Method and device for generating an automated vulnerability scan template based on a large language model

Abstract

The application provides a kind of big language model-based automated vulnerability scanning template generation method and device, it is related to network security technical field, the method comprises: generating vulnerability interaction summary information based on proof of concept verification;In any one vulnerability interaction process, request payload is generated according to vulnerability interaction summary information using request agent, key fragment information in the vulnerability interaction process is extracted in the case where the request payload is valid using evaluation agent, and verification rule is generated according to the key fragment information using extraction agent;Based on the request payload and verification rule corresponding to each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated.The big language model-based automated vulnerability scanning template generation method and device provided by the application utilize three collaborative model agents to perform a step-by-step conversion process, enabling automatic conversion from proof of concept verification to vulnerability scanning template, greatly improving the efficiency of vulnerability scanning template generation.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an automated vulnerability scanning template generation method and apparatus based on a large language model. Background Technology

[0002] Penetration testing, a key component of modern cybersecurity strategies, uses simulated attacks to identify and address potential security vulnerabilities, preventing their malicious exploitation. The vulnerability scanning phase is crucial for detecting potential security weaknesses, relying on predefined rules to guide the discovery process.

[0003] However, developing and maintaining these scanning rules presents significant challenges. While the cybersecurity community has publicly released numerous proof-of-concept (PoC) demonstrations, converting these diverse PoCs into standardized scanning templates is both complex and time-consuming. Security experts must analyze and transform various PoCs, including code in different programming languages, natural language descriptions, and various types of structured information, to suit the needs of vulnerability scanning frameworks such as Nuclei or PocSuite.

[0004] Therefore, there is an urgent need for an automated method to generate vulnerability scanning templates, which can directly convert proof-of-concept (PoC) into vulnerability scanning templates, thereby automating the process and improving the efficiency of vulnerability scanning template generation. Summary of the Invention

[0005] The purpose of this application is to provide an automated vulnerability scanning template generation method and apparatus based on a large language model. It utilizes three collaborative large language model agents to perform a step-by-step conversion process, thereby achieving automated conversion from proof of concept to vulnerability scanning templates and greatly improving the generation efficiency of vulnerability scanning templates.

[0006] This application provides a method for generating automated vulnerability scanning templates based on a large language model, including:

[0007] Obtain the proof-of-concept corresponding to the target vulnerability, and generate vulnerability interaction overview information based on the proof-of-concept; the vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; in any vulnerability interaction process, a request proxy is used to generate a request payload based on the vulnerability interaction overview information, an evaluation proxy is used to extract key fragment information in the vulnerability interaction process if the request payload is deemed valid, and an extraction proxy is used to generate verification rules based on the key fragment information; based on the request payload and verification rules obtained in each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated.

[0008] Optionally, generating vulnerability interaction overview information based on the proof of concept includes: generating vulnerability verification interaction overview information corresponding to the target vulnerability using a large language model based on the proof of concept; wherein, the vulnerability interaction overview information is text information containing multiple entries, and each entry contains vulnerability triggering association information; the vulnerability triggering association information includes: interaction purpose, dependent steps, and expected response.

[0009] Optionally, generating a request payload using the request proxy based on the vulnerability interaction overview information includes: using the request proxy to analyze the proof of concept, the vulnerability interaction overview information, and variables in the variable set to generate a request payload and interaction elements corresponding to the current vulnerability interaction process; wherein, the interaction elements include: target address, method to be invoked, request header information, and request data; the request payload is used to interact with the vulnerability range environment to trigger the target vulnerability.

[0010] Optionally, the verification rules include: matching rules and extraction rules; the step of using an evaluation agent to extract key fragment information in the vulnerability interaction process when the request payload is deemed valid, and using an extraction agent to generate verification rules based on the key fragment information, includes: generating a vulnerability interaction request containing the request payload corresponding to the current vulnerability interaction process based on the interaction element; performing vulnerability interaction with the vulnerability test environment based on the vulnerability interaction request to obtain vulnerability interaction response information, and using the evaluation agent to determine that the request payload is valid when the target vulnerability is determined to be triggered based on the vulnerability interaction response information; extracting key fragment information from the request data contained in the vulnerability interaction request and the vulnerability interaction response information when the request payload is determined to be valid; and using the extraction agent to analyze the key fragment information in the current vulnerability interaction process to generate matching rules and extraction rules corresponding to the current vulnerability interaction process; wherein, the matching rules are used to verify whether the target vulnerability is triggered; and the extraction rules are used to extract field data required for subsequent vulnerability interaction processes.

[0011] Optionally, the vulnerability interaction request carries a remote control command; the step of interacting with the vulnerability range environment based on the vulnerability interaction request to obtain vulnerability interaction response information, and using the evaluation agent to determine the validity of the request payload when it is determined that the target vulnerability has been triggered based on the vulnerability interaction response information, includes: interacting with the target host in the vulnerability range environment based on the vulnerability interaction request to obtain vulnerability interaction response information; analyzing the vulnerability interaction response information using the evaluation agent, and determining the validity of the request payload if the vulnerability interaction response information contains status information fed back by an out-of-band server; wherein, the remote control command is: a remote command executed by the target host when the vulnerability is triggered; when the target host executes the remote control command, it sends any network access request to the out-of-band server; the status information is: information fed back by the out-of-band server after receiving the network access request.

[0012] Optionally, after generating verification rules using the extraction agent based on the key fragment information, the method further includes: using the extraction rules to extract field data required for subsequent vulnerability interaction processes from the vulnerability interaction response information, and adding the extracted field data to the variable set.

[0013] Optionally, generating a vulnerability scanning template for the target vulnerability based on the request payload and verification rules corresponding to each vulnerability interaction process includes: generating a vulnerability scanning template for the target vulnerability based on vulnerability interaction metadata, the request payload corresponding to each vulnerability interaction process, the matching rules corresponding to each vulnerability interaction process, and the extraction rules corresponding to each vulnerability interaction process; wherein the vulnerability interaction metadata is generated based on the proof-of-concept proof corresponding to the target vulnerability, and the vulnerability interaction metadata includes the generic vulnerability disclosure number of the target vulnerability.

[0014] This application also provides an automated vulnerability scanning template generation device based on a large language model, comprising:

[0015] The information acquisition module is used to acquire the proof-of-concept corresponding to the target vulnerability and generate vulnerability interaction overview information based on the proof-of-concept. The vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process. The vulnerability interaction module is used to generate a request payload based on the vulnerability interaction overview information using a request proxy, extract key fragment information in the vulnerability interaction process using an evaluation proxy if the request payload is deemed valid, and generate verification rules based on the key fragment information using an extraction proxy in any vulnerability interaction process. The template generation module is used to generate a vulnerability scanning template for the target vulnerability based on the request payload and verification rules obtained in each vulnerability interaction process.

[0016] Optionally, the information acquisition module is specifically used to generate vulnerability verification interaction overview information corresponding to the target vulnerability based on the proof of concept using a large language model; wherein, the vulnerability interaction overview information is text information containing multiple entries, and each entry contains vulnerability triggering association information; the vulnerability triggering association information includes: interaction purpose, dependent steps, and expected response.

[0017] Optionally, the vulnerability interaction module is specifically used to utilize the request proxy to analyze the proof of concept, the vulnerability interaction overview information, and the variables in the variable set to generate the request payload and interaction elements corresponding to the current vulnerability interaction process; wherein, the interaction elements include: target address, method to be called, request header information, and request data; the request payload is used to interact with the vulnerability range environment to trigger the target vulnerability.

[0018] Optionally, the verification rules include: matching rules and extraction rules; the vulnerability interaction module is specifically used to generate a vulnerability interaction request containing the request payload corresponding to the current vulnerability interaction process based on the interaction element; the vulnerability interaction module is further used to perform vulnerability interaction with the vulnerability range environment based on the vulnerability interaction request, obtain vulnerability interaction response information, and use the evaluation proxy to determine that the request payload is valid if the target vulnerability is determined to be triggered based on the vulnerability interaction response information; the vulnerability interaction module is further used to extract key fragment information from the request data contained in the vulnerability interaction request and the vulnerability interaction response information if the request payload is determined to be valid; the vulnerability interaction module is further used to analyze the key fragment information in the current vulnerability interaction process using the extraction proxy to generate matching rules and extraction rules corresponding to the current vulnerability interaction process; wherein, the matching rules are used to verify whether the target vulnerability is triggered; the extraction rules are used to extract the field data required for subsequent vulnerability interaction processes.

[0019] Optionally, the vulnerability interaction request carries a remote control instruction; the vulnerability interaction module is specifically used to interact with the target host in the vulnerability range environment based on the vulnerability interaction request to obtain vulnerability interaction response information; the vulnerability interaction module is further used to analyze the vulnerability interaction response information using the evaluation proxy, and if the vulnerability interaction response information contains status information fed back by an out-of-band server, then the request payload is determined to be valid; wherein, the remote control instruction is: a remote command executed by the target host when the vulnerability is triggered; when the target host executes the remote control instruction, it sends any network access request to the out-of-band server; the status information is: information fed back by the out-of-band server after receiving the network access request.

[0020] Optionally, the vulnerability interaction module is further configured to extract field data required for subsequent vulnerability interaction processes from the vulnerability interaction response information using the extraction rules, and add the extracted field data to the variable set.

[0021] Optionally, the template generation module is specifically used to generate a vulnerability scanning template for the target vulnerability based on vulnerability interaction metadata, the request payload corresponding to each vulnerability interaction process, the matching rules corresponding to each vulnerability interaction process, and the extraction rules corresponding to each vulnerability interaction process; wherein, the vulnerability interaction metadata is generated based on the proof-of-concept proof corresponding to the target vulnerability, and the vulnerability interaction metadata includes the generic vulnerability disclosure number of the target vulnerability.

[0022] This application also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the automated vulnerability scanning template generation method based on a large language model as described above.

[0023] This application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the automated vulnerability scanning template generation method based on a large language model as described above.

[0024] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the automated vulnerability scanning template generation method based on a large language model as described above.

[0025] The method and apparatus for generating automated vulnerability scanning templates based on a large language model provided in this application first obtain a proof of concept (PCP) corresponding to the target vulnerability and generate vulnerability interaction overview information based on the PCP. The vulnerability interaction overview information characterizes the execution order and dependencies of at least one vulnerability interaction process. Then, in any vulnerability interaction process, a request proxy generates a request payload based on the vulnerability interaction overview information, an evaluation proxy extracts key fragment information from the vulnerability interaction process if the request payload is deemed valid, and an extraction proxy generates verification rules based on the key fragment information. Finally, based on the request payload and verification rules obtained in each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated. By utilizing three collaborative large language model proxies to perform a step-by-step conversion process, the conversion from PCP to vulnerability scanning templates is automated, significantly improving the generation efficiency of vulnerability scanning templates. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a diagram illustrating the vulnerability interaction intermediate provided in this application;

[0028] Figure 2 This is a schematic diagram illustrating the workflow for deriving the vulnerability triggering steps provided in this application;

[0029] Figure 3 This is a flowchart illustrating the automated vulnerability scanning template generation method based on a large language model provided in this application;

[0030] Figure 4 This is a schematic diagram of the automated vulnerability scanning template generation device based on a large language model provided in this application;

[0031] Figure 5 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0033] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0034] To address the technical problems of complex and inefficient vulnerability scanning template generation processes in related technologies, this application provides an automated vulnerability scanning template generation method based on a large language model. This invention aims to systematically convert various vulnerability proof-of-concept (PoC) formats into vulnerability scanning templates. To ensure the capture of data and sequential dependencies between PoC steps, and to integrate the request payload and verification rules of each step, this application also introduces a vulnerability interaction intermediate representation graph (PoCGraph) as a platform-independent data storage structure. This graph-based representation helps to uniformly convert PoCs with varying structures into a standardized intermediate format, enabling subsequent tasks to generate scanning templates across different vulnerability scanning frameworks.

[0035] like Figure 1 As shown, this is an intermediate representation diagram of vulnerability interaction provided in an embodiment of this application. Based on the design of the intermediate representation diagram of vulnerability interaction, this embodiment of the application first generates vulnerability interaction metadata (PoCInfo) and vulnerability interaction overview information (PoCOverview) from the proof of concept (PoC) provided by the user. Then, the vulnerability interaction overview information is used to guide the generation of each step of the vulnerability interaction process (PoCStep). Finally, three collaborative large language model proxies are used to perform the step-by-step transformation process.

[0036] like Figure 2 The diagram illustrates the workflow for deriving the vulnerability triggering process. The large language model agent provided in this embodiment includes a Request Agent, a Judge Agent, and an Extractor Agent. Each agent independently maintains its own dialogue context and coordinates internally, while still allowing users to interact transparently with this embodiment. The coordination efforts of these agents ultimately produce the final transformation output.

[0037] The automated vulnerability scanning template generation method based on a large language model provided in this application focuses on meticulously and systematically converting proof-of-concept demonstrations into vulnerability scanning templates to ensure the accuracy and effectiveness of each step. Given that failure in a single step can affect the entire process, this application employs a fine-grained, step-by-step conversion approach to address this challenge. To support this conversion process, this application designs a vulnerability interaction intermediate representation graph (PoCGraph) designed to meet two key objectives.

[0038] First, the intermediate vulnerability representation graph is standardized to eliminate reliance on any specific vulnerability scanning framework, thus achieving cross-platform compatibility. This standardized design avoids deep integration with specific scanning tools, allowing the converted result to flexibly adapt to various vulnerability scanning template formats. Second, the intermediate vulnerability representation graph retains detailed information from each step, accurately capturing data and sequential dependencies between steps. This enables the internal large language model agent in this embodiment to utilize the results of previous steps for continuous reasoning and processing during subsequent conversion steps, ensuring the logical coherence of the vulnerability proof-of-concept execution flow.

[0039] like Figure 2 As shown, the vulnerability interaction intermediate diagram consists of three components: vulnerability interaction metadata (PoCInfo), vulnerability interaction overview information (PoCOverview), and multiple vulnerability interaction steps (PoCStep). PoCInfo provides basic information about the PoC, including the Common Vulnerabilities & Exposures (CVE) number, the author of the proof-of-concept, the severity of the vulnerability, etc. The PoCOverview maintains the execution order and dependencies between each step, guiding the orderly execution of the vulnerability proof-of-concept process. Each instance in the multiple vulnerability interaction steps (PoCStep) contains two parts: the interaction request body (PoCRequest) and the response parser (PoCExtractor). The interaction request body defines how to construct the request to interact with the target server, while the response parser uses matching and extraction rules to parse the response and extract key information for subsequent decision-making and operations.

[0040] The vulnerability interaction intermediate representation diagram organizes the various vulnerability interaction processes and their individual steps into a linear relationship, although conditional judgments or loop logic may exist in practical applications. However, considering that the main purpose of PoC is to verify the existence of vulnerabilities rather than to execute complex attack behaviors, this simplified design not only reduces the complexity of the transformation but also maintains the basic ability to verify the existence of vulnerabilities. For example, when confirming an SQL injection vulnerability, verification can be completed simply by sending a malformed payload and matching the error message, without the need for complex iterative attempts or conditional logic. This approach ensures the simplicity and efficiency of the transformation process without losing its core function of verifying vulnerabilities.

[0041] The following description, in conjunction with the accompanying drawings, details the automated vulnerability scanning template generation method based on a large language model provided in this application, through specific embodiments and application scenarios.

[0042] like Figure 3 As shown in the embodiment of this application, an automated vulnerability scanning template generation method based on a large language model is provided. This method may include the following steps 301 to 303:

[0043] Step 301: Obtain the proof of concept corresponding to the target vulnerability, and generate vulnerability interaction overview information based on the proof of concept.

[0044] The vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; the vulnerability concept verification process includes multiple vulnerability interaction processes, and each vulnerability interaction process includes: generating a request payload, verifying the request payload, and generating verification rules.

[0045] For example, in order to convert the user-provided proof of concept (PoC) for a target vulnerability (which may be a web vulnerability) into an intermediate representation diagram of vulnerability interaction, this application embodiment first utilizes the logical reasoning capability of a large language model to generate vulnerability interaction overview information based on the user-provided proof of concept (PoC). This vulnerability interaction overview information is used to guide the generation of subsequent vulnerability triggering steps.

[0046] Specifically, step 301 above, the step of generating vulnerability interaction overview information based on the proof of concept, may further include the following step 301a:

[0047] Step 301a: Based on the proof of concept, use a large language model to generate the vulnerability verification interaction overview information corresponding to the target vulnerability.

[0048] The vulnerability interaction overview information is a text message containing multiple entries, and each entry contains vulnerability triggering association information; the vulnerability triggering association information includes: interaction purpose, dependent steps, and expected response.

[0049] For example, each entry in the vulnerability interaction overview information contains basic information about the vulnerability triggering step, including its interaction purpose, dependent steps, expected response, and the contribution of this interaction to vulnerability triggering. The vulnerability interaction overview information maintains a global context, ensuring consistency between adjacent steps during the generation of vulnerability triggering steps, rather than transforming each step in isolation.

[0050] Step 302: In any vulnerability interaction process, the request proxy generates a request payload based on the vulnerability interaction overview information, the evaluation proxy extracts key fragment information in the vulnerability interaction process if the request payload is deemed valid, and the extraction proxy generates verification rules based on the key fragment information.

[0051] The request proxy, the evaluation proxy, and the extraction proxy are cooperative large language model proxies.

[0052] For example, after generating the vulnerability interaction overview information, a vulnerability interaction process sequence can be generated sequentially. For instance... Figure 2 As shown, this process includes three steps: request payload generation, request payload verification, and verification rule generation. These three steps respectively undertake the three sub-tasks of generation, verification, and matching.

[0053] It is understood that, in the embodiments of this application, the large language model agent can input the data to be analyzed and the corresponding prompt words into the large language model, and then obtain the required content output by the large language model.

[0054] Specifically, step 302 above, the step of generating the request payload, may further include the following step 302a:

[0055] Step 302a: Utilize the request proxy to analyze the proof of concept, the vulnerability interaction overview information, and the variables in the variable set to generate the request payload and interaction elements corresponding to the current vulnerability interaction process.

[0056] The interaction elements include: target address, method to be invoked, request header information, and request data; the request payload is used to interact with the vulnerability range environment to trigger the target vulnerability; if there is no preceding vulnerability interaction process before the current vulnerability interaction process, the variable set is empty.

[0057] It should be noted that, in this embodiment of the application, the vulnerability interaction request is described as an HTTP request. At the beginning of a specific step in transforming the proof-of-concept (PoC), the request agent in this embodiment analyzes the original PoC information and the previously generated vulnerability interaction overview information (PocOverview) to extract the appropriate request payload (PoCRequest). During this process, the request agent identifies four basic HTTP interaction elements from the PoC: the Uniform Resource Locator (URL), the method invoked, the headers (i.e., the HTTP request headers), and the POST data. These key elements determine how to communicate with the target server using the HTTP protocol, such as sending a formatted payload to a specified URL.

[0058] Simultaneously, considering that interaction with the target server may rely on variables obtained from previous vulnerability interaction processes, the request broker also integrates the set of variables previously extracted throughout the transformation process. This process ensures that the generated request payload maintains the necessary context and dependencies established in earlier interaction steps, thereby guaranteeing the consistency and coherence of the operation. Although the request broker successfully generates the request payload, this generation process alone cannot fully guarantee the payload's validity. The generated request payload may contain minor issues or defects that could hinder the successful triggering of the vulnerability, such as incorrect parameter formats or a lack of necessary context-dependent values. Therefore, to ensure that the request payload can effectively interact with the target environment, a robust verification mechanism must be introduced to evaluate its validity. This verification mechanism is crucial for ensuring the reliability and accuracy of the entire process.

[0059] For example, in the request payload generation section, this application introduces a request agent based on a large language model to request the large language model to perform in-depth and detailed analysis on a given proof-of-concept (PoC) and extract request payload data that is critical to the current vulnerability interaction process. This request payload is the data carried in the vulnerability interaction request used to trigger the target vulnerability.

[0060] Specifically, step 302 above, specifically the step of requesting payload verification, may further include steps 302b1 to 302b3:

[0061] Step 302b1: Generate a vulnerability interaction request based on the interaction element, which includes the request payload corresponding to the current vulnerability interaction process.

[0062] Step 302b2: Based on the vulnerability interaction request, perform vulnerability interaction with the vulnerability range environment to obtain vulnerability interaction response information, and use the evaluation agent to determine that the request payload is valid if the target vulnerability is triggered based on the vulnerability interaction response information.

[0063] Step 302b3: If the request payload is determined to be valid, extract key fragment information from the request data contained in the vulnerability interaction request and the vulnerability interaction response information.

[0064] Specifically, if the target vulnerability is triggered, the request payload is determined to be valid; if the target vulnerability is not triggered, the request payload is determined to be invalid.

[0065] For example, in the request payload verification part, this application embodiment introduces a Judge Agent to determine whether the request payload in the previous step is valid, in order to block invalid request payloads caused by problems such as large language model illusion in advance. This judgment is based on the interaction between this application embodiment and the vulnerability range and the preset out-of-band server information status change.

[0066] It should be noted that, to verify the validity of the request payload generated in the previous steps, this embodiment deploys a component called a Judge Agent to deeply analyze the interaction process with the target server. After generating the request payload, this embodiment captures all traffic throughout the entire HTTP communication process. The Judge Agent evaluates these interactions by meticulously examining key metrics of specific HTTP status codes and response content to determine whether the request payload successfully triggered the target vulnerability. If the attempt fails, the Judge Agent performs a detailed analysis of the interaction traffic, generating a detailed interaction summary, which allows the Judge Agent to optimize subsequent request payloads based on more accurate information.

[0067] In one possible implementation, the proxies' analytical capabilities are not limited to standard HTTP response verification. While many web vulnerabilities can be identified through immediate HTTP response anomalies (such as SQL error messages), in some cases, vulnerability execution does not directly produce discernible response indicators.

[0068] Specifically, the vulnerability interaction request carries remote control instructions, and step 302b2 above may further include the following steps 302b21 ​​and 302b22:

[0069] Step 302b21: Based on the vulnerability interaction request, perform vulnerability interaction with the target host in the vulnerability range environment to obtain vulnerability interaction response information.

[0070] Step 302b22: Analyze the vulnerability interaction response information using the evaluation agent. If the vulnerability interaction response information contains status information fed back by the out-of-band server, then the request payload is determined to be valid.

[0071] Wherein, the remote control instruction is: the remote command executed by the target host when the vulnerability is triggered; when the target host executes the remote control instruction, it sends any network access request to the out-of-band server; the status information is: the information fed back by the out-of-band server after receiving the network access request.

[0072] For example, such as Figure 2 As shown, to address situations where information from the target host cannot determine whether a vulnerability has been triggered, this application embodiment also integrates an out-of-band (OOB) server for a secondary detection mechanism. The request proxy can embed commands like `nslookup oobserver.com` in the payload to trigger a DNS query. When the HTTP response lacks an explicit success indicator, the DNS query received by the OOB server can serve as confirmation of payload execution and the existence of the vulnerability; that is, whether the vulnerability on the target host has been triggered is determined by whether the out-of-band server returns status information. This dual-channel detection method enhances the ability of this application embodiment to transform vulnerability proof-of-concept methods, surpassing traditional response-based analysis. However, for vulnerabilities that neither provide HTTP response indicators nor trigger network interactions, the current method still has limitations, as remote verification is crucial for scanning-oriented applications.

[0073] It's important to note that when a vulnerability in a vulnerability range is triggered, there needs to be some feedback information to indicate whether the trigger was successful or not. For some vulnerabilities (such as sensitive file reading), triggering them will include some sensitive information in the vulnerability interaction response; however, for other vulnerabilities that do not provide feedback (such as silent command injection), whether or not they are triggered will not change the information returned by the target host. Therefore, simply using the information returned by the target host to determine whether a vulnerability has been triggered is insufficient.

[0074] Therefore, an out-of-band server was introduced. The out-of-band server itself does not contain vulnerabilities; its purpose is to detect whether the vulnerability testing environment actively accesses it. Normally, vulnerability testing environments do not actively access out-of-band servers. Access is only granted when a vulnerability, such as injecting commands like `nslookup`, is exploited into the vulnerability testing environment. Therefore, in addition to information from the target host, the access status of the out-of-band server can also reveal the triggering of vulnerabilities.

[0075] For example, to ensure the accuracy of analysis across various response patterns, the evaluation agent tracks all HTTP response redirects to avoid missing any critical information. Faced with large-scale HTTP responses that exceed the context window of a large language model, the evaluation agent employs a response slicing strategy. To avoid the problem of over-focusing on single fragments and losing the overall context that might result from treating HTTP responses simply as text, this strategy preserves the complete HTTP headers as part of the LLM input, processing only the response body in segments. This approach has proven effective because it uses HTTP status codes and header information to remind the LLM of the overall context of the response, preventing it from focusing excessively on isolated analysis of single fragments. Once it is determined that the current vulnerability interaction flow has achieved its intended goal, the evaluation agent extracts representative interaction fragments that demonstrate success. These key fragments may include HTTP response portions containing specific sensitive information or out-of-band server state changes (such as receiving a DNS request from the target server). This focused extraction process provides the Extractor Agent with refined input material, enabling it to develop accurate vulnerability detection rules without processing the entire server response. By providing refined, relevant fragments, the Judge Agent enables the Extractor Agent to bypass the need for comprehensive HTTP response analysis and directly utilize pre-filtered information, allowing it to focus more efficiently on generating matching and extraction rules.

[0076] For example, in the verification rule generation section, this application embodiment introduces an ExtractorAgent to extract and generate a series of matching rules and extraction rules based on information such as the current request payload and the content returned by the vulnerability range server. These matching rules are used to determine whether the current vulnerability triggering step is successful during vulnerability scanning, and to extract data fields that may be used in subsequent interaction steps based on the information returned by the victim server under the current vulnerability interaction, including but not limited to various login tokens, file upload paths, etc.

[0077] Specifically, step 302 above, the step of generating the verification rules, may further include the following step 302c:

[0078] Step 302c: Analyze the key segment information in the current vulnerability interaction process using the extraction agent, and generate matching rules and extraction rules corresponding to the current vulnerability interaction process.

[0079] The matching rules are used to verify whether the target vulnerability has been triggered; the extraction rules are used to extract the field data required for subsequent vulnerability interaction processes.

[0080] For example, after evaluating whether the agent has successfully extracted and displayed a successful interaction fragment, the ExtractorAgent performs in-depth analysis on these fragments to formulate precise matching and extraction rules. This process aims to ensure that scanning tools can accurately identify vulnerabilities in the target server and systematically collect relevant information from the response. Matching rules enable the scanner to identify vulnerabilities in the target server by detecting expected error messages or determining whether security patches have prevented the disclosure of sensitive information. Meanwhile, extraction rules focus on collecting relevant fields from the server response when predetermined objectives are met. The previously generated vulnerability interaction overview information (PocOverview) provides the extraction agent with the necessary context, ensuring the consistency of the extracted variables with the requirements of subsequent steps.

[0081] For example, to verify the existence of vulnerabilities, the matching rules employ multiple pattern types. One verification method is HTTP response code verification, which preliminarily determines the success or failure of the request by checking the returned HTTP status code. Another important verification method involves keyword detection in the HTTP header and response body, which identifies the presence of expected vulnerability indications by searching for predefined keywords or patterns. A further mechanism relies on out-of-band server status verification, where the target server initiates a query (such as a DNS query) to an external out-of-band server as indirect evidence of command execution success. For example, the existence of a command injection vulnerability can be confirmed when the response to an `id` command contains the string `uid=`, or when the target server initiates a DNS query to an out-of-band server.

[0082] For example, the extraction rules employ sophisticated regular expression techniques, enabling this embodiment to systematically extract sensitive information from server responses. This approach not only improves the accuracy of data extraction but also enhances the automation of the entire process. This strategy allows for efficient operation even with complex and varied response content. The extraction agent directly processes pre-filtered information using these refined, relevant fragments, focusing more effectively on generating matching and extraction rules, avoiding the need for a comprehensive analysis of the entire server response. This simplifies the processing flow and ensures the effective extraction and utilization of critical information, further supporting the accuracy and efficiency of vulnerability detection. Throughout the process, the extraction agent's operations closely revolve around the detailed information received from the evaluation agent, ensuring that each step is optimized and executed based on the most accurate data. This rigorous approach guarantees the coherence and effectiveness of the transformation process from proof-of-concept (PoC) to the vulnerability interaction intermediate representation graph (PocGraph).

[0083] Step 303: Based on the request payload and verification rules corresponding to each vulnerability interaction process, generate a vulnerability scanning template for the target vulnerability.

[0084] For example, after obtaining the request payload, matching rules, and extraction rules for each vulnerability interaction process, a vulnerability scanning template for the target vulnerability can be generated.

[0085] Specifically, step 303 above may also include the following step 303a:

[0086] Step 303a: Based on the vulnerability interaction metadata, the request payload corresponding to each vulnerability interaction process, the matching rules corresponding to each vulnerability interaction process, and the extraction rules corresponding to each vulnerability interaction process, generate a vulnerability scanning template for the target vulnerability.

[0087] The vulnerability interaction metadata is generated based on the proof-of-concept corresponding to the target vulnerability, and the vulnerability interaction metadata includes the generic vulnerability disclosure number of the target vulnerability.

[0088] For example, after obtaining all the relevant data in the vulnerability interaction diagram, a corresponding vulnerability scanning template can be generated.

[0089] In one possible implementation, it is also necessary to use extraction rules to extract the field data required for subsequent vulnerability interaction processes from the vulnerability interaction response information, and add the extracted field data to the variable set for use in subsequent vulnerability interaction processes.

[0090] For example, after step 302c above, the automated vulnerability scanning template generation method based on a large language model provided in this application embodiment may further include the following step 305:

[0091] Step 305: Use the extraction rules to extract the field data required for the subsequent vulnerability interaction process from the vulnerability interaction response information, and add the extracted field data to the variable set.

[0092] For example, the above field data includes, but is not limited to, various login tokens, file upload paths, etc.

[0093] For example, to comprehensively evaluate the effectiveness of this framework in converting vulnerability proof-of-concept into scanning templates, embodiments of this application designed a series of rigorous experiments. These experiments not only tested the performance of this method in interactive environments of varying complexity but also compared its performance with that of benchmark large language models. First, in the experimental design phase, a benchmark dataset containing various types of vulnerability PoCs was collected and constructed from environments such as Metasploit, Exploit-DB, and GitHub. This dataset covers various scenarios from simple to complex, aiming to simulate various situations that may be encountered in real-world applications, as shown in Table 1. Each PoC was carefully selected and validated to ensure its representativeness and challenge.

[0094] Table 1

[0095]

[0096] During the experiments, the automated vulnerability scanning template generation method based on a large language model provided in this application demonstrated superior conversion capabilities. By introducing a deterministic template generation method, this method successfully eliminated formatting errors generated by the benchmark model. Specifically, the method achieved a success rate of 57.2%, significantly outperforming the 28.2% and 25.6% success rates achieved by GPT-3.5-turbo and GPT-4o-mini, respectively. This indicates that, compared to traditional guess-based methods, this method, through automated server interaction and verification processes, greatly improves the accuracy and reliability of the converted templates.

[0097] Furthermore, this method performs impressively when handling complex interactions. Statistically, it consumes an average of approximately 70,000 tokens when processing PoCs involving multiple interactions, while the 80th percentile threshold is approximately 100,000 tokens. Considering the cost of the chosen model is less than 1 / M tokens (0.50 / M for GPT-3.5-turbo and 0.15 / M for GPT-4o-mini), this means the maximum cost per experiment does not exceed 0.1. Therefore, this method not only excels in performance but also offers a significant advantage in cost-effectiveness.

[0098] Experimental results show that this method, by employing advanced natural language understanding and logical reasoning techniques, not only significantly improves the success rate of converting Proof-of-Concept (PoC) to scanning templates, but also demonstrates superior performance on several key tasks. Compared to the baseline model, this method reduces the occurrence of formatting errors, enhances adaptability to complex vulnerability environments, and lowers costs while maintaining high efficiency.

[0099] The automated vulnerability scanning template generation method based on a large language model provided in this application first obtains the proof of concept (PPC) corresponding to the target vulnerability and generates vulnerability interaction overview information based on the PPC. The vulnerability interaction overview information characterizes the execution order and dependencies of at least one vulnerability interaction process. Then, in any vulnerability interaction process, a request proxy generates a request payload based on the vulnerability interaction overview information, an evaluation proxy extracts key fragment information from the vulnerability interaction process if the request payload is deemed valid, and an extraction proxy generates verification rules based on the key fragment information. Finally, based on the request payload and verification rules obtained in each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated. By utilizing three collaborative large language model proxies to perform the step-by-step conversion process, the automated conversion from PPC to vulnerability scanning template is achieved, significantly improving the generation efficiency of vulnerability scanning templates.

[0100] It should be noted that the automated vulnerability scanning template generation method based on a large language model provided in this application embodiment can be executed by an automated vulnerability scanning template generation device based on a large language model, or by a control module within that device for executing the automated vulnerability scanning template generation method based on a large language model. This application embodiment uses the execution of the automated vulnerability scanning template generation method based on a large language model by an automated vulnerability scanning template generation device as an example to illustrate the automated vulnerability scanning template generation device based on a large language model provided in this application embodiment.

[0101] It should be noted that, in the embodiments of this application, the accompanying drawings of the various methods described above illustrate the automated vulnerability scanning template generation method based on a large language model, all of which are exemplified by referring to one of the accompanying drawings in the embodiments of this application. In specific implementation, the automated vulnerability scanning template generation method based on a large language model shown in the accompanying drawings of the various methods described above can also be implemented in conjunction with any other accompanying drawings that can be combined as illustrated in the above embodiments, which will not be elaborated here.

[0102] The automated vulnerability scanning template generation device based on a large language model provided in this application is described below. The description below can be referred to in conjunction with the automated vulnerability scanning template generation method based on a large language model described above.

[0103] Figure 4 A schematic diagram of the structure of the automated vulnerability scanning template generation device based on a large language model provided in the embodiments of this application is shown below. Figure 4 As shown, it specifically includes:

[0104] Information acquisition module 401 is used to acquire the proof of concept corresponding to the target vulnerability and generate vulnerability interaction overview information based on the proof of concept; the vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; vulnerability interaction module 402 is used to generate a request payload based on the vulnerability interaction overview information using a request proxy, extract key fragment information in the vulnerability interaction process using an evaluation proxy if the request payload is deemed valid, and generate verification rules based on the key fragment information using an extraction proxy in any vulnerability interaction process; template generation module 403 is used to generate a vulnerability scanning template for the target vulnerability based on the request payload and verification rules obtained in each vulnerability interaction process.

[0105] Optionally, the information acquisition module 401 is specifically used to generate vulnerability verification interaction overview information corresponding to the target vulnerability based on the proof of concept using a large language model; wherein, the vulnerability interaction overview information is text information containing multiple entries, and each entry contains vulnerability triggering association information; the vulnerability triggering association information includes: interaction purpose, dependent steps, and expected response.

[0106] Optionally, the vulnerability interaction module 402 is specifically used to utilize the request proxy to analyze the proof of concept, the vulnerability interaction overview information, and the variables in the variable set to generate the request payload and interaction elements corresponding to the current vulnerability interaction process; wherein, the interaction elements include: target address, method to be called, request header information, and request data; the request payload is used to interact with the vulnerability range environment to trigger the target vulnerability.

[0107] Optionally, the verification rules include: matching rules and extraction rules; the vulnerability interaction module 402 is specifically used to generate a vulnerability interaction request containing the request payload corresponding to the current vulnerability interaction process based on the interaction element; the vulnerability interaction module 402 is further used to perform vulnerability interaction with the vulnerability range environment based on the vulnerability interaction request, obtain vulnerability interaction response information, and use the evaluation agent to determine that the request payload is valid if the target vulnerability is determined to be triggered based on the vulnerability interaction response information; the vulnerability interaction module 402 is further used to extract key fragment information from the request data contained in the vulnerability interaction request and the vulnerability interaction response information if the request payload is determined to be valid; the vulnerability interaction module 402 is further used to analyze the key fragment information in the current vulnerability interaction process using the extraction agent, and generate matching rules and extraction rules corresponding to the current vulnerability interaction process; wherein, the matching rules are used to verify whether the target vulnerability is triggered; the extraction rules are used to extract the field data required for subsequent vulnerability interaction processes.

[0108] Optionally, the vulnerability interaction request carries a remote control command; the vulnerability interaction module 402 is specifically used to interact with the target host in the vulnerability range environment based on the vulnerability interaction request to obtain vulnerability interaction response information; the vulnerability interaction module 402 is further used to analyze the vulnerability interaction response information using the evaluation agent, and if the vulnerability interaction response information contains status information fed back by an out-of-band server, then the request payload is determined to be valid; wherein, the remote control command is: a remote command executed by the target host when the vulnerability is triggered; when the target host executes the remote control command, it sends any network access request to the out-of-band server; the status information is: information fed back by the out-of-band server after receiving the network access request.

[0109] Optionally, the vulnerability interaction module 402 is further configured to extract field data required for subsequent vulnerability interaction processes from the vulnerability interaction response information using the extraction rules, and add the extracted field data to the variable set.

[0110] Optionally, the template generation module 403 is specifically used to generate a vulnerability scanning template for the target vulnerability based on vulnerability interaction metadata, the request payload corresponding to each vulnerability interaction process, the matching rules corresponding to each vulnerability interaction process, and the extraction rules corresponding to each vulnerability interaction process; wherein, the vulnerability interaction metadata is generated based on the proof-of-concept proof corresponding to the target vulnerability, and the vulnerability interaction metadata includes the generic vulnerability disclosure number of the target vulnerability.

[0111] The automated vulnerability scanning template generation device based on a large language model provided in this application first obtains the proof of concept corresponding to the target vulnerability and generates vulnerability interaction overview information based on the proof of concept. The vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process. Then, in any vulnerability interaction process, a request agent generates a request payload based on the vulnerability interaction overview information, an evaluation agent extracts key fragment information in the vulnerability interaction process if the request payload is deemed valid, and an extraction agent generates verification rules based on the key fragment information. Finally, based on the request payload and verification rules obtained in each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated. By using three collaborative large language model agents to perform a step-by-step conversion process, the conversion from proof of concept to vulnerability scanning template is automated, greatly improving the generation efficiency of vulnerability scanning templates.

[0112] Figure 5 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 5As shown, the electronic device may include a processor 510, a communications interface 520, a memory 530, and a communication bus 540, wherein the processor 510, communications interface 520, and memory 530 communicate with each other via the communication bus 540. The processor 510 can invoke logical instructions in the memory 530 to execute an automated vulnerability scanning template generation method based on a large language model. This method includes: first, obtaining a proof-of-concept corresponding to the target vulnerability and generating vulnerability interaction overview information based on the proof-of-concept; the vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; then, in any vulnerability interaction process, using a request proxy to generate a request payload based on the vulnerability interaction overview information, using an evaluation proxy to extract key fragment information in the vulnerability interaction process if the request payload is deemed valid, and using an extraction proxy to generate verification rules based on the key fragment information; finally, generating a vulnerability scanning template for the target vulnerability based on the request payload and verification rules obtained in each vulnerability interaction process. By utilizing three collaborative large language model proxies to perform a step-by-step conversion process, the conversion from proof of concept to vulnerability scanning templates is automated, greatly improving the efficiency of vulnerability scanning template generation.

[0113] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0114] On the other hand, this application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions, and when the program instructions are executed by a computer, the computer can execute the automated vulnerability scanning template generation method based on a large language model provided by the above methods. This method includes: first, obtaining a proof of concept corresponding to a target vulnerability, and generating vulnerability interaction overview information based on the proof of concept; the vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; then, in any vulnerability interaction process, using a request proxy to generate a request payload based on the vulnerability interaction overview information, using an evaluation proxy to extract key fragment information in the vulnerability interaction process if the request payload is deemed valid, and using an extraction proxy to generate verification rules based on the key fragment information; finally, generating a vulnerability scanning template for the target vulnerability based on the request payload and verification rules obtained in each vulnerability interaction process. By using three collaborative large language model proxies to perform a step-by-step conversion process, the automated conversion from proof of concept to vulnerability scanning template is achieved, greatly improving the generation efficiency of vulnerability scanning templates.

[0115] Furthermore, this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned automated vulnerability scanning template generation methods based on large language models. This method includes: first, obtaining a proof-of-concept corresponding to a target vulnerability and generating vulnerability interaction overview information based on the proof-of-concept; the vulnerability interaction overview information characterizes the execution order and dependencies of at least one vulnerability interaction process; then, in any vulnerability interaction process, using a request proxy to generate a request payload based on the vulnerability interaction overview information, using an evaluation proxy to extract key fragment information from the vulnerability interaction process if the request payload is deemed valid, and using an extraction proxy to generate verification rules based on the key fragment information; finally, generating a vulnerability scanning template for the target vulnerability based on the request payload and verification rules obtained in each vulnerability interaction process. By utilizing three collaborative large language model proxies to perform a step-by-step conversion process, the automated conversion from proof-of-concept to vulnerability scanning template is achieved, significantly improving the generation efficiency of vulnerability scanning templates.

[0116] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0117] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for generating automated vulnerability scanning templates based on a large language model, characterized in that, include: Obtain the proof of concept corresponding to the target vulnerability, and generate vulnerability interaction overview information based on the proof of concept; The vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; In any vulnerability interaction process, a request proxy is used to generate a request payload based on the vulnerability interaction overview information; an evaluation proxy is used to extract key fragment information in the vulnerability interaction process if the request payload is deemed valid; and an extraction proxy is used to generate verification rules based on the key fragment information. Based on the request payload and verification rules obtained in each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated. The verification rules include: matching rules and extraction rules; the step of using an evaluation proxy to extract key fragment information from the vulnerability interaction process when the request payload is deemed valid, and using an extraction proxy to generate verification rules based on the key fragment information, includes: A vulnerability interaction request is generated based on the interaction elements, which includes the request payload corresponding to the current vulnerability interaction process. The interaction elements include: target address, method to be called, request header information, and request data. The request payload is used to interact with the vulnerability range environment to trigger the target vulnerability. Based on the vulnerability interaction request, vulnerability interaction is performed with the vulnerability range environment to obtain vulnerability interaction response information. Then, using the evaluation agent, if it is determined that the target vulnerability has been triggered based on the vulnerability interaction response information, the request payload is determined to be valid. If the request payload is determined to be valid, key fragment information is extracted from the request data contained in the vulnerability interaction request and the vulnerability interaction response information. The extraction agent is used to analyze key segment information in the current vulnerability interaction process to generate matching rules and extraction rules corresponding to the current vulnerability interaction process. The matching rules are used to verify whether the target vulnerability has been triggered; the extraction rules are used to extract the field data required for subsequent vulnerability interaction processes.

2. The method according to claim 1, characterized in that, The generation of vulnerability interaction overview information based on the proof of concept includes: Based on the proof of concept, a vulnerability interaction overview information corresponding to the target vulnerability is generated using a large language model. The vulnerability interaction overview information is a text message containing multiple entries, and each entry contains vulnerability triggering association information; the vulnerability triggering association information includes: interaction purpose, dependent steps, and expected response.

3. The method according to claim 1 or 2, characterized in that, The process of generating a request payload using the request proxy based on the vulnerability interaction overview information includes: The request proxy analyzes the proof of concept, the vulnerability interaction overview information, and the variables in the variable set to generate the request payload and interaction elements corresponding to the current vulnerability interaction process.

4. The method according to claim 1, characterized in that, The vulnerability interaction request carries remote control instructions; The process of interacting with the vulnerability target environment based on the vulnerability interaction request to obtain vulnerability interaction response information, and then using the evaluation proxy to determine the validity of the request payload when the target vulnerability is determined to be triggered based on the vulnerability interaction response information, includes: Based on the vulnerability interaction request, vulnerability interaction is performed with the target host in the vulnerability range environment to obtain vulnerability interaction response information; The evaluation agent is used to analyze the vulnerability interaction response information. If the vulnerability interaction response information contains out-of-band server feedback status information, then the request payload is determined to be valid. The remote control command is a remote command executed by the target host when the vulnerability is triggered; when the target host executes the remote control command, it sends any network access request to the out-of-band server; the status information is the information fed back by the out-of-band server after receiving the network access request.

5. The method according to claim 1 or 4, characterized in that, After generating verification rules based on the key fragment information using the extraction agent, the method further includes: The extraction rules are used to extract the field data required for the subsequent vulnerability interaction process from the vulnerability interaction response information, and the extracted field data is added to the variable set.

6. The method according to claim 1, characterized in that, The process of generating a vulnerability scanning template for the target vulnerability based on the request payload and verification rules corresponding to each vulnerability interaction process includes: Based on the vulnerability interaction metadata, the request payload corresponding to each vulnerability interaction process, the matching rules corresponding to each vulnerability interaction process, and the extraction rules corresponding to each vulnerability interaction process, a vulnerability scanning template for the target vulnerability is generated. The vulnerability interaction metadata is generated based on the proof-of-concept corresponding to the target vulnerability, and the vulnerability interaction metadata includes the generic vulnerability disclosure number of the target vulnerability.

7. An automated vulnerability scanning template generation device based on a large language model, characterized in that, The device includes: The information acquisition module is used to acquire the proof of concept corresponding to the target vulnerability and generate vulnerability interaction overview information based on the proof of concept; the vulnerability interaction overview information is used to characterize the execution order and dependencies of at least one vulnerability interaction process; The vulnerability interaction module is used to generate a request payload based on the vulnerability interaction overview information using a request proxy, extract key fragment information in the vulnerability interaction process using an evaluation proxy if the request payload is deemed valid, and generate verification rules based on the key fragment information using an extraction proxy in any vulnerability interaction process. The template generation module is used to generate a vulnerability scanning template for the target vulnerability based on the request payload and verification rules corresponding to each vulnerability interaction process. The verification rules include: matching rules and extraction rules; the step of using an evaluation agent to extract key fragment information in the vulnerability interaction process when the request payload is deemed valid, and using an extraction agent to generate verification rules based on the key fragment information, includes: generating a vulnerability interaction request containing the request payload corresponding to the current vulnerability interaction process based on interaction elements; the interaction elements include: target address, called method, request header information, and request data; the request payload is used to interact with the vulnerability range environment to trigger the target vulnerability; based on the vulnerability interaction request, vulnerability interaction is performed with the vulnerability range environment to obtain vulnerability interaction response information, and the evaluation agent determines that the request payload is valid when the target vulnerability is determined to be triggered based on the vulnerability interaction response information; when the request payload is determined to be valid, key fragment information is extracted from the request data contained in the vulnerability interaction request and the vulnerability interaction response information; the extraction agent analyzes the key fragment information in the current vulnerability interaction process to generate matching rules and extraction rules corresponding to the current vulnerability interaction process; wherein, the matching rules are used to verify whether the target vulnerability is triggered; the extraction rules are used to extract field data required for subsequent vulnerability interaction processes.

8. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the automated vulnerability scanning template generation method based on a large language model as described in any one of claims 1 to 5.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the automated vulnerability scanning template generation method based on a large language model as described in any one of claims 1 to 5.

Images