Original vulnerability data translation compression method based on large language model and related equipment

Abstract

The application discloses a raw vulnerability data translation compression method based on a large language model and related equipment, extracts structured facts from raw vulnerability data based on a preset Prompt template and a large language model, the structured facts include network service facts and vulnerability existence facts, wherein the network service facts are used for describing target IP addresses, service names running, protocol types, port numbers and service running permissions; the vulnerability existence facts are used for describing vulnerabilities existing in services running on target IP addresses, and the existing vulnerabilities are identified through standard vulnerability numbers; vulnerability attribute standardized label association is performed on the vulnerabilities with the standard vulnerability numbers to generate vulnerability attribute facts; a direct mapping relationship between the vulnerabilities associated with the standardized vulnerability attribute labels and MSF utilization module paths is established to generate MSF utilization module mapping facts; the network service facts, the vulnerability existence facts, the vulnerability attribute facts and the MSF utilization module mapping facts are combined to form compressed vulnerability data sets through translation compression, and the compressed vulnerability data sets are expressed in the form of standardized predicate logic or key-value pair sets. The application can convert original and lengthy vulnerability scanning data into a highly structured and information-refined expression form.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method and related equipment for translating and compressing raw vulnerability data based on a large language model. Background Technology

[0002] In cybersecurity assessments and penetration testing, vulnerability scanning is a crucial method for discovering potential security risks. Scanning tools (such as Nmap with scripts, Nessus, OpenVAS, or the scanning module built into MSF) can identify services, ports, and known vulnerabilities on target systems. However, the raw reports generated by these tools often contain extensive natural language descriptions, diverse data formats, and high levels of information redundancy.

[0003] Security analysts need to extract key information from these complex reports, such as affected IP addresses, ports, service types, and CVE numbers of vulnerabilities, and determine the nature of the vulnerabilities (e.g., whether it is remote code execution, SQL injection, etc.). Furthermore, they need to find usable exploit code or methods for these vulnerabilities. Especially in frameworks like the Metasploit Framework (MSF), which integrates numerous pre-built exploit modules, quickly and accurately matching scanned vulnerabilities with specific exploit modules in MSF is a crucial aspect affecting work efficiency.

[0004] Currently, this process often relies on human experience or requires secondary processing using external scripts or tools. The raw scan data itself does not directly provide this precise mapping to MSF modules, and its redundant text descriptions are not conducive to automated machine processing and efficient storage. For example, to express that "the httpd service on IP address 10.20.0.68 has a CVE-2007-1603 vulnerability, which is a remotely exploitable privilege escalation vulnerability, and a corresponding exploit module exists in MSF," a traditional report might require a lot of text, but such a description is difficult to use directly in an automated process. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and related equipment for translating and compressing raw vulnerability data based on a large language model, which can transform raw and lengthy vulnerability scanning data into a highly structured and concise representation.

[0006] To solve the above-mentioned technical problems, the present invention is achieved through the following technical solution: According to a first aspect of the present invention, a method for transcoding and compressing raw vulnerability data based on a large language model is provided, comprising: Based on a pre-set Prompt template, a large language model is used to extract structured facts from the raw vulnerability data. The structured facts include network service facts and vulnerability existence facts. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service running permissions. The vulnerability existence facts describe the vulnerabilities existing in the service running on the target IP address, and the existing vulnerabilities are identified by standard vulnerability numbers. Associate standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers to generate vulnerability attribute facts; Establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, and generate MSF exploit module mapping facts; The network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts are combined, translated, and compressed to form a compressed vulnerability dataset, which is represented by a standardized set of predicate logic or key-value pairs.

[0007] In one possible implementation of the first aspect, the preset Prompt template is specifically: Extract the target IP address, running service name, protocol type, port number, service running permissions, standard vulnerability number, vulnerability attribute category, and vulnerability attribute value from the original vulnerability data, and output them as follows: networkSI (target IP address, name of the service to be run, protocol type, port number, and service running permissions); vulE(target IP address, standard vulnerability number, running service name); vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value).

[0008] In one possible implementation of the first aspect, the network service fact is represented as follows: networkSI (target IP address, name of the service to be run, protocol type, port number and service running permissions).

[0009] In one possible implementation of the first aspect, the existence of the vulnerability is represented as follows: vulE(target IP address, standard vulnerability number, running service name).

[0010] In one possible implementation of the first aspect, the vulnerability attribute fact is represented as follows: vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value).

[0011] In one possible implementation of the first aspect, the MSF utilizes the module mapping fact in the following form: mapExploit (standard vulnerability number, exploit module path).

[0012] In one possible implementation of the first aspect, the compressed vulnerability dataset is stored in text, JSON, or XML format, where, when stored as text, each line represents a fact.

[0013] According to a second aspect of the present invention, a raw vulnerability data translation and compression apparatus based on a large language model is provided, comprising: The extraction module is used to extract structured facts from the original vulnerability data based on a preset Prompt template and a large language model. The structured facts include network service facts and vulnerability existence facts. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service running permissions. The vulnerability existence facts describe the vulnerabilities existing in the service running on the target IP address, and the existing vulnerabilities are identified by standard vulnerability numbers. The association module is used to associate standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers, and generate vulnerability attribute facts; The mapping module is used to establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, and to generate MSF exploit module mapping facts. The compression module is used to combine the network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts, and translate and compress them to form a compressed vulnerability dataset. The compressed vulnerability dataset is represented by a standardized set of predicate logic or key-value pairs.

[0014] According to a third aspect of the present invention, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the aforementioned method for translating and compressing raw vulnerability data based on a large language model.

[0015] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned method for translating and compressing raw vulnerability data based on a large language model.

[0016] Compared with the prior art, the present invention has at least the following beneficial effects: This invention provides a method for translating and compressing raw vulnerability data based on a large language model. By using a pre-set Prompt template and a large language model, it extracts structured facts from raw vulnerability data, including network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts. These facts are then translated and compressed into a compressed vulnerability dataset represented by standardized predicate logic or key-value pair sets. This effectively removes lengthy natural language descriptions, retaining only core actionable information, reducing data volume, and improving information conciseness. This invention utilizes a large language model and a pre-set Prompt template to quickly and accurately extract key information from raw vulnerability data, generate structured facts, and establish a direct mapping relationship between vulnerabilities and MSF exploit modules. Compared to current methods that rely on manual experience or external scripts and tools for secondary processing, this invention significantly shortens the time required for this process, improves work efficiency, and enables security analysts to conduct subsequent penetration testing and vulnerability remediation work more efficiently. This invention transforms raw vulnerability data into standardized predicate logic or key-value pair sets, replacing lengthy text descriptions. This achieves data compression and structuring, making the structured data format easier for machines to read and process. Automated systems can quickly perform analysis and decision-making based on the compressed vulnerability dataset. This invention uses a unified preset Prompt template and a large language model to process the raw vulnerability data, ensuring the accuracy and consistency of the extracted data in terms of format and content. Regardless of the scanning tool from which the raw data originates, the processed data yields a consistent and reliable structured format, reducing errors caused by tool differences and manual processing.

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of the present invention, the drawings used in the description of the specific embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a method for translating and compressing raw vulnerability data based on a large language model according to the present invention; Figure 2 This is a schematic diagram of the structure of the compressed vulnerability dataset of this invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Combination Figure 1 and Figure 2 As shown, this invention provides a method for translating and compressing raw vulnerability data based on a large language model, specifically including the following steps: Step 1: Based on the preset Prompt template, extract structured facts from the original vulnerability data using a large language model. The structured facts include network service facts and vulnerability existence facts.

[0022] Specifically, based on a pre-defined Prompt template, the system guides the large language model to extract key information from raw vulnerability data reports in different formats. The pre-defined Prompt template is as follows: Extract the target IP address, running service name, protocol type, port number, service running permissions, standard vulnerability number, vulnerability attribute category, and vulnerability attribute value from the original vulnerability data, and output them as follows: networkSI (target IP address, name of the service to be run, protocol type, port number, and service running permissions); vulE(target IP address, standard vulnerability number, running service name); vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value).

[0023] Preferably, the pre-defined Prompt template also features: using few-shot thought chain technology, combined with a small number of labeled examples, to guide a large language model to accurately extract key information from vulnerability scanning reports of different formats. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service running permissions. In this embodiment, the network service facts are represented as: networkSI(target IP address, name of the running service, protocol type, port number, and service running permissions).

[0024] In other words, for each identified open service, a network service fact (networkSI) is generated (target IP address, running service name, protocol type, port number, and service running permissions). For example, if the scan finds that port 80 of 10.30.0.29 is running the TCP protocol httpd service, and it is inferred that its service running permissions are root, then the generated network service fact is: networkSI('10.30.0.29', httpd, tcp, 80, root).

[0025] The existence of a vulnerability describes a vulnerability present in a service running on the target IP address, and is identified by a standard vulnerability number (such as a CVE ID). In this embodiment, the existence of a vulnerability is represented as: vulE(target IP address, standard vulnerability number, name of the running service).

[0026] In other words, for each identified vulnerability associated with a service running on the target IP address, a vulnerability existence fact vulE(target IP address, standard vulnerability number, running service name) is generated. For example, if a scan finds a CVE-2007-1603 vulnerability in the httpd service on 10.20.0.68, the vulnerability existence fact generated would be: vulE('10.20.0.68', 'CVE-2007-1603', 'httpd').

[0027] It should be understood that the raw vulnerability data is obtained from one or more vulnerability scanning tools (such as Nmap's NSE script output, Nessus report XML files, the vulns table in the MSF database, etc.).

[0028] Step 2: Associate standardized vulnerability attribute tags with standard vulnerability numbers to generate vulnerability attribute facts. Vulnerability attribute facts are used to describe the technical characteristics or attack types corresponding to a specific vulnerability number, such as remote code execution (RCE), SQL injection (SQLi), privilege escalation (privEscalation), etc.

[0029] It should be noted that when associating standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers, a vulnerability knowledge base is used, which contains attribute information of known standard vulnerability numbers (CVEs).

[0030] In this embodiment, the vulnerability attribute fact is represented as: vulP(standard vulnerability number, vulnerability attribute category, vulnerability attribute value). For example, for CVE-2007-1603, the vulnerability attribute fact may be generated as follows: vulP('CVE-2007-1603', 'vulType', 'privEscalation'). vulP('CVE-2007-1603', 'accessVector', 'remote'). Common vulnerability attribute categories include, but are not limited to, deserialization, cross-site scripting (XSS), information disclosure, and buffer overflow. Vulnerability attribute values ​​include RCE, SQLi, XSS, Deserialization, AuthBypass, InfoLeak, BufferOverflow, etc.

[0031] Step 3: Establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF (Metasploit Framework) exploit module paths, and generate MSF exploit module mapping facts. The MSF exploit module mapping facts explicitly indicate the complete path of the MSF exploit module corresponding to a specific vulnerability number.

[0032] It should be understood that the Metasploit Framework (MSF) is an open-source penetration testing and security development platform widely used by security researchers, penetration testers, and ethical hackers for vulnerability exploitation, vulnerability research, and security assessment.

[0033] It should be noted that when establishing a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, the mapping table from standard vulnerability numbers (CVE) to MSF exploit module paths is known.

[0034] In this embodiment, the MSF exploit module mapping fact is represented as: mapExploit(standard vulnerability number, exploit module path). For example: mapExploit('CVE-2017-12629', 'exploit / multi / http / solr_velocity_rce'). mapExploit('CVE-2018-20062', 'exploit / unix / webapp / thinkphp_rce'). mapExploit('CVE-2019-15107', 'exploit / linux / http / webmin_backdoor'). If a CVE does not have a directly corresponding MSF exploit module path, this fact can be empty or point to a general auxiliary module or manual exploit guide.

[0035] Step 4: Combine the network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts, and translate and compress them to form a compressed vulnerability dataset. The compressed vulnerability dataset is represented by standardized predicate logic or key-value pair sets, replacing the lengthy natural language description, thus realizing the compression and structuring of the original vulnerability data.

[0036] In this embodiment, the compressed vulnerability dataset is stored in text, JSON, or XML format. When stored as text, each line represents a fact.

[0037] In other words, the facts are collected to form a logical set of facts. This set can be stored simply as a text file, one fact per line; or in a more structured way, such as an array of JSON objects, an XML document, or a database table. For example, a partial dataset of compressed vulnerabilities is shown below: networkSI('10.30.0.29', httpd, tcp, 80, root). networkSI('10.20.0.68', httpd, tcp, 80, user). vulE('10.20.0.68', 'CVE-2007-1603', 'httpd'). vulP('CVE-2007-1603', 'vulType', 'privEscalation'). vulP('CVE-2007-1603', 'accessVector', 'remote'). mapExploit('CVE-2007-1603', 'exploit / windows / some_module_for_cve_2007_1603'). vulE('10.30.0.29', 'CVE-2019-15107', 'httpd'). mapExploit('CVE-2019-15107', 'exploit / linux / http / webmin_backdoor'). vulP('CVE-2019-15107', 'vulType', 'RCE'). This set of facts is a compressed representation of the original vulnerability data, removing descriptive text and retaining only the core, actionable, machine-readable information.

[0038] When a user or automated script needs to take action against a specific IP address and vulnerability (e.g., vulE('10.20.0.68', 'CVE-2007-1603', 'httpd')), it utilizes the MSF exploit module mapping fact mapExploit associated with CVE-2007-1603 to obtain the MSF exploit module path (e.g., exploit / windows / some_module_for_cve_2007_1603). It also extracts the target IP address (10.20.0.68) and port (80) from the relevant network service fact networkSI (e.g., networkSI('10.20.0.68',httpd, tcp, 80, user)).

[0039] As a more preferred implementation, a method for translating and compressing raw vulnerability data based on a large language model further includes a dynamic optimization process: adjusting the preset Prompt template and the translation strategy of the large language model based on manual verification or automated feedback mechanisms to improve the accuracy of translation and adaptability to new report formats. Specifically, the Prompt template is adjusted based on historical translation results and user feedback.

[0040] It also features a multimodal input processing mechanism, supporting automatic recognition and processing of various report formats (such as text, XML, and JSON), and optimizing the mapping between vulnerability attributes and Metasploit Framework (MSF) exploit modules through a dynamic knowledge graph. It supports multimodal input processing, automatically recognizing and processing vulnerability scan reports in various formats such as text, XML, and JSON, and dynamically selecting the appropriate Prompt template based on the report format; it maintains the mapping relationship between vulnerability attributes and MSF exploit modules through a dynamic knowledge graph, updating graph nodes and edges in real time to adapt to incremental changes in new vulnerability types and MSF modules.

[0041] This implementation method uses a dynamic optimization process and a multimodal input processing mechanism, combined with manual verification or automated feedback to adjust the translation strategy, supports automatic recognition and processing of various report formats, and utilizes dynamic knowledge graphs to optimize mapping, adapting to changes in the network security environment.

[0042] The invention will now be described with reference to specific examples.

[0043] Raw data: interfaces: ############################################################ # DMZ Layer (10 hosts: 10.1.0.11 ~ 10.1.0.20) ############################################################ - hostname: dmz-web-11 os_type: debian iface: eth0 mac_address: "00:50:56:a1:11:01" address: "10.1.0.11 / 24" secondary_ips: ["10.1.0.111 / 24"] gateway: "10.1.0.1" dns: ["8.8.8.8", "8.8.4.4"] mtu: 1500 vlan: 100 state: up description: "DMZ Apache Web Server" services: - name: dmz_web_11 protocol: tcp port: 80 permissions: root vulnerabilities: - cve: CVE-2024-1234 description: "Apache httpd " attributes: vulType: RCE accessVector: remote - hostname: dmz-web-12 os_type: windows iface: Ethernet0 mac_address: "00:50:56:a1:11:02" address: "10.1.0.12 / 24" gateway: "10.1.0.1" dns: ["8.8.8.8", "8.8.4.4"] mtu: 1500 state: up description: "DMZ IIS Server" services: - name: dmz_web_12 protocol: tcp port: 80 permissions: user - hostname: dmz-web-13 os_type: rhel iface: ens192 mac_address: "00:50:56:a1:11:03" address: "10.1.0.13 / 24" gateway: "10.1.0.1" dns: ["8.8.8.8", "8.8.4.4"] state: up description: "DMZ Nginx Reverse Proxy" services: - name: dmz_web_13 protocol: tcp port: 80 permissions: user ############################################################ # Application Layer (10.2.0.11 ~ 10.2.0.30) ############################################################ - hostname: app-11 os_type: debian iface: eth0 mac_address: "00:50:56:a1:21:01" address: "10.2.0.11 / 24" gateway: "10.2.0.1" dns: ["10.3.0.11", "10.3.0.12"] state: up bonding: false description: "Tomcat App Server #1" services: - name: app_11 protocol: tcp port: 8080 permissions: user - hostname: app-12 os_type: windows iface: Ethernet0 mac_address: "00:50:56:a1:21:02" address: "10.2.0.12 / 24" gateway: "10.2.0.1" dns: ["10.3.0.11", "10.3.0.12"] state: up description: ".NET App Server #2" services: - name: app_12 protocol: tcp port: 8080 permissions: user vulnerabilities: - cve: CVE-2024-5678 description: ".NET" attributes: vulType: infoLeak accessVector: remote ############################################################ # Database Layer (10.3.0.11 ~ 10.3.0.15) ############################################################ - hostname: db-11 os_type: debian iface: eth0 mac_address: "00:50:56:a1:31:01" address: "10.3.0.11 / 24" gateway: "10.3.0.1" dns: ["8.8.8.8"] mtu: 9000 state: up description: "MySQL Primary Database" services: - name: db_11 protocol: tcp port: 3306 permissions: root - hostname: db-12 os_type: windows iface: Ethernet0 mac_address: "00:50:56:a1:31:02" address: "10.3.0.12 / 24" gateway: "10.3.0.1" dns: ["8.8.8.8"] state: up description: "MSSQL Database Server" services: - name: db_12 protocol: tcp port: 1433 permissions: user ############################################################ # File Server Layer (10.3.0.16 ~ 10.3.0.20) ############################################################ - hostname: fs-16 os_type: debian iface: eth0 mac_address: "00:50:56:a1:32:01" address: "10.3.0.16 / 24" gateway: "10.3.0.1" dns: ["8.8.8.8"] state: up description: "FTP Server (Internal)" services: - name: fs_16 protocol: tcp port: 21 permissions: user ############################################################ # Workstation Layer (10.3.0.31 ~ 10.3.0.50) ############################################################ - hostname: ws-31 os_type: windows iface: Ethernet0 mac_address: "00:50:56:a1:33:01" Address: "10.3.0.31 / 24" gateway: "10.3.0.1" DNS: ["8.8.8.8", "8.8.4.4"] state: up vlan: 300 description: "Employee Windows Workstation" services: - name: ws_31 protocol: tcp port: 3389 permissions: user - hostname: ws-32 os_type: debian iface: eth0 mac_address: "00:50:56:a1:33:02" Address: "10.3.0.32 / 24" gateway: "10.3.0.1" DNS: ["8.8.8.8", "8.8.4.4"] state: up description: "Employee Linux Workstation" services: - name: ws_32 protocol: tcp port: 22 permissions: user The compressed data using the method of this invention is as follows: networkSI('10.1.0.11', dmz_web_11, tcp, 80, root). networkSI('10.2.0.12', app_12, tcp, 8080, user). vulE('10.1.0.11', 'CVE-2024-1234', dmz_web_11). vulE('10.2.0.12', 'CVE-2024-5678', app_12). vulP('CVE-2024-1234', 'vulType', 'RCE'). vulP('CVE-2024-1234', 'accessVector', 'remote'). vulP('CVE-2024-5678', 'vulType', 'infoLeak'). vulP('CVE-2024-5678', 'accessVector', 'remote'). The original data contained numerous fields for each host, such as hostname, operating system type, interface name, MAC address, gateway, DNS, etc., resulting in a large amount of redundant information. The compressed data, however, retains only the network service facts, vulnerability existence facts, and vulnerability attribute facts closely related to network security analysis, removing non-core information such as hostname and operating system type. This significantly reduces the data volume, making the data more concise and clear, and facilitating the rapid retrieval of key information.

[0044] Despite data compression, all critical information remains intact. For network service facts, key elements such as the target IP address, running service name, protocol type, port number, and service permissions are clearly provided, clearly demonstrating the operational status of the network service. The vulnerability existence facts accurately identify the vulnerable IP address, standard vulnerability number, and running service name, enabling analysts to quickly locate the vulnerability. The vulnerability attribute facts further provide important attributes such as the vulnerability type and access vector.

[0045] The compressed data uses a standardized predicate logic representation, resulting in a unified format and clear structure. This representation facilitates automated machine processing and parsing. For example, security analysis tools or automated scripts can quickly read this data and perform further analysis, statistics, or take appropriate security measures based on the factual information contained within. This eliminates the need for complex processing and parsing of the original, complex data structure, improving the efficiency and accuracy of automated processing.

[0046] By combining the facts of a vulnerability's existence with its attributes, a quick understanding of the vulnerability's specifics can be achieved. For example, compressed data clearly shows that the dmz_web_11 service running on the host with IP address 10.1.0.11 is vulnerable to CVE-2024-1234, a remote code execution vulnerability that can be exploited remotely. This provides security analysts with clear vulnerability information, enabling them to quickly assess the risk and take appropriate measures, such as updating software and deploying protective strategies, thereby effectively improving work efficiency and the timeliness of vulnerability handling.

[0047] This invention provides a raw vulnerability data translation and compression device based on a large language model, used to implement the aforementioned raw vulnerability data translation and compression method based on a large language model, specifically including the following modules: The extraction module is used to extract structured facts from the original vulnerability data based on a preset Prompt template and a large language model. The structured facts include network service facts and vulnerability existence facts. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service running permissions. The vulnerability existence facts describe the vulnerabilities existing in the service running on the target IP address, and the existing vulnerabilities are identified by standard vulnerability numbers.

[0048] The association module is used to associate standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers, and generate vulnerability attribute facts.

[0049] The mapping module is used to establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, generating MSF exploit module mapping facts.

[0050] The compression module is used to combine the network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts, and translate and compress them to form a compressed vulnerability dataset. The compressed vulnerability dataset is represented by a standardized set of predicate logic or key-value pairs.

[0051] All relevant content regarding the steps involved in the aforementioned embodiment of the raw vulnerability data translation and compression method based on a large language model can be referenced from the functional description of the corresponding functional module of the raw vulnerability data translation and compression device based on a large language model in this invention embodiment, and will not be repeated here. The module division in this embodiment is illustrative and only represents a logical functional division. In actual implementation, there may be other division methods. Furthermore, the functional modules in the various embodiments of this invention can be integrated into a processor, exist as separate physical entities, or have two or more modules integrated into one module. The integrated modules can be implemented in hardware or as software functional modules.

[0052] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a method for translating and compressing raw vulnerability data based on a large language model.

[0053] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the above embodiment regarding a method for translating and compressing raw vulnerability data based on a large language model.

[0054] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0055] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0056] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0057] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0058] This invention also provides a computer program product, which is used to execute any of the above-described methods for translating and compressing raw vulnerability data based on a large language model. Since the computer program product provided by this invention belongs to the same inventive concept as the above-described method for translating and compressing raw vulnerability data based on a large language model, it possesses all the advantages of the above-described method. Therefore, the beneficial effects of the computer program product provided by this invention will not be elaborated upon here.

[0059] In this invention, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0060] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for transcoding and compressing raw vulnerability data based on a large language model, characterized in that, include: Based on a pre-defined Prompt template, structured facts are extracted from the raw vulnerability data using a large language model. These structured facts include network service facts and vulnerability existence facts. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service's permissions. The vulnerability existence facts describe vulnerabilities present in the service running on the target IP address, and these vulnerabilities are identified using standard vulnerability numbers. The pre-defined Prompt template is as follows: Extract the target IP address, running service name, protocol type, port number, service running permissions, standard vulnerability number, vulnerability attribute category, and vulnerability attribute value from the original vulnerability data, and output them as follows: networkSI (target IP address, name of the service to be run, protocol type, port number, and service running permissions); vulE(target IP address, standard vulnerability number, running service name); vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value); Associate standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers to generate vulnerability attribute facts; Establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, and generate MSF exploit module mapping facts; The network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts are combined, translated, and compressed to form a compressed vulnerability dataset, which is represented by a standardized set of predicate logic or key-value pairs.

2. The method for transcoding and compressing raw vulnerability data based on a large language model according to claim 1, characterized in that, The network service fact is represented in the following form: networkSI (target IP address, name of the service to be run, protocol type, port number and service running permissions).

3. The method for translating and compressing raw vulnerability data based on a large language model according to claim 1, characterized in that, The existence of the vulnerability is represented in the following form: vulE(target IP address, standard vulnerability number, running service name).

4. The method for transcoding and compressing raw vulnerability data based on a large language model according to claim 1, characterized in that, The vulnerability attribute fact is represented in the following form: vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value).

5. A method for translating and compressing raw vulnerability data based on a large language model according to claim 1, characterized in that, The MSF uses the following representation of the module mapping fact: mapExploit (standard vulnerability number, exploit module path).

6. The method for translating and compressing raw vulnerability data based on a large language model according to claim 1, characterized in that, The compressed vulnerability dataset is stored in text, JSON, or XML format. When stored as text, each line represents a fact.

7. A device for translating and compressing raw vulnerability data based on a large language model, characterized in that, include: The extraction module is used to extract structured facts from the raw vulnerability data based on a preset Prompt template and a large language model. These structured facts include network service facts and vulnerability existence facts. The network service facts describe the target IP address, the name of the running service, the protocol type, the port number, and the service's running permissions. The vulnerability existence facts describe vulnerabilities present in the service running on the target IP address, and these vulnerabilities are identified using standard vulnerability numbers. The preset Prompt template is specifically as follows: Extract the target IP address, running service name, protocol type, port number, service running permissions, standard vulnerability number, vulnerability attribute category, and vulnerability attribute value from the original vulnerability data, and output them as follows: networkSI (target IP address, name of the service to be run, protocol type, port number, and service running permissions); vulE(target IP address, standard vulnerability number, running service name); vulP (standard vulnerability number, vulnerability attribute category, vulnerability attribute value); The association module is used to associate standardized vulnerability attribute tags with vulnerabilities that have standard vulnerability numbers, and generate vulnerability attribute facts; The mapping module is used to establish a direct mapping relationship between vulnerabilities with standardized vulnerability attribute tags and MSF exploit module paths, and to generate MSF exploit module mapping facts. The compression module is used to combine the network service facts, vulnerability existence facts, vulnerability attribute facts, and MSF exploit module mapping facts, and translate and compress them to form a compressed vulnerability dataset. The compressed vulnerability dataset is represented by a standardized set of predicate logic or key-value pairs.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a raw vulnerability data translation and compression method based on a large language model as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements a raw vulnerability data translation and compression method based on a large language model as described in any one of claims 1 to 6.

Images