Security vulnerability detection method and device, medium and program product

Abstract

The invention discloses a security vulnerability detection method and device, a medium and a program product, and the method comprises the steps: obtaining an asset vulnerability data set, and dividing the asset vulnerability data set into a first data set, a second data set and a third data set; the first data set is used for performing zero sample prompt learning on the large language model; the second data set comprises prompt data and answer data and is used for carrying out prompt reinforcement learning on the large language model; the third data set comprises asset data and an associated asset detection program; performing iterative training on the large language model by using the first data set, the second data set and the third data set, and taking the trained large language model as a vulnerability detection model; and inputting to-be-detected target asset data into the vulnerability detection model to obtain a vulnerability detection result. According to the technical scheme provided by the embodiment of the invention, potential safety hazards in the computer system can be quickly identified, the manual detection cost is reduced, and the safety of the computer system is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, is applicable to financial software scenarios, and in particular to a security vulnerability detection method, device, medium, and program product. Background Art

[0002] System security vulnerabilities, also known as system vulnerabilities, refer to flaws and deficiencies in the design and implementation of computer hardware, software, and protocols, as well as in system security policies. If exploited by unauthorized users, these vulnerabilities could allow them to gain system privileges and perform illegal operations, leading to security incidents.

[0003] In the prior art, vulnerability detection in computer systems typically involves using security scanning tools based on vulnerability signature libraries. However, there are numerous types of security vulnerabilities, each requiring a targeted approach to detection. While there are many different vulnerability scanning tools, none are capable of simultaneously detecting multiple vulnerability types. Each tool has its own specific focus and complements each other; no single tool can detect all vulnerabilities.

[0004] Current vulnerability detection tools are unable to conduct in-depth mining, analysis, classification, and identification of diverse assets, and detection results rely on manual participation and expert experience, making automation difficult. Summary of the Invention

[0005] The present invention provides a security vulnerability detection method, device, medium and program product, which can overcome the limitations of a single vulnerability detection tool, quickly identify potential security risks in computer systems, and reduce manual detection costs.

[0006] According to one aspect of the present invention, a security vulnerability detection method is provided, the method comprising:

[0007] Acquire an asset vulnerability dataset, and divide the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset;

[0008] The first data set is used for zero-shot prompt learning of the large language model; the second data set includes prompt data and answer data, which are used for prompt reinforcement learning of the large language model; the third data set includes asset data and associated asset detection procedures;

[0009] Iteratively train a large language model using the first data set, the second data set, and the third data set, and then use the trained large language model as a vulnerability detection model;

[0010] The target asset data to be detected is input into the vulnerability detection model, and the vulnerability detection result corresponding to the target asset data is output through the vulnerability detection model.

[0011] According to another aspect of the present invention, a security vulnerability detection device is provided, the device comprising:

[0012] A data set acquisition module, configured to acquire an asset vulnerability data set and divide the asset vulnerability data set into a first data set, a second data set, and a third data set;

[0013] The first data set is used for zero-shot prompt learning of the large language model; the second data set includes prompt data and answer data, which are used for prompt reinforcement learning of the large language model; the third data set includes asset data and associated asset detection procedures;

[0014] A model training module, configured to iteratively train a large language model using the first data set, the second data set, and the third data set, and then use the trained large language model as a vulnerability detection model;

[0015] The model output module is used to input the target asset data to be detected into the vulnerability detection model, and output the vulnerability detection results corresponding to the target asset data through the vulnerability detection model.

[0016] According to another aspect of the present invention, an electronic device is provided, comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the security vulnerability detection method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security vulnerability detection method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the security vulnerability detection method according to any embodiment of the present invention is implemented.

[0022] The technical solution provided by the embodiment of the present invention obtains an asset vulnerability dataset, divides the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset, uses the first dataset, the second dataset, and the third dataset to iteratively train a large language model, and then uses the trained large language model as a vulnerability detection model. The target asset data to be detected is input into the vulnerability detection model, and the vulnerability detection result corresponding to the target asset data is output through the vulnerability detection model. This technical means provides a more efficient and accurate vulnerability detection method, which can overcome the limitations of a single vulnerability detection tool in the existing technology, realize rapid identification of potential security risks in computer systems, and predict unknown threats, thereby reducing manual detection costs and improving computer system security.

[0023] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a security vulnerability detection method provided according to an embodiment of the present invention;

[0026] Figure 2 is a flow chart of another security vulnerability detection method provided by an embodiment of the present invention;

[0027] Figure 3 2 is a schematic structural diagram of a security vulnerability detection device provided by an embodiment of the present invention;

[0028] Figure 4 It is a structural diagram of an electronic device that implements the security vulnerability detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Figure 1 This is a flowchart of a security vulnerability detection method provided by an embodiment of the present invention. This embodiment is applicable to the case of detecting security vulnerabilities in a computer system. The method can be executed by a security vulnerability detection device. The security vulnerability detection device can be implemented in the form of hardware and / or software. The device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0032] Step 110: Acquire an asset vulnerability dataset, and divide the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset.

[0033] In this step, the assets may include computers, servers, network equipment, printers, and other tangible devices that are critical to the efficiency of enterprise operations. The asset vulnerability dataset may include asset data (such as the corresponding software data, operating system, application system, middleware, code, encryption algorithm, etc.) and massive vulnerability intelligence data.

[0034] In this embodiment, after obtaining the asset vulnerability dataset, it can be divided into a first dataset, a second dataset, and a third dataset. The first dataset is used for zero-shot prompt learning of the large language model; the second dataset includes prompt data and answer data, which are used for prompt-reinforced learning of the large language model; and the third dataset includes asset data and associated asset detection programs.

[0035] Specifically, the first dataset may include only prompt data, but not answer data, for zero-shot prompt learning of the large language model. Zero-shot prompt learning refers to the process of designing training samples without providing any relevant examples to the large language model. This allows the model to recognize and classify new categories even if it has not previously processed samples of these categories, thereby improving the model's generalization ability.

[0036] Optionally, the prompt data may include software name, software version data, registration information in the registration file, dependent libraries and components, firmware information, remote upgrade method, communication protocol, identity authentication method, API interface, data synchronization strategy, distributed multi-threading mechanism, memory management information, etc. For example, the format of a training sample in the first data set may be "The server operating system is xxx, the application software xxx is installed, the installation package is xxx, the version number is xxx, are there any security vulnerabilities? What is the risk level?"

[0037] The second data set may include prompt data and answer data, which are used to perform prompt-enhanced learning on the large language model. The prompt-enhanced learning refers to adding a small number of examples to the training samples to guide the model to learn new tasks, thereby improving the model performance in data-scarce scenarios. Optionally, the answer data may include whether there are vulnerabilities, vulnerability names, risk levels, code programs, and vulnerability solutions. For example, the format of a training sample in the second data set may be "The server operating system is xxx, the application software xxx is installed, the installation package is xxx, the version number is xxx, are there any security vulnerabilities? What is the risk level? The answer is that this installation package has a security vulnerability, and the risk level is 3."

[0038] The third dataset may include asset data and associated asset detection programs, used to train the large language model's query capabilities for the associated asset data. For example, a training sample in the third dataset might be formatted as follows: "The server's operating system is xxx, and application software xxx is installed. I want to check whether software package xxx and its corresponding version number are installed on the server. Please generate the corresponding detection program code. The answer is that the detection program's Python code is xxx."

[0039] The advantage of this setting is that by constructing a third data set including asset data and associated asset detection programs, the large language model can be equipped with the ability to query associated asset data, avoiding omissions in the detection results of the current asset data, thereby ensuring the comprehensiveness and effectiveness of the detection results.

[0040] Step 120: Use the first data set, the second data set, and the third data set to iteratively train the large language model, and then use the trained large language model as a vulnerability detection model.

[0041] In this embodiment, the first, second, and third datasets can be input into a large language model for iterative training. During this iterative training process, the large language model can deeply explore the characteristic information and correlations between asset data and vulnerability intelligence data, and continuously fine-tune the training parameters based on the output results. After training is complete, the model parameters can be fine-tuned based on the training results to optimize the model's detection performance and ensure that the final output results are accurate and appropriate.

[0042] Step 130: Input the target asset data to be detected into the vulnerability detection model, and output the vulnerability detection results corresponding to the target asset data through the vulnerability detection model.

[0043] In one implementation of this embodiment, a software scanning tool can be used to obtain target asset data to be detected on the current device. This target asset data is then input into a vulnerability detection model, which then outputs vulnerability detection results corresponding to the target asset data. The target asset data can include installed software information, dependency libraries, configuration files, framework information, platform information (including name, version, upgrade method, read / write permissions, etc.), software runtime data, timing status, communication data packets, and the like on the current device.

[0044] In another implementation of this embodiment, in addition to obtaining the target asset data to be detected in the current device through a scanning tool, it is also possible to directly receive the target asset data to be detected in an external device input by the user, and then directly input the target asset data to be detected in the external device into the vulnerability detection model, and output the vulnerability detection results through the vulnerability detection model.

[0045] The technical solution provided by the embodiment of the present invention obtains an asset vulnerability dataset, divides the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset, uses the first dataset, the second dataset, and the third dataset to iteratively train a large language model, and then uses the trained large language model as a vulnerability detection model. The target asset data to be detected is input into the vulnerability detection model, and the vulnerability detection result corresponding to the target asset data is output through the vulnerability detection model. This technical means provides a more efficient and accurate vulnerability detection method, which can overcome the limitations of a single vulnerability detection tool in the existing technology, realize rapid identification of potential security risks in computer systems, and predict unknown threats, thereby reducing manual detection costs and improving computer system security.

[0046] Figure 2 A flowchart of another security vulnerability detection method provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0047] Step 210: Obtain script language codes from the asset vulnerability dataset, and analyze the script language codes using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data.

[0048] In this embodiment, a gradient boosting decision tree algorithm, comprised of multiple decision trees, is used to solve data classification and regression problems. By iteratively training the decision tree model, data prediction capabilities can be gradually improved. Specifically, the gradient boosting decision tree algorithm can be used to extract features from scripting language code in an asset vulnerability dataset. A decision tree model is then iteratively trained based on the feature extraction results. The decision tree model is then used to classify the asset vulnerability data, yielding asset data with vulnerabilities, asset data without vulnerabilities, and asset data categories with vulnerabilities, such as function logic vulnerability data, interface vulnerability data, and access permission vulnerability data.

[0049] In one implementation of this embodiment, a gradient boosting decision tree algorithm is used to analyze the script language code to obtain different types of asset vulnerability data, including: performing syntax analysis on the script language code and generating an abstract syntax tree corresponding to the script language code based on the syntax analysis result; and analyzing the abstract syntax tree corresponding to the script language code using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data.

[0050] Specifically, a gradient boosting decision tree algorithm can be used to analyze the correlation between data in the abstract syntax tree, and then the asset vulnerability data can be classified according to the correlation analysis results to obtain different types of asset vulnerability data.

[0051] The advantage of this setting is that by constructing an abstract syntax tree corresponding to the script language code and pre-classifying the asset vulnerability data, the large language model can analyze potential vulnerabilities in the script language code to the greatest extent, such as functions, interface parameters, module or middleware access rights, etc., and the script language code is combined with related data such as version information, dependent libraries, security policies, configuration information, upgrade interfaces, etc., thereby enriching the vulnerability analysis corpus centered on the syntax tree, enabling the large language model to detect vulnerabilities more efficiently.

[0052] Step 220: Clean and normalize the different types of asset vulnerability data respectively, and then divide the processed asset vulnerability data into a first data set, a second data set, and a third data set.

[0053] In this step, specifically, different types of asset vulnerability data can be cleaned separately, such as removing redundant data, non-comparison statements and names, and then the cleaned asset vulnerability data is normalized, and finally the normalized asset vulnerability data is divided.

[0054] The advantage of this setting is that it can improve the data quality of large language model training samples, help the large language model better learn the patterns and regularities in the data, and improve the detection performance of the large language model.

[0055] Step 230: Use the first data set, the second data set, and the third data set to iteratively train the large language model, and verify the detection performance of the trained large language model.

[0056] In this embodiment, optionally, when verifying the detection performance of the trained large language model, the quality of the output result of the current large language model can be judged by using pre-established boundary conditions or knowledge base.

[0057] The large language model can be a lightweight model built based on a sliding window attention mechanism, wherein the sliding window size and moving step size corresponding to the sliding window attention mechanism are pre-configured according to the vulnerability detection task.

[0058] Specifically, users can pre-set the sliding window size and moving step size corresponding to the sliding window attention mechanism based on the complexity of the vulnerability detection task. Optionally, users can also refer to the characteristics, attributes, and hazard level of known vulnerability data to further adjust the set sliding window size and moving step size.

[0059] The benefit of this setup is that traditional global attention mechanisms need to consider the relationships between all data features, resulting in a large number of parameters and computational complexity, making deployment difficult and complex. Furthermore, global attention mechanisms do not always extract the most critical feature information. In contrast, the sliding window attention mechanism significantly reduces the computational resources required by the global attention mechanism by dividing data features into multiple small windows and independently calculating attention for each window. This reduces the model size without sacrificing the performance of the large language model, making it easier to deploy in different vulnerability detection scenarios. Furthermore, the adjustable sliding window mechanism increases the flexibility of the vulnerability detection process.

[0060] Step 240: If the detection performance of the trained large language model is successfully verified, the trained large language model is used as a vulnerability detection model.

[0061] The advantage of this setting is that by using the large language model with successful performance verification as the final vulnerability detection model, the accuracy and effectiveness of the vulnerability detection results can be guaranteed.

[0062] In one implementation of this embodiment, after verifying the detection performance of the trained large language model, the method further includes: if the detection performance verification of the trained large language model fails, correcting the output result of the large language model, and generating a target training sample based on the corrected output result; and retraining the large language model using the target training sample until the detection performance verification of the large language model is successful.

[0063] The advantage of this setting is that by retraining the large language model with the corrected output results, the quality of the vulnerability detection model can be improved, ensuring the feasibility and effectiveness of the vulnerability detection model.

[0064] Step 250: Input the target asset data to be detected into the vulnerability detection model, and output the vulnerability detection results corresponding to the target asset data through the vulnerability detection model.

[0065] In this embodiment, the vulnerability detection result corresponding to the target asset data includes at least one of the following: vulnerability category, vulnerability risk level, vulnerability repair solution, and asset detection program associated with the target asset data.

[0066] The advantage of this setting is that by outputting vulnerability categories, vulnerability risk levels, vulnerability repair solutions, and associated asset detection programs, the convenience of the vulnerability repair process and the security of the computer system can be improved.

[0067] The technical solution provided by an embodiment of the present invention obtains script language code from an asset vulnerability dataset, analyzes the script language code using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data, cleans and normalizes the different types of asset vulnerability data, and then divides the processed asset vulnerability data into a first dataset, a second dataset, and a third dataset. The first, second, and third datasets are used to iteratively train a large language model, and the detection performance of the trained large language model is verified. If the detection performance of the trained large language model is successfully verified, the trained large language model is used as a vulnerability detection model, and the target asset data to be detected is input into the vulnerability detection model. The vulnerability detection model outputs a vulnerability detection result corresponding to the target asset data. This technical solution can achieve rapid identification of potential security risks in computer systems, reduce manual detection costs, and improve computer system security.

[0068] Figure 3 A schematic diagram of a security vulnerability detection device provided by an embodiment of the present invention is provided. The device is applied to electronic devices, such as Figure 3As shown, the device includes: a data set acquisition module 310, a model training module 320 and a model output module 330.

[0069] The data set acquisition module 310 is used to acquire an asset vulnerability data set and divide the asset vulnerability data set into a first data set, a second data set, and a third data set;

[0070] The first data set is used for zero-shot prompt learning of the large language model; the second data set includes prompt data and answer data, which are used for prompt reinforcement learning of the large language model; the third data set includes asset data and associated asset detection procedures;

[0071] A model training module 320 is configured to iteratively train a large language model using the first data set, the second data set, and the third data set, and then use the trained large language model as a vulnerability detection model;

[0072] The model output module 330 is used to input the target asset data to be detected into the vulnerability detection model, and output the vulnerability detection results corresponding to the target asset data through the vulnerability detection model.

[0073] The technical solution provided by the embodiment of the present invention obtains an asset vulnerability dataset, divides the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset, uses the first dataset, the second dataset, and the third dataset to iteratively train a large language model, and then uses the trained large language model as a vulnerability detection model. The target asset data to be detected is input into the vulnerability detection model, and the vulnerability detection result corresponding to the target asset data is output through the vulnerability detection model. This technical means provides a more efficient and accurate vulnerability detection method, which can overcome the limitations of a single vulnerability detection tool in the existing technology, realize rapid identification of potential security risks in computer systems, and predict unknown threats, thereby reducing manual detection costs and improving computer system security.

[0074] Based on the above embodiment, the large language model is constructed based on a sliding window attention mechanism; wherein the sliding window size and moving step size corresponding to the sliding window attention mechanism are pre-configured according to the vulnerability detection task;

[0075] The vulnerability detection result corresponding to the target asset data includes at least one of the following: vulnerability category, vulnerability risk level, vulnerability repair solution, and asset detection program associated with the target asset data.

[0076] The model training module 320 includes:

[0077] a model verification unit, configured to iteratively train a large language model using the first data set, the second data set, and the third data set, and verify the detection performance of the trained large language model; if the detection performance verification of the trained large language model is successful, using the trained large language model as a vulnerability detection model;

[0078] An output result correction unit is used to correct the output result of the large language model after training if the detection performance verification of the large language model fails, and generate a target training sample based on the corrected output result; and use the target training sample to retrain the large language model until the detection performance verification of the large language model is successful.

[0079] The data set acquisition module 310 includes:

[0080] a code analysis unit, configured to obtain script language codes from the asset vulnerability dataset, and analyze the script language codes using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data;

[0081] a data preprocessing unit, configured to clean and normalize the different types of asset vulnerability data, and then divide the processed asset vulnerability data into a first data set, a second data set, and a third data set;

[0082] A syntax tree generating unit, configured to perform syntax analysis on the scripting language code and generate an abstract syntax tree corresponding to the scripting language code according to the syntax analysis result;

[0083] The syntax tree analysis unit is used to analyze the abstract syntax tree corresponding to the script language code using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data.

[0084] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not fully described in the embodiments of the present invention, please refer to the methods provided by all the above embodiments of the present invention.

[0085] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0086] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0087] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0088] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the security vulnerability detection method.

[0089] In some embodiments, the security vulnerability detection method can be implemented as a computer program that is tangibly contained in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security vulnerability detection method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform the security vulnerability detection method in any other appropriate manner (for example, by means of firmware).

[0090] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0091] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0092] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0093] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0094] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0095] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0096] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0097] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A security vulnerability detection method, characterized in that: The method comprises: Acquire an asset vulnerability dataset, and divide the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset; The first data set is used for zero-shot prompt learning of the large language model; the second data set includes prompt data and answer data, which are used for prompt reinforcement learning of the large language model; the third data set includes asset data and associated asset detection procedures; Iteratively train the large language model using the first data set, the second data set, and the third data set, and then use the trained large language model as a vulnerability detection model; The target asset data to be detected is input into the vulnerability detection model, and the vulnerability detection result corresponding to the target asset data is output through the vulnerability detection model.

2. The method according to claim 1, characterized in that Using the first, second, and third datasets, iteratively training a large language model, and then using the trained large language model as a vulnerability detection model, including: Iteratively training a large language model using the first data set, the second data set, and the third data set, and verifying the detection performance of the trained large language model; If the detection performance of the trained large language model is successfully verified, the trained large language model will be used as the vulnerability detection model.

3. The method according to claim 2, characterized in that After verifying the detection performance of the trained large language model, it also includes: If the detection performance verification of the trained large language model fails, the output result of the large language model is corrected, and a target training sample is generated according to the corrected output result; The large language model is retrained using the target training samples until the detection performance of the large language model is successfully verified.

4. The method according to claim 1, wherein Obtaining an asset vulnerability dataset and dividing the asset vulnerability dataset into a first dataset, a second dataset, and a third dataset, including: Obtaining script language codes in the asset vulnerability dataset, and analyzing the script language codes using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data; The different types of asset vulnerability data are cleaned and normalized respectively, and then the processed asset vulnerability data are divided into a first data set, a second data set, and a third data set.

5. The method according to claim 4, characterized in that The script language code is analyzed using a gradient boosting decision tree algorithm to obtain different types of asset vulnerability data, including: Performing syntax analysis on the scripting language code, and generating an abstract syntax tree corresponding to the scripting language code according to the syntax analysis result; A gradient boosting decision tree algorithm is used to analyze the abstract syntax tree corresponding to the script language code to obtain different types of asset vulnerability data.

6. The method according to claim 1, characterized in that The large language model is constructed based on the sliding window attention mechanism; The sliding window size and moving step size corresponding to the sliding window attention mechanism are pre-configured according to the vulnerability detection task.

7. The method according to claim 1, characterized in that The vulnerability detection result corresponding to the target asset data includes at least one of the following: Vulnerability category, vulnerability risk level, vulnerability remediation plan, and asset detection procedures associated with target asset data.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the security vulnerability detection method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security vulnerability detection method according to any one of claims 1 to 7 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the security vulnerability detection method according to any one of claims 1 to 7.

Images