This data will help the model better understand and execute specific instructions in penetration testing.

[0095] Step S24: Verify the correctness of the penetration test question and answer dataset to generate a penetration test instruction dataset for executing penetration test tasks.

[0096] The verification process involves confirming the accuracy of the question-and-answer data generated by the large language model for penetration testing. This typically involves manual review or the use of predefined test sets. Manual review often involves students or teachers with strong cybersecurity backgrounds who use the background materials relied upon by the large language model and their own knowledge to examine parts of the questions and answers, thus evaluating the accuracy of the large language model's responses. Ensuring the accuracy of the question-and-answer data is crucial for the reliability and usability of the large language model.

[0097] After verifying the accuracy of the question-and-answer data, this data is integrated into a penetration testing instruction dataset. This dataset will serve as the foundation for fine-tuning and inference of the small language model. The process of creating the penetration testing instruction dataset requires ensuring the quality and diversity of the data so that the small language model can accurately understand and execute instructions across a wide range of scenarios.

[0098] The penetration test instruction dataset in this embodiment includes penetration test instructions, questions, and answers.

[0099] Step S3: Divide the penetration test instruction dataset to determine the first penetration test instruction data subset and the second penetration test instruction data subset.

[0100] Step S4: Fine-tune the parameters of the small language model using the first subset of penetration test command data.

[0101] This embodiment uses a subset of the penetration testing instruction dataset (i.e., the first penetration testing instruction data subset) and leverages LoRA (Low-Rank Adaptation) technology to achieve efficient parameter fine-tuning of a small-parameter language model. The specific implementation process of parameter fine-tuning includes:

[0102] Step S41: Concatenate the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction;

[0103] Step S42: Perform word segmentation on the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model;

[0104] Step S43: Perform Chinese text vectorization on the sub-text unit sequence corresponding to each penetration test command to obtain the number sequence corresponding to each penetration test command.

[0105] This embodiment can use a tokenizer to vectorize Chinese text.

[0106] Step S44: Input the numerical sequence corresponding to each penetration test command into the small language model for low-rank adaptive processing.

[0107] LoRA technology enables fine-tuning of small language models to optimize their performance in penetration testing. This approach allows small language models to better adapt to specific instructions and datasets without significantly increasing computational costs, thus enabling them to play a greater role in real-world applications. The fine-tuning process focuses on the model's accuracy and response speed, ensuring efficient and accurate execution of instructions in actual penetration testing. During training (i.e., the low-rank adaptive processing), only the parameters of the LoRA adapter are updated.

[0108] Step S5: Using the small language model with fine-tuned parameters, perform penetration testing knowledge question answering and behavioral reasoning on the questions in the second penetration testing instruction data subset.

[0109] The small-parameter model, fine-tuned using LoRA, demonstrates similar performance and capabilities in penetration testing knowledge-based question answering while having fewer parameters than the original large language model. The small language model uses user-provided questions as prompts, infers from these prompts, and generates answers consistent with the penetration testing domain. This allows for the injection of penetration testing knowledge from open-source cybersecurity documentation and the large language model, reducing model parameter deployment costs and enhancing the model's adaptability and capability to penetration testing tasks.

[0110] This embodiment utilizes penetration testing background knowledge and a penetration testing instruction dataset generated by a large language model to fine-tune the parameters of a small language model. Through penetration testing knowledge question answering and behavioral reasoning of the small language model after parameter fine-tuning, penetration testing knowledge from the large language model and corresponding knowledge bases (such as open-source cybersecurity documents) is injected into the local small language model. This significantly reduces the cost of deploying the model, increases the security of the large language model, and enhances the model's adaptability and capability to penetration testing tasks. The small language model is also used for auxiliary decision-making during the penetration testing process.

[0111] The above embodiments can be implemented using the technical solutions given in the following embodiments:

[0112] Another embodiment provides a penetration testing knowledge injection system based on a large language model, which includes:

[0113] The acquisition module is used to acquire penetration testing background knowledge using an open-source penetration testing platform;

[0114] The generation module is used to generate a penetration testing instruction dataset by utilizing the aforementioned penetration testing background knowledge and employing a large language model.

[0115] A partitioning module is used to partition the penetration test instruction dataset to determine a first penetration test instruction data subset and a second penetration test instruction data subset;

[0116] The parameter fine-tuning module is used to fine-tune the parameters of the small language model using the first subset of penetration test command data;

[0117] The reasoning module is used to perform penetration testing knowledge question answering and behavioral reasoning on questions in the second subset of penetration testing command data using a small language model with fine-tuned parameters.

[0118] Furthermore, the acquisition module includes:

[0119] The collection submodule is used to collect knowledge texts related to penetration testing on open-source penetration testing platforms;

[0120] The knowledge texts include penetration testing tool documentation, vulnerability databases, security research papers, tutorials, and community discussion data.

[0121] The filtering submodule is used to filter the knowledge text to remove non-professional penetration testing knowledge;

[0122] The non-professional penetration testing knowledge includes noisy data unrelated to penetration testing, non-penetration testing professional comments, and outdated penetration testing information;

[0123] The classification submodule is used to classify the filtered knowledge text in order to determine the background knowledge for penetration testing;

[0124] The background knowledge on penetration testing includes both conceptual and practical knowledge of penetration testing.

[0125] Furthermore, the generation module includes:

[0126] A submodule is constructed to build penetration testing input prompts based on the aforementioned penetration testing background knowledge and using prompt engineering.

[0127] The penetration testing input prompts include the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set;

[0128] A construction submodule is used to construct a penetration test example corresponding to the penetration test input prompt words;

[0129] The few-shot learning module is used to perform few-shot learning on a large language model using the penetration test example to output a question-and-answer dataset for the penetration test.

[0130] The verification submodule is used to verify the correctness of the question-and-answer dataset for the penetration test in order to generate a dataset of penetration test instructions for executing the penetration test task.

[0131] Furthermore, the parameter fine-tuning module includes:

[0132] The splicing submodule is used to splice the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction;

[0133] The word segmentation processing submodule is used to segment the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model.

[0134] The Chinese text vectorization submodule is used to vectorize the Chinese text of the subtext unit sequence corresponding to each penetration test instruction to obtain the numerical sequence corresponding to each penetration test instruction.

[0135] The low-rank adaptive processing submodule is used to input the numerical sequences corresponding to each penetration test command into the small language model for low-rank adaptive processing.

[0136] The principles, formulas, and parameter definitions involved in the above embodiments are all applicable and will not be repeated here.

[0137] The above embodiments merely illustrate several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A penetration testing knowledge injection method based on a large language model, characterized in that, The penetration testing knowledge injection method includes: Step S1: Use an open-source penetration testing platform to acquire background knowledge on penetration testing; Step S2: Using the aforementioned penetration testing background knowledge, a large language model is used to generate a penetration testing instruction dataset; In step S2, the specific process of generating the penetration testing instruction dataset includes: Step S21: Based on the aforementioned penetration testing background knowledge, construct penetration testing input prompts using prompt engineering; In S21, the penetration testing input prompts include the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set; Step S22: Construct a penetration test example corresponding to the penetration test input prompt; Step S23: Using the penetration test example, perform few-shot learning on the large language model to output a question-and-answer dataset for the penetration test; Step S24: Verify the correctness of the question-and-answer dataset for the penetration test to generate a penetration test instruction dataset for executing the penetration test task; Step S3: Divide the penetration test instruction dataset to determine a first penetration test instruction data subset and a second penetration test instruction data subset; Step S4: Fine-tune the parameters of the small language model using the first subset of penetration test command data; The specific implementation process of step S4 includes: Step S41: Concatenate the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction; Step S42: Perform word segmentation on the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model; Step S43: Perform Chinese text vectorization on the sub-text unit sequence corresponding to each penetration test command to obtain the number sequence corresponding to each penetration test command; Step S44: Input the numerical sequence corresponding to each penetration test command into the small language model for low-rank adaptive processing; Step S5: Using the small language model with fine-tuned parameters, perform penetration testing knowledge question answering and behavioral reasoning on the questions in the second penetration testing instruction data subset.

2. The penetration testing knowledge injection method according to claim 1, characterized in that, The specific implementation process of step S1 includes: Step S11: Collect knowledge texts related to penetration testing on open-source penetration testing platforms; In step S11, the knowledge text includes penetration testing tool documents, vulnerability databases, security research papers, tutorials, and community discussion data; Step S12: Filter the knowledge text to remove non-professional penetration testing knowledge; In step S12, the non-professional penetration testing knowledge includes noisy data unrelated to penetration testing, non-penetration testing professional comments, and outdated penetration testing information; Step S13: Classify the filtered knowledge texts to determine the background knowledge for penetration testing; In step S13, the penetration testing background knowledge includes conceptual knowledge and practical knowledge of penetration testing.

3. The penetration testing knowledge injection method according to claim 2, characterized in that, In step S13, the conceptual knowledge includes basic principles, security concepts, and vulnerability types; the practical knowledge includes the usage methods of penetration testing tools and the implementation steps of the attack process.

4. The penetration testing knowledge injection method according to claim 3, characterized in that, In step S24, the penetration test instruction data in the penetration test instruction dataset includes penetration test instructions, questions, and answers.

5. A penetration testing knowledge injection system based on a large language model, characterized in that, The penetration testing knowledge injection system includes: The acquisition module is used to acquire penetration testing background knowledge using an open-source penetration testing platform; The generation module is used to generate a penetration testing instruction dataset by utilizing the aforementioned penetration testing background knowledge and employing a large language model. The generation module includes: A submodule is constructed to build penetration testing input prompts based on the aforementioned penetration testing background knowledge and using prompt engineering. The penetration testing input prompts include the penetration testing role, the skills for generating penetration testing questions and answers, and the limitations of the penetration testing instruction set; A construction submodule is used to construct a penetration test example corresponding to the penetration test input prompt words; The few-shot learning module is used to perform few-shot learning on a large language model using the penetration test example to output a question-and-answer dataset for the penetration test. The verification submodule is used to verify the correctness of the question-and-answer dataset for the penetration test in order to generate a dataset of penetration test instructions for executing the penetration test task. A partitioning module is used to partition the penetration test instruction dataset to determine a first penetration test instruction data subset and a second penetration test instruction data subset; The parameter fine-tuning module is used to fine-tune the parameters of the small language model using the first subset of penetration test command data; The parameter fine-tuning module includes: The splicing submodule is used to splice the questions and answers corresponding to each penetration test instruction in the first penetration test instruction dataset to form the text corresponding to each penetration test instruction; The word segmentation processing submodule is used to segment the text corresponding to each penetration test instruction to generate a sequence of sub-text units corresponding to each penetration test instruction to be processed by the small language model. The Chinese text vectorization submodule is used to vectorize the Chinese text of the subtext unit sequence corresponding to each penetration test instruction to obtain the numerical sequence corresponding to each penetration test instruction. The low-rank adaptive processing submodule is used to input the numerical sequences corresponding to each penetration test command into the small language model for low-rank adaptive processing. The reasoning module is used to perform penetration testing knowledge question answering and behavioral reasoning on questions in the second subset of penetration testing command data using a small language model with fine-tuned parameters.

6. The penetration testing knowledge injection system according to claim 5, characterized in that, The acquisition module includes: The collection submodule is used to collect knowledge texts related to penetration testing on open-source penetration testing platforms; The knowledge texts include penetration testing tool documentation, vulnerability databases, security research papers, tutorials, and community discussion data. The filtering submodule is used to filter the knowledge text to remove non-professional penetration testing knowledge; The non-professional penetration testing knowledge includes noisy data unrelated to penetration testing, non-penetration testing professional comments, and outdated penetration testing information; The classification submodule is used to classify the filtered knowledge text in order to determine the background knowledge for penetration testing; The background knowledge on penetration testing includes both conceptual and practical aspects of penetration testing.

Images