Detection tool generation method and device, medium and program product

Abstract

The embodiment of the invention provides a detection tool generation method and device, a medium and a program product, and the method comprises the steps: determining script information which comprises a target script and script operation information; detecting the target script in combination with the script running information to generate a script detection result; and analyzing the script detection result by adopting a target model to generate a corresponding script detection tool. Codes do not need to be written manually, and the efficiency of the script detection tool automatically generated through the model is higher.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method for generating a detection tool, an electronic device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the continuous development of cloud computing technology, cloud computing platforms are providing cloud computing services to more and more users. Users can access cloud computing platforms and use them to provide storage, computing and other services.

[0003] Cloud computing platforms offer various service scripts for users to use, and users can also upload their own scripts for easy access. However, these scripts may harbor unrecognized security risks, such as vulnerabilities and permission abuse. Running these scripts in a production environment could potentially lead to system crashes, data leaks, or malicious attacks.

[0004] Currently, script detection is often done by developers manually writing code to generate detection tools, which is inefficient. Summary of the Invention

[0005] An embodiment of the present application provides a method for generating a detection tool to improve the generation efficiency of the detection tool.

[0006] Accordingly, an embodiment of the present application also provides an electronic device, a computer-readable storage medium and a computer program product to ensure the implementation and application of the above system.

[0007] In order to solve the above problems, an embodiment of the present application discloses a method for generating a detection tool, wherein the method includes: determining script information, the script information including a target script and script execution information; detecting the target script in combination with the script execution information to generate a script detection result; using a target model to analyze the script detection result to generate a corresponding script detection tool.

[0008] Optionally, determining the target information includes: monitoring a script library to determine a script that meets the extraction rules as a target script; and running the target script to determine script running information of the target script.

[0009] Optionally, detecting the target script in combination with the script running information to generate a script detection result includes: detecting the target script using a first model in combination with the script running information to generate a script detection result.

[0010] Optionally, combining the script running information and using the first model to detect the target script to generate a script detection result includes: generating first input data based on the script running information and the target script, inputting the first input data into at least one first model for detection, and outputting at least one script detection result.

[0011] Optionally, generating the first input data based on the script running information and the target script includes: obtaining a first prompt word template for prompting the detection script; and assembling the target script, the script running information and the first prompt word template to generate the first input data.

[0012] Optionally, the first prompt word template includes: task prompt information, script variable parameters and operation variable parameters of the script detection task; assembling the target script, script operation information and the first prompt word template to generate the first input data includes: filling the target script into the script variable parameters, filling the script operation information into the operation variable parameters, and combining them with the task prompt information to generate the first input data.

[0013] Optionally, the step of inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: inputting the first input data into at least one first model; the first model performing at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; and generating at least one script detection result in a predetermined format.

[0014] Optionally, the target model is a second model, and the target model is used to analyze the script detection result to generate a corresponding script detection tool, including: obtaining a second prompt word template for prompting the generation of the script detection tool; generating second input data based on the second prompt word template and the script detection result; inputting the second input data into the second model for analysis, and outputting the corresponding script detection tool.

[0015] Optionally, the target model is the second model, and further includes: using a generated script detection tool to detect the target script and generate a corresponding tool detection result; using the second model to analyze the script detection result and generate a corresponding script detection tool, including: obtaining a third prompt word template for prompting analysis of differences, and generating third input data based on the third prompt word template, the script detection result and the tool detection result; inputting the third input data into the second model to analyze the differences and output the difference analysis results; obtaining a fourth prompt word template for prompting update of the script detection tool, and generating fourth input data based on the fourth prompt word template, the difference analysis results and the script detection tool; inputting the fourth input data into the second model to output update information of the generated script detection tool; and using the update information to update the generated script detection tool to obtain an updated script detection tool.

[0016] Optionally, the method further includes: generating a test case for the script detection tool based on the second model, so as to test the script detection tool based on the test case.

[0017] Optionally, the method further includes: analyzing the at least one script detection result, and screening the script detection result for generating a script detection tool.

[0018] Optionally, the analyzing of the at least one script detection result and screening of the script detection results for generating a script detection tool include: obtaining a fifth prompt word template for prompting the evaluation of different model processing results; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into the third model for screening processing, and outputting the screened script detection result.

[0019] An embodiment of the present application also discloses an electronic device, which includes: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method described in the embodiment of the present application.

[0020] An embodiment of the present application further discloses a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the embodiment of the present application.

[0021] An embodiment of the present application further discloses a computer program product, including a computer program / computer executable instructions, wherein the computer program / computer executable instructions, when executed by a processor in an electronic device, implement the method described in the embodiment of the present application.

[0022] Compared with the prior art, the embodiments of the present application have the following advantages: In an embodiment of the present application, a target script to be detected and its script execution information are obtained, and then, in combination with the script execution information, the target script is detected using a first model to generate a script detection result. Compared with using script static information to detect the script, the detection accuracy of the script execution is higher when combined with the context of the script execution. The second model is then used to analyze the script detection result to generate a corresponding script detection tool. There is no need to manually write code, and the script detection tool automatically generated by the model is more efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flowchart of the steps of an embodiment of a method for generating a detection tool of the present application; Figure 2 This is a flowchart of the steps of an optional embodiment of a method for generating a detection tool of the present application; Figure 3 is a flowchart of steps of an optional embodiment of a method for generating another detection tool of the present application; Figure 4 is a schematic diagram of a script detection architecture according to an embodiment of the present application; Figure 5 This is a flowchart of the steps of an embodiment of a method for updating a script detection tool of the present application; Figure 6 This is a flowchart of another embodiment of a method for updating a script detection tool of the present application; Figure 7 It is a structural diagram of a generating device of a detection tool of the present application; Figure 8 It is a structural diagram of an exemplary device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned purposes, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0025] The embodiment of the present application is applied to the script detection scenario, and can detect the script based on the model and generate a script detection tool based on the detection results. The script detection tool can also be updated and tested through the model. The model used can be a large model. Among them, a large model (Large Model) refers to a machine learning model with a large number of parameters and a complex structure, which can process massive amounts of data and complete various complex tasks, such as natural language processing, computer vision processing, speech recognition, code writing, code detection and other tasks. The large model can be a large language model (LLM), a language model based on the transformer architecture, and other models. The large model can also be various large language models trained by different software service providers based on the LLM model.

[0026] The large model can be combined with prompt engineering to perform processing. Prompt engineering is a method that guides the model to output the desired result by designing input prompts. Prompt engineering is a technology that guides the large language model to generate more accurate and demand-compliant outputs by designing and optimizing the structure, content, and context of input prompts. That is, by designing and optimizing input prompts, the large model is guided to generate more accurate answers, similar to equipping the large model with a "human language translator." Therefore, a prompt template can be set and combined with corresponding information to form input data, thereby guiding the model to output the corresponding result. In the embodiment of the present application, different prompt templates can be set for different tasks, thereby prompting the large model to perform corresponding task processing. In the embodiment of the present application, the tasks required to be performed by the large model include at least one of the following: script detection tasks, script detection tool generation tasks, script detection tool update tasks, analysis tasks for differences between different script detection results, and evaluation tasks for different model processing results. Accordingly, the prompt word template includes at least one of the following: a first prompt word template for prompting the detection script, a second prompt word template for prompting the generation of a script detection tool, a third prompt word template for prompting the analysis of differences, a fourth prompt word template for prompting the update of the script detection tool, and a fifth prompt word template for prompting the evaluation of different model processing results. The generated script detection tool also needs to be tested. Therefore, the tasks of the large model also include the testing task of the script detection tool and the generation task of test cases for the script detection tool, and prompt word templates can be set accordingly. In addition, test cases can be generated together with the script detection tool, for example, test cases can be generated in the script detection tool generation and update tasks.

[0027] In the following embodiments, the model and prompt word template are combined to perform script detection, and the corresponding script testing tool is generated and updated based on the script detection results, so as to realize automatic generation and adaptive optimization of the script testing tool and improve processing efficiency and accuracy.

[0028] Reference Figure 1 , shows a step flow chart of an embodiment of a method for generating a detection tool of the present application.

[0029] Step 102: Determine script information, where the script information includes a target script and script execution information.

[0030] Monitor scripts in the platform, for example, by determining script information based on the platform's database, script library, and script-related directories. The script information includes the target script and script execution information. The target script is the script to be detected, and the script execution information is information about the script during execution, such as the context of the execution environment.

[0031] In an optional embodiment, the target information is determined, including: monitoring the script library to determine the script that meets the extraction rules as the target script; running the target script to determine the script running information of the target script. The script library of the platform is monitored, and the script library can be understood as a storage unit such as a database for storing scripts. The script library can be monitored, for example, the script directory of the script library is monitored, and the newly added script is determined to be the target script through the script directory. In one example, the script directory can be monitored, and when the newly added file is determined to be a script through the file name, file extension, etc. of the newly added file in the directory, the script is used as the target script. Among them, the file extension is used to indicate the format of the file, such as the extension of the Python script is usually ".py", and the extension of the Shell script is ".sh". The file belonging to the script can be determined by the extension.

[0032] In an embodiment of the present application, unique identification information such as the hash value of the collected scripts can also be recorded. Therefore, when a new script is detected, the hash value of the script is obtained and compared with the recorded hash value to determine whether it is the hash value of the recorded script. If it is already recorded, the script can be ignored. If it is not recorded, the script can be obtained as the target script. The script hash value list can be updated in an incremental manner.

[0033] After determining the target script to be detected, the script execution information of the target script can be obtained. The script execution information refers to the context information when the script is executed. The script execution information can be obtained by running the target script. If the script execution information of the target script is already stored, it can also be directly obtained.

[0034] In one embodiment, when a new script is detected, the script is run to obtain a contextual running environment. Table 1 below is an example of script running information:

[0035] Table 1 This enables the script to be analyzed in conjunction with the contextual operating environment.

[0036] Step 104: Detect the target script in combination with the script execution information to generate a script detection result.

[0037] In an embodiment of the present application, the target script can be detected based on the script running information. There can be multiple methods for detecting the script, such as detecting the script based on an algorithm model to generate a script detection result, or detecting the target script separately based on multiple detection tools to generate multiple script detection results. This detection tool is used to detect different dimensions of the target script, such as separately detecting function behavior security, permission security, data security, etc., and detecting results from multiple dimensions so that a script detection tool can be generated by subsequently integrating various dimensions to detect different dimensions of the script.

[0038] In an optional embodiment, the target script is detected in combination with the script running information to generate a script detection result, including: detecting the target script using the first model in combination with the script running information to generate a script detection result. The script running information and the target script can be input into the first model for detection to generate a corresponding script detection result. For example, one or more LLM models are selected as the first model, and the target script is detected by the first model, such as for detecting the security of the script, to generate a corresponding script detection result. For the LLM model, a prompt word project can also be combined to set a prompt word template to assist in detection.

[0039] In an optional embodiment, the method of combining the script execution information, detecting the target script using a first model, and generating a script detection result includes: generating first input data based on the script execution information and the target script, inputting the first input data into at least one first model for detection, and outputting at least one script detection result. The first input data can be generated based on the target script and the script execution information, inputting the first input data into at least one first model for analysis and processing, and outputting a corresponding script detection result, thereby obtaining at least one script detection result. The model can automatically detect scripts, improving script detection efficiency, and combining the execution information during the script detection process can improve the accuracy of script detection.

[0040] In an embodiment of the present application, generating first input data based on the script execution information and the target script includes: obtaining a first prompt word template; and assembling the target script, the script execution information, and the first prompt word template to generate the first input data. The first prompt word template is pre-generated based on a script detection task, and the target script, the script execution information, and the first prompt word template are assembled to generate the first input data.

[0041] Wherein, the first prompt word template includes: task prompt information of the script detection task, script variable parameters and parameter variable parameters; the task prompt information is used to prompt the task objectives and task requirements of the script detection task that the first model needs to perform, for example, the task objective is to detect the security of the script, and the task requirements include the format requirements of the output data of the security project that needs to be detected. In one example, the task prompt information can prompt various tasks such as the operations that need to be performed, the required variable parameters and the format of the output data. The variable parameters are variable parameters in the first prompt word template, the script variable parameters are used to determine the script that needs to be detected, and the parameter variable parameters are used to determine the script running parameters of the script. The assembling of the target script, the script running information and the first prompt word template to generate the first input data includes: filling the target script into the script variable parameters, filling the script running information into the parameter variable parameters, and combining them with the task prompt information to generate the first input data.

[0042] In one example, the script types of the target script to be detected include Python script and Shell script. Python is an interpreted scripting language, and Shell is a scripting language. An example of a first prompt word template is: py_script_permission_prompt = """You are a security expert proficient in Python and Shell. Your task is to analyze the security of scripts. Please analyze the script according to the following requirements: - Issues related to permissions that require checking include the following categories. You can add more categories based on your experience: 1. … 2. … … - Output follows the specified JSON (JavaScript Object Notation) format - Please do not output redundant information, only output the results in JSON format **Notice**: - Only analyze the given script content, and return empty if there is no problem - The output format is as follows (must match exactly): ```json {{ "permission_checker": [ {{ "line_number": "<line number>", "danger_type": "<danger type, e.g. Accessing Sensitive Directories>", "danger_detail": "<dangerous behavior details, such as cd / root / benchmarksql / run>”, }} ], }} ``` The following is the specific content of the Python script: {python_script_code} The following is the context of the python script {python_script_context} """ The task prompt information of the above-mentioned first prompt word template includes: task objectives, task content, variable parameter positions, output format, output content and other information. Among them, the task objective is used to prompt the detection task that the model needs to perform, and the task content is used to prompt the specific content of the word template detection task, including detection categories, projects, etc. The variable parameter position is used to indicate the position and type of the variable parameters that need to be filled in the template, and the corresponding variable parameter values ​​can be filled based on the variable parameter position. The output format is used to indicate the format of the model output data, such as JSON format, etc. The output content is used to indicate the specific content in the template output data, such as the results corresponding to the detected items, including the output item type and location, etc.

[0043] In one example, script detection includes performing security checks on the script to ensure the security of the called script. Therefore, inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: inputting the first input data into at least one first model; the first model performing at least one of the following security checks based on the input data: function behavior security check, permission security check, data security check, dependency security check, and network behavior security check; and generating at least one script detection result in a predetermined format.

[0044] The first input data is input into a first model. The first model, based on the prompts of the first input data and combined with script execution information, performs at least one of the following security checks on the target script: function behavior security check, permission security check, data security check, dependency security check, and network behavior security check. Corresponding test results are obtained for each security check item, and the results are combined to obtain script test results in a predetermined format, such as JSON format or YAML (Yet Another Markup Language) format. Function behavior security check is used to check the behavior security of functions in the script, for example, whether the function performs undefined behavior and whether the calling and accessing of corresponding data by the function is safe. Permission security check is used to check the security of the script's call of permissions, for example, whether the permissions the script calls are necessary and whether there is any abuse of permissions. Data security check is used to check the security of the script's corresponding data, for example, whether the data called by the script is safe. Dependency security check is used to check the security of the script's corresponding dependencies, for example, whether the dependencies between functions in the script are safe and the dependencies of the script's called data are safe. Network behavior security testing is used to detect the security of the network behavior corresponding to the script, such as whether the network behavior called by the script's corresponding interface, data, service, etc. is safe. The above security testing items can be adjusted based on demand, such as expanding new security testing items or modifying existing security testing items. Therefore, the first prompt word template can be adjusted based on the detection item adjustment information. This detection item adjustment information is used to determine the adjusted detection item. Based on the adjusted detection item, the task prompt in the first prompt word template can be adjusted, such as adjusting the task content.

[0045] Thus, the first input data is input into each first model, and the script detection results output by each first model can be obtained. In the embodiment of the present application, since there are certain differences between different first models, the script detection results after the script analysis by different first models are also different. Therefore, multiple first models can be used to analyze the target script respectively, and then the script detection results of each first model are detected to screen the required script detection results. That is, the at least one script detection result is analyzed to screen the script detection results used to generate the script detection tool. In one example, each script detection result can be analyzed by scoring or other methods to screen the required script detection results.

[0046] In some other optional embodiments, the analysis of the at least one script detection result and the screening of the script detection results for generating the script detection tool include: obtaining a fifth prompt word template; generating fifth input data based on the fifth prompt word template and at least one script detection result; inputting the fifth input data into the third model for screening processing, and outputting the screened script detection result. The script detection results can be screened by a large language model, and a fifth prompt word template can be pre-constructed. The fifth prompt word template is used to prompt the task of screening the script detection results. The fifth prompt script includes a prompt task and variable parameters. The prompt task is used to prompt the task of screening the script detection results, including the content of the screening, the screening conditions, etc. The variable parameters correspond to each script detection result. Based on the fifth prompt word template and each script detection result, a fifth input data is generated, and the fifth input data is input into the third model to screen each script detection result, and the screened script detection result is output.

[0047] In an optional embodiment, the screening content includes at least one of the following verification items: syntax verification, context verification, and consistency verification. The screening conditions may be passing each verification item, or the number of verification items passed, etc. Among them, language verification is used to verify the format legitimacy of the script detection results, such as verifying the format legitimacy through JSON Schema, and context verification is used to verify whether the dangerous items in the script detection results are consistent with the operating environment, such as whether the dangerous items in the script detection results are consistent with the operating environment, and the operating system will not mark root access. Consistency verification is used to cross-validate the script detection results output by different first models.

[0048] In the embodiment of the present application, the first model and the fifth model may be the same large model or different large models, and the script detection results are screened by the large model.

[0049] Step 106: Analyze the script detection result using the target model to generate a corresponding script detection tool.

[0050] After obtaining the script detection result, a target model such as a large model can be used to analyze the script detection result to generate a script detection tool. The target model is a model that can generate a script detection tool.

[0051] Among them, the script detection tool is a tool for detecting scripts. The items detected by the tool can be determined based on the needs, such as detecting the safety box of the script, detecting the functions of the script, etc. The script detection tool can be in the form of an SDK (Software Development Kit). SDK is a collection of tools provided to developers, usually including library files, API (Application Programming Interface) interfaces and sample codes, for quickly building software or applications with specific functions. In the embodiment of the present application, the script detection tool can be in the form of an SDK, and an example is a packaged toolkit with script security detection capabilities.

[0052] In an optional embodiment, the use of a second model to analyze the script detection result and generate a corresponding script detection tool includes: obtaining a second prompt word template; generating second input data based on the second prompt word template and the script detection result; inputting the second input data into the second model for analysis, and outputting the corresponding script detection tool. A second prompt word template can be pre-constructed, and the second prompt word template is used to prompt the task of generating the script detection tool. The second prompt script includes a task prompt and variable parameters. The task prompt is used to prompt the task of generating the script detection tool to correspond to the required operation, such as prompting the generation of the corresponding script detection tool based on the script detection result. The items that the script detection tool needs to detect can be determined based on the detection items in the script detection result, as well as the output results corresponding to each detection item and its format requirements, etc. The variable parameters are used to fill in variable parameters, such as filling in the script detection result.

[0053] The script detection result is filled into the variable parameter of the second prompt word template to generate the second input data, and then the second input data is input into the second model for processing. The second input data is processed by the second model, and based on the prompt in the second data input, it is determined that a script detection tool needs to be generated. Based on the script detection result in the second input data, the items that need to be detected in the script are determined, and the detection items include at least one of the following: function behavior security detection, permission security detection, data security detection, dependency security detection, network behavior security detection, etc. The output requirements of the script detection tool, such as output content, output format, etc., can also be determined based on the script detection result. Thus, the script detection tool is generated and output. The second model can be combined with the prompt word template to execute the generation processing of the script detection tool. The prompt word template can prompt the processing required to be performed by the second model, thereby improving the generation efficiency and accuracy of the script detection tool.

[0054] In the embodiment of the present application, the first model and the second model can be the same model or different models. For example, the second model is a model with good code compilation capability, etc. The embodiment of the present application does not limit this.

[0055] In summary, the target script to be detected and its script running information are obtained, and then combined with the script running information, the target script is detected using the first model to generate a script detection result. Compared with using the static information of the script to detect the script, the detection accuracy of the script execution is higher when combined with the context of the script running. The second model is then used to analyze the script detection results and generate the corresponding script detection tool. There is no need to manually write code, and the script detection tool automatically generated by the model is more efficient.

[0056] Based on the above embodiments, the embodiments of the present application also provide a method for generating a detection tool, which can combine multiple first models to detect the target script, screen better script detection results to generate a script detection tool, and improve the accuracy of the script detection tool.

[0057] Reference Figure 2 , showing a step flow chart of an optional embodiment of a method for generating a detection tool of the present application.

[0058] Step 202: monitor the script library and determine the script that meets the extraction rules as the target script.

[0059] Step 204: Run the target script to determine script running information of the target script.

[0060] Step 206: Obtain a first prompt word template.

[0061] Step 208: Assemble the target script, script execution information, and the first prompt word template to generate first input data.

[0062] The target script is filled into the script variable parameter, the script running information is filled into the running variable parameter, and the two are combined with the task prompt information to generate the first input data.

[0063] Step 210: input the first input data into at least one first model.

[0064] Step 212: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0065] Step 214: Generate at least one script detection result in a predetermined format.

[0066] Step 216: Analyze the at least one script detection result and filter the script detection result for generating a script detection tool.

[0067] Among them, a fifth prompt word template is obtained; based on the fifth prompt word template and at least one script detection result, fifth input data is generated; the fifth input data is input into the third model for screening processing, and the screened script detection result is output.

[0068] Step 218: Obtain a second prompt word template.

[0069] Step 220: Generate second input data based on the second prompt word template and the script detection result.

[0070] Step 222: Input the second input data into the second model for analysis, and output a corresponding script detection tool.

[0071] In this way, multiple first models can be used to detect scripts, and then the script detection results of each model can be comprehensively evaluated to screen the script detection results that meet the requirements. Based on the screened script detection results and the second model, a script detection tool can be generated, thereby automatically generating a script detection tool and improving processing efficiency.

[0072] After the script detection tool is generated, it is usually necessary to test the script detection tool to test the security, stability, accuracy, etc. of the script detection tool. In an embodiment of the present application, a test case for the script detection tool can also be automatically generated by the model. The test case can be generated together when the script detection tool is generated, or generated separately. The embodiment of the present application does not limit this. In an optional embodiment of the present application, a test case for the script detection tool is generated based on the second model so that the script detection tool is tested based on the test case.

[0073] In one embodiment, prompt information for generating a script test case can be added to the second prompt word template, so that the task prompt of the second prompt word template includes prompt information for generating a script test tool and prompt information for generating a script test case. After generating second input data based on the script detection results and the second prompt word template, the second model can process the second input data to generate a script detection tool and a test case, thereby testing the script detection tool using the test case.

[0074] In another embodiment, a separate prompt word template, referred to as a sixth prompt word template, can be created for generating test cases. This sixth prompt word template is used to prompt test cases generated by the script detection tool. Sixth input data is generated based on the sixth prompt template and the script detection tool. The sixth input data is input into the second model for processing, and a test case corresponding to the script detection tool is output.

[0075] The script detection tool can be tested based on the test cases generated by the model, and can be used to detect scripts after the script detection tool passes the test.

[0076] Based on the above embodiments, the embodiments of the present application also provide a method for generating a detection tool, which can combine multiple first models to detect the target script, screen better script detection results to generate a script detection tool, and improve the accuracy of the script detection tool.

[0077] Reference Figure 3 , showing a step flow chart of an optional embodiment of a method for generating another detection tool of the present application.

[0078] Step 302: monitor the script library and determine the script that meets the extraction rules as the target script.

[0079] Step 304: Run the target script to determine script running information of the target script.

[0080] Step 306: Obtain a first prompt word template.

[0081] Step 308: Assemble the target script, script execution information, and the first prompt word template to generate first input data.

[0082] The target script is filled into the script variable parameter, the script running information is filled into the running variable parameter, and the two are combined with the task prompt information to generate the first input data.

[0083] Step 310: Input the first input data into at least one first model.

[0084] Step 312: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0085] Step 314: Generate at least one script detection result in a predetermined format.

[0086] Step 316: Analyze the at least one script detection result and filter the script detection result for generating a script detection tool.

[0087] Among them, a fifth prompt word template is obtained; based on the fifth prompt word template and at least one script detection result, fifth input data is generated; the fifth input data is input into the third model for screening processing, and the screened script detection result is output.

[0088] Step 318: Obtain a second prompt word template.

[0089] Step 320: Generate second input data based on the second prompt word template and the script detection result.

[0090] Step 322: Input the second input data into the second model for analysis, and output the corresponding script detection tool and test case.

[0091] Step 324: Use the test case to test the script detection tool.

[0092] In the embodiment of the present application, taking the application to the cloud computing platform as an example, there are self-developed components in the cloud computing platform, which can be Python scripts and / or Shell scripts. These components can provide the required services for users using the cloud computing platform. The cloud computing platform can implement the script for security detection of self-developed components through the following modules, such as Figure 4 As shown: Monitoring and data collection module 401, security enhancement analysis module 403, code generation module 405, management module 407. Among them: The monitoring and data collection module 401 is used to collect script execution information such as newly added Python scripts / Shell scripts and the script's contextual execution environment from the self-developed components. The module uses the script directory of the self-developed component as input, monitors the script directory to identify newly added Python scripts and / or newly added Shell scripts, and obtains script execution information during the script's execution, such as operating system data, permission data, and network exposure level.

[0093] Security Enhancement Analysis Module 403 uses the LLM model to perform various specialized checks and security risk analyses on newly added Python / Shell scripts, generating structured inspection results, namely script detection results, to guide the generation and iterative update of script detection tools. Specifically, these specialized checks and security risk analyses include at least one of the following: function behavior security, permission security, data security, dependency security, and network behavior security. These checks can be expanded as needed, but are not limited in this embodiment.

[0094] Among them, the large language model is used as an "expert annotator" to generate a high-precision structured inspection report to guide the generation and update of script detection tools. The script and script running information obtained by the monitoring and data collection module 401 are used as input, and combined with the prompt word template corresponding to the prompt word project, a structured script detection result can be generated. In an optional embodiment, the screening content includes at least one of the following verification items: syntax verification, context verification and consistency verification. The screening conditions can be passing each verification item, or the number of passed verification items. Among them, language verification is used to verify the format and discovery of the script detection results, such as verifying the format legitimacy through JSON Schema, and context verification is used to verify whether the dangerous items in the script detection results are consistent with the operating environment, such as whether the dangerous items in the script detection results are consistent with the operating environment, and the operating system will not mark root access. Consistency verification is used to cross-validate the script detection results output by different first models.

[0095] Code generation module 405 is used to generate a script detection tool and update the script detection tool's code (including test code) based on the script detection results generated by the LLM model, achieving detection results substantially equivalent to those of the LLM model. Code generation module 405 converts the script detection results from security enhancement analysis module 403 into executable SDK code for the script detection tool, generates code for corresponding test cases, and can also execute tests.

[0096] For the script detection tool's code, the executable SDK code, updated patch code, etc. can be determined based on the script detection results and prompt word templates. Test cases can also be generated and executed to verify whether the script detection tool's code can pass the test and determine the corresponding logs, such as whether the code is wrong and whether the performance meets the requirements.

[0097] Test cases for script detection tools can be constructed using a hybrid testing framework, including unit testing, fuzz testing, and real-world testing. Unit testing is used to verify the logic of each detection item in the script detection tool, fuzz testing is used to stress-test the script detection tool, and real-world testing is used to execute tests based on a test set of self-developed components. Testing can also be performed by setting quality control thresholds, such as unit test coverage ≥ 90% and performance degradation ≤ 10%.

[0098] The management module 407 is used to manage the version iteration of the script detection tool, support release, rollback and version tracking, etc. For the script detection tool that passes the test, information such as the script detection tool and the corresponding version number can be recorded, and the version release record can be determined.

[0099] This enables real-time analysis of new scripts using a large language model, generating a structured script detection tool and converting it into executable SDK code, enabling automatic rule iteration. This improves rule update efficiency, shortens the update cycle, and enables rapid response to new threats such as malicious script variants.

[0100] By combining runtime feedback from proprietary components, such as script execution results and environmental context, rule weights are dynamically adjusted, allowing rules to evolve in sync with actual scenarios and optimizing scripting tools driven by runtime data. This enhances threat detection coverage, allowing the model to identify unseen permission-abusing scripts and incorporate them into the rule base, reducing the risk of missed reports.

[0101] The model's script detection results undergo multiple validations, including semantic and contextual consistency checks and multi-model cross-validation, to improve accuracy and ensure they are consistent with real-world scenarios. The script detection tool performs tests during the build and update process, feeding back test failures (such as false positives and false negatives) to the model, triggering automatic iterative optimization. This improves functional consistency, ensuring high consistency between the detection capabilities of the script detection tool and the model, and correcting for discrepancies through backward validation such as testing.

[0102] The above process automates the entire process, from monitoring script update events, analyzing and detecting scripts using a large model, to code generation, updating, automated testing, and version management, achieving end-to-end automation. This significantly improves iteration efficiency, enhancing the efficiency of script detection tools.

[0103] On the basis of the above embodiments, the embodiments of the present application further provide a method for updating a script detection tool. When a script detection tool has been generated, the script detection tool can be automatically updated through a model.

[0104] Based on the generated script detection tool, when the target script is detected, the first model and the generated script detection tool can be used to detect the target script respectively. The generated script detection tool is used to detect the target script and generate a corresponding tool detection result.

[0105] The generated script detection tool can be updated using the second model. By combining the differences between the script detection results output by the first model and the tool detection results output by the script detection tool, possible problems with the script detection tool can be analyzed, and the script detection tool can be updated.

[0106] In some other optional embodiments, when adding or modifying script detection rules or detection methods, the first prompt template can be adjusted accordingly, thereby updating the script detection results accordingly. By comparing the script detection results of the model detection with the tool detection results of the script detection tool, it can be determined whether the generated script detection tool is missing or has not been updated, and the generated script detection tool can be updated accordingly.

[0107] In an optional embodiment, the target model is the second model, and the target model is used to analyze the script detection result to generate a corresponding script detection tool, including: obtaining a third prompt word template for prompting analysis of differences, and generating third input data based on the third prompt word template, the script detection result and the tool detection result; inputting the third input data into the second model to analyze the differences and output the difference analysis results; obtaining a fourth prompt word template for prompting update of the script detection tool, and generating fourth input data based on the fourth prompt word template, the difference analysis results and the generated script detection tool; inputting the fourth input data into the second model to output update information of the script detection tool; and using the update information to update the generated script detection tool to obtain an updated script detection tool.

[0108] The first model and the script detection tool can be used to detect the target script in combination with the script running information to obtain the corresponding script detection results and tool detection results. The script detection results and the tool detection results are then combined with the third prompt word template to generate the corresponding third input data. The third prompt word template includes: task prompt information and variable parameters of the difference detection task, the task prompt information includes the task objectives and task requirements of the difference analysis task to be performed by the prompt model, for example, the task objective is to analyze the difference between the two script results, and the task requirements include specific items that need to be analyzed, which are related to the script detection items, and optimization suggestions can be analyzed for the analyzed differences, etc. The task requirements also include the output format of the output data, such as the difference items, difference content and data format that need to be output. The variable parameters include: model output parameters and tool output parameters, wherein the model output parameters are used to fill in the script detection results output by the model, and the tool output parameters are used to fill in the tool detection results output by the script detection tool.

[0109] An example of a third prompt word template is as follows: diff_prompt = """ You are a security expert proficient in Python and Shell. Your task is to analyze the security of scripts. We use two tools: 1. **Model** (security analysis of scripts based on models) 2. **Script Detection for Sharing Weal and Woe** (not based on large models, but on static analysis of code for security analysis) Security analysis was performed on the same Python or Shell script, and different detection results were output. Both of these detection results were from the perspective of 5 detectors (function_checker, permission_checker, data_checker, dependency_checker, network_checker) for security analysis --- Task Requirements 1. **Comparative Analysis**: Identify the dangerous items detected by the model but not by the script detection tool 2. **Optimization Suggestions**: If there are differences, it is necessary to clearly state **what the expected situation of the script detection tool should be**, including: - Which checker type (`function_checker`, `permission_checker`, etc.) - Which section of the code to check and what the expected inspection result should be 3. **Output Format Requirements**: - Strictly follow the following JSON format - Do not output any extra information, only output the JSON result - If there are no differences, the `diff` is an empty list --- Output Format (Strict Match): ```json {{ "diff": {{ "checker_type": "<checker type>", "llm_report": "<Dangerous behaviors reported by the LLM, showing the specific sub-items of this checker>", "sdk_report": "<Dangerous behaviors reported by the SDK, showing the specific sub-items of this checker>", "diff_analysis": "<Difference analysis, divided into two categories: 1. No differences 2. There are differences, describe the type of differences>", "action": "Whether to update the SDK, if yes, please describe: - Which checker to modify - Which code is to be checked and what kind of check results are expected? }} ], }} Thus, the differences between different detection results are detected through the third prompt word template.

[0110] The script detection results are entered into the model output parameters of the third prompt word template, and the tool detection results are entered into the tool output parameters of the third prompt word template, thereby generating third input data. The third input data is then input into the second model for analysis and processing. The second model can use the script detection results as a benchmark to detect differences between the two different detection results, such as whether a certain danger prompt item is detected in the script detection results but not in the tool detection results. Based on the differences, the reasons for the differences can be analyzed and improvement suggestions can be made, such as whether the difference is caused by the detection method or the lack of corresponding detection rules. This generates a difference analysis result.

[0111] The difference analysis results are then combined with a fourth prompt word template to generate corresponding fourth input data. The fourth prompt word template includes task prompt information and variable parameters for the difference detection task. The task prompt information indicates the task objective and requirements of the difference detection task to be performed by the model. For example, the task objective is to detect differences between different test results, while the task requirements include analyzing the differences between the results and the content of the differences, as well as output format requirements. The variable parameters are used to populate parameters such as the difference analysis results and the code of the script detection tool.

[0112] An example of a fourth prompt word template is as follows: code_generate_prompt = """ You are a security expert proficient in Python and Shell. Your task is to generate a code patch for the security SDK based on the difference (diff) analysis results (analyze {file}) between this detection result and the tool detection result. Enables Security SDK to analyze {file} to achieve the same effect as LLM analysis --- ###Script detection tool related code: {sdk_content} ### Input Requirements Please generate patch code and test cases for the script detection tool based on the diff analysis results input in the following JSON format: {diff_result} Please carefully read and understand the existing code logic of the script detection tool, and then generate the patch code Output requirements 1. Generate patch code: Please make sure to understand the existing code logic of the script detection tool and add patches to the existing code logic. Clearly mark the modification path (such as security_analyzer / checkers / function_checker / XX.py) Use + to indicate adding new code Use - to delete code if necessary Output format Diff analysis results (output complete {diff_result}) Code patches (output only in diff format) """ Thus, fourth input data can be generated based on the fourth prompt word template and the code of the script detection tool, the difference analysis result, etc.

[0113] The fourth input data is input into the second model for analysis. Based on the difference result analysis, the content that needs to be updated in the script detection tool can be determined, and the update needs to follow the code logic of the script detection tool itself. A patch code is generated based on the code logic, and the patch code is output as update information for the script detection tool. The generated script detection tool is then updated using the code patch and other update information to obtain an updated script detection tool. Based on the generated script detection tool, the generated script detection tool and the second model are used to respectively detect the same script, analyze the difference between the two detection results, and obtain update information such as the patch code of the generated script detection tool, thereby quickly updating the generated script detection tool.

[0114] Based on the above embodiment, the present application embodiment also provides a method for updating a script detection tool, such as Figure 5 As shown: Step 502: monitor the script library and determine the script that meets the extraction rules as the target script.

[0115] Step 504: Run the target script to determine script running information of the target script.

[0116] Step 506: Obtain a first prompt word template for prompting the detection script.

[0117] Step 508: Assemble the target script, script execution information, and the first prompt word template to generate first input data.

[0118] The target script is filled into the script variable parameter, the script running information is filled into the running variable parameter, and they are combined with the task prompt to generate the first input data.

[0119] Step 510: Input the first input data into at least one first model.

[0120] Step 512: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0121] Step 514: Generate at least one script detection result in a predetermined format.

[0122] Step 516: Obtain a fifth prompt word template for prompting evaluation of processing results of different models, and generate fifth input data based on the fifth prompt word template and at least one script detection result.

[0123] Step 518: Input the fifth input data into the third model for screening, and output the screened script detection result.

[0124] Step 520: Use the generated script detection tool to detect the target script and generate a corresponding tool detection result.

[0125] Step 522: Obtain a third prompt word template for prompting analysis differences, and generate third input data based on the third prompt word template, the script detection result, and the tool detection result.

[0126] Step 524: Input the third input data into the second model to analyze the difference, and output the difference analysis result.

[0127] Step 526 : Obtain a fourth prompt word template for prompting the script detection tool to update, and generate fourth input data based on the fourth prompt word template, the difference analysis result, and the script detection tool.

[0128] Step 528: Input the fourth input data into the second model.

[0129] Step 530 : Analyze the fourth input data using the second model to determine the generated patch code of the script testing tool, and output the patch code as update information of the script testing tool.

[0130] Step 532: Use the update information to update the generated script detection tool to obtain an updated script detection tool.

[0131] In an optional embodiment, the script detection tool can be updated, test cases generated, and corresponding test results determined using the same model, thereby enabling the testing of the updated script detection tool to be completed simultaneously with the update, which is more efficient.

[0132] Therefore, prompts for generating test cases and executing tests can be set in the fourth prompt template. Based on this fourth prompt template, test cases can be generated, executed, and the test results determined based on the updated script testing tool. Accordingly, the task objectives of the fourth prompt template include generating test cases and executing tests using test cases. Correspondingly, test case mapping rules and the test commands required for executing the test can be set.

[0133] In one example, a prompt template that can generate update information (such as patch code), test cases, and determine test results for a script testing tool is as follows: code_generate_prompt = """ You are a security expert proficient in Python and Shell. Your task is to generate a code patch for the security SDK based on the difference (diff) analysis results (analyze {file}) between this detection result and the tool detection result. Enables Security SDK to analyze {file} to achieve the same effect as LLM analysis --- ###Script detection tool related code: {sdk_content} ### Input Requirements Please generate patch code and test cases for the script detection tool based on the diff analysis results input in the following JSON format: {diff_result} Please carefully read and understand the existing code logic of the script detection tool, and then generate the patch code Output requirements 1. Generate patch code: Please make sure to understand the existing code logic of the script detection tool and add patches to the existing code logic. Clearly mark the modification path (such as security_analyzer / checkers / function_checker / XX.py) Use + to indicate adding new code Use - to delete code if necessary 2. Generate unit test cases Test file mapping rules: function_checker → tests / test_func_checker.py permission_checker → tests / test_permission_checker.py data_checker → tests / test_data_checker.py dependency_checker → tests / test_dependency_checker.py network_checker → tests / test_network_checker.py Test case requirements (if necessary): Using the pytest framework Covering the following scenarios: Positive match: scripts containing dangerous functions / patterns Reverse matching: scripts that do not contain dangerous functions / patterns Edge cases: Dangerous functions appear on multiple lines, in comments, or in string concatenation. 3. Verify test results Run the command cd / Users / yanrong / Documents / develop / X-Sec / sdk-agent / source .venv / bin / activate pytest sdk_output / security_analyzer / tests Failure handling: If a test case fails, please: Checks whether a regular expression matches an expected pattern Verify that the patch is applied correctly Adjust test cases or patch code Output format Diff analysis results (output complete {diff_result}) Code patches (output only in diff format) Test cases (only Python test code is output) Verify test results (output test results only) """ Thus, the fourth input data can be generated based on the fourth prompt word template and the code of the script detection tool, the difference analysis result, etc.

[0134] The fourth input data is input into the second model for analysis. Based on the difference result analysis, the content that needs to be updated in the script detection tool can be determined, and the update needs to follow the code logic of the script detection tool itself. Based on the code logic, a patch code is generated, and the patch code is used as the update information of the script detection tool. In addition, a test case for the script testing tool and the patch code can be generated, and a test command is executed. The script testing tool and the patch code are tested using the test case to determine the corresponding test results. If the test case fails, the reason for the failure of the test case can be checked and the test case can be adjusted until the test is successful. The code patch, test case, and verification test result can be used as the update information of the script testing tool.

[0135] Based on the above embodiment, the present application embodiment also provides a method for updating a script detection tool, such as Figure 6 As shown: Step 602: monitor the script library and determine the script that meets the extraction rules as the target script.

[0136] Step 604: Run the target script to determine script running information of the target script.

[0137] Step 606: Obtain a first prompt word template for prompting the detection script.

[0138] Step 608: Assemble the target script, script execution information, and the first prompt word template to generate first input data.

[0139] The target script is filled into the script variable parameter, the script running information is filled into the running variable parameter, and they are combined with the task prompt to generate the first input data.

[0140] Step 610: Input the first input data into at least one first model.

[0141] Step 612: The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection.

[0142] Step 614: Generate at least one script detection result in a predetermined format.

[0143] Step 616: Obtain a fifth prompt word template for prompting evaluation of different model processing results, and generate fifth input data based on the fifth prompt word template and at least one script detection result.

[0144] Step 618: Input the fifth input data into the third model for screening and output the screened script detection result.

[0145] Step 620: Use the generated script detection tool to detect the target script and generate a corresponding tool detection result.

[0146] Step 622: Obtain a third prompt word template for prompting analysis differences, and generate third input data based on the third prompt word template, the script detection result, and the tool detection result.

[0147] Step 624: Input the third input data into the second model to analyze the difference, and output the difference analysis result.

[0148] Step 626: Obtain a fourth prompt word template for prompting the script detection tool to update, and generate fourth input data based on the fourth prompt word template, the difference analysis result, and the script detection tool.

[0149] Step 628: Input the fourth input data into the second model.

[0150] Step 630: Analyze the fourth input data through the second model to determine the patch code and test cases of the script test tool, and perform tests on the script test tool and the patch code based on the test cases to determine the test results.

[0151] Step 632: Output the patch code, test case, and test result as update information of the generated script detection tool.

[0152] Step 634: Use the update information to update the generated script detection tool to obtain an updated script detection tool.

[0153] This enables updating and testing of the script detection tool. In the embodiments of the present application, after the script detection tool passes the test, the script detection tool can be released so that the script detection tool can be used to detect the script. For example, the script detection tool can be released in a cloud computing system so that scripts uploaded to the cloud computing system can be detected by the script detection tool.

[0154] In this application, a large language model is used to analyze newly added scripts in real time, generating a structured script detection tool that is then converted into executable SDK code, enabling automatic rule iteration. This improves rule update efficiency and shortens the update cycle, enabling rapid response to new threats such as malicious script variants. Furthermore, the model identifies unseen permission-abusing scripts and incorporates them into the rule base, reducing the risk of missed reports.

[0155] It can automate the entire process, from monitoring script update events, analyzing and detecting scripts using large models, to code generation, updating, automated testing, and version management, achieving end-to-end automation. This significantly improves iteration efficiency, enhancing the iteration efficiency of script detection tools.

[0156] It should be noted that the embodiments of this application may involve the use of user data. In actual applications, user-specific personal data can be used in the scheme described herein within the scope permitted by applicable laws and regulations, subject to the requirements of applicable laws and regulations of the country where the user is located (for example, with the user's explicit consent, effective notification to the user, etc.).

[0157] It should be noted that for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the order of the actions described, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0158] On the basis of the above embodiment, this embodiment further provides a device for generating a detection tool, which is applied to electronic devices such as a server device, such as Figure 7 As shown, the device includes: The script determination module 702 is used to determine script information, where the script information includes a target script and script execution information.

[0159] The script detection module 704 is configured to detect the target script in combination with the script execution information and generate a script detection result.

[0160] The tool generation module 706 is used to analyze the script detection result using the target model and generate a corresponding script detection tool.

[0161] In summary, the target script to be detected and its script running information are obtained, and then combined with the script running information, the target script is detected using the first model to generate a script detection result. Compared with using the static information of the script to detect the script, the detection accuracy of the script execution is higher when combined with the context of the script running. The second model is then used to analyze the script detection results and generate the corresponding script detection tool. There is no need to manually write code, and the script detection tool automatically generated by the model is more efficient.

[0162] The script determination module is configured to monitor the script library, determine a script that meets the extraction rules as a target script, and run the target script to determine script running information of the target script.

[0163] The script detection module is used to detect the target script using the first model in combination with the script running information to generate a script detection result.

[0164] The script detection module is configured to generate first input data based on the script running information and the target script, input the first input data into at least one first model for detection, and output at least one script detection result.

[0165] The script detection module is used to obtain a first prompt word template for prompting a detection script; assemble the target script, script running information and the first prompt word template to generate first input data.

[0166] Among them, the first prompt word template includes: task prompt information, script variable parameters and operation variable parameters of the script detection task; the script detection module is used to fill the target script into the script variable parameters, fill the script operation information into the operation variable parameters, and combine it with the task prompt information to generate the first input data.

[0167] Among them, the script detection module is used to input the first input data into at least one first model; the first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, network behavior security detection; and generates at least one script detection result in a predetermined format.

[0168] Among them, the tool generation module is used to obtain a second prompt word template for prompting the generation of a script detection tool; generate second input data based on the second prompt word template and the script detection result; input the second input data into the second model for analysis, and output the corresponding script detection tool.

[0169] The tool generation module is further used to use the generated script detection tool to detect the target script and generate a corresponding tool detection result; and to obtain a third prompt word template for prompting analysis of differences, and generate third input data based on the third prompt word template, the script detection result and the tool detection result; input the third input data into the second model to analyze the differences and output the difference analysis result; obtain a fourth prompt word template for prompting update of the script detection tool, and generate fourth input data based on the fourth prompt word template, the difference analysis result and the script detection tool; input the fourth input data into the second model and output update information of the generated script detection tool; and use the update information to update the generated script detection tool to obtain an updated script detection tool.

[0170] The tool generation module is further configured to generate a test case for the script detection tool based on the second model, so as to test the script detection tool based on the test case.

[0171] The script detection module is used to analyze the at least one script detection result and screen the script detection results for generating a script detection tool.

[0172] The script detection module is used to obtain a fifth prompt word template for prompting and evaluating the processing results of different models; generate fifth input data based on the fifth prompt word template and at least one script detection result; input the fifth input data into the third model for screening processing, and output the screened script detection result.

[0173] In this application, a large language model is used to analyze newly added scripts in real time, generating a structured script detection tool that is then converted into executable SDK code, enabling automatic rule iteration. This improves rule update efficiency and shortens the update cycle, enabling rapid response to new threats such as malicious script variants. Furthermore, the model identifies unseen permission-abusing scripts and incorporates them into the rule base, reducing the risk of missed reports.

[0174] It can automate the entire process, from monitoring script update events, analyzing and detecting scripts using large models, to code generation, updating, automated testing, and version management, achieving end-to-end automation. This significantly improves iteration efficiency, enhancing the iteration efficiency of script detection tools.

[0175] An embodiment of the present application further provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0176] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the embodiment of the present application.

[0177] The present application also provides an electronic device comprising: a processor and a memory communicatively connected to the processor; the memory storing computer-executable instructions; and the processor executing the computer-executable instructions stored in the memory to implement the method described in the present application. In the present application, the electronic device includes a server, a terminal device, and other devices.

[0178] An embodiment of the present application further discloses a computer program product, including a computer program / computer executable instructions, wherein the computer program / computer executable instructions, when executed by a processor in an electronic device, implement the method described in the embodiment of the present application.

[0179] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as a server (cluster), a terminal, etc. Figure 8 An exemplary apparatus 800 that can be used to implement various embodiments described in this application is schematically illustrated.

[0180] For one embodiment, Figure 8 An exemplary apparatus 800 is shown having one or more processors 802, a control module (chip set) 804 coupled to at least one of the processor(s) 802, a memory 806 coupled to the control module 804, a non-volatile memory (NVM) / storage device 808 coupled to the control module 804, one or more input / output devices 810 coupled to the control module 804, and a network interface 812 coupled to the control module 804.

[0181] The processor 802 may include one or more single-core or multi-core processors, and the processor 802 may include any combination of general-purpose processors or dedicated processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, the apparatus 800 can function as a server, terminal, or other device described in the embodiments of the present application.

[0182] In some embodiments, the apparatus 800 may include one or more computer-readable media (e.g., memory 806 or NVM / storage 808) having instructions 814 and one or more processors 802 configured in conjunction with the one or more computer-readable media to execute the instructions 814 to implement a module to perform the actions described in the present disclosure.

[0183] For one embodiment, the control module 804 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 802 and / or any suitable device or component in communication with the control module 804 .

[0184] The control module 804 may include a memory controller module to provide an interface to the memory 806. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0185] The memory 806 can be used, for example, to load and store data and / or instructions 814 for the device 800. For one embodiment, the memory 806 can include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 806 can include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0186] For one embodiment, the control module 804 may include one or more input / output controllers to provide interfaces to the NVM / storage device 808 and the input / output device(s) 810 .

[0187] For example, NVM / storage 808 may be used to store data and / or instructions 814. NVM / storage 808 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0188] NVM / storage device 808 may include storage resources that are part of the device on which apparatus 800 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 808 may be accessed via input / output device(s) 810 over a network.

[0189] (One or more) input / output devices 810 may provide an interface for the apparatus 800 to communicate with any other appropriate device, and the input / output device 810 may include a communication component, an audio component, a sensor component, etc. The network interface 812 may provide an interface for the apparatus 800 to communicate via one or more networks. The apparatus 800 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard such as Bluetooth, WiFi, 2G, 3G, 4G, 5G, 6G, etc., or a combination thereof for wireless communication.

[0190] For one embodiment, at least one of the processor(s) 802 may be packaged together with the logic of one or more controllers of the control module 804 (e.g., a memory controller module). For one embodiment, at least one of the processor(s) 802 may be packaged together with the logic of one or more controllers of the control module 804 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 802 may be integrated on the same die with the logic of one or more controllers of the control module 804. For one embodiment, at least one of the processor(s) 802 may be integrated on the same die with the logic of one or more controllers of the control module 804 to form a system-on-chip (SoC).

[0191] In various embodiments, the apparatus 800 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the apparatus 800 may have more or fewer components and / or a different architecture. For example, in some embodiments, the apparatus 800 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0192] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in the memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0193] The present application also provides an electronic device comprising: a processor; and a memory storing executable code, wherein when the executable code is executed, the processor executes one or more methods described in the embodiments of the present application. The memory in the embodiments of the present application can store various data, such as target files, file-application association data, and other data, and can also include user behavior data, thereby providing a data foundation for various processing.

[0194] The embodiments of the present application further provide one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes one or more methods described in the embodiments of the present application.

[0195] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0196] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0197] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0198] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0200] Although preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they become aware of the basic inventive concepts. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present invention.

[0201] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that includes a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or terminal device that includes the element.

[0202] The above is a detailed introduction to a method for generating a detection tool, an electronic device, a computer-readable storage medium and a computer program product provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for generating a detection tool, wherein: The method comprises: Determine script information, wherein the script information includes a target script and script execution information; Detecting the target script in combination with the script running information to generate a script detection result; The target model is used to analyze the script detection results and generate a corresponding script detection tool.

2. The method according to claim 1, wherein The determining script information includes: Monitor the script library and determine the script that meets the extraction rules as the target script; Run the target script and determine script running information of the target script.

3. The method according to claim 1, wherein The detecting the target script in combination with the script running information to generate a script detection result includes: Combined with the script running information, the target script of the first model is used to perform detection to generate a script detection result.

4. The method according to claim 3, wherein: The step of combining the script running information and detecting the target script using the first model to generate a script detection result includes: First input data is generated based on the script running information and the target script, the first input data is input into at least one first model for detection, and at least one script detection result is output.

5. The method according to claim 4, wherein Generating first input data based on the script execution information and the target script includes: Obtaining a first prompt word template for prompting a detection script; The target script, script running information and the first prompt word template are assembled to generate first input data.

6. The method according to claim 5, wherein: The first prompt word template includes: task prompt information of the script detection task, script variable parameters and running variable parameters; The step of assembling the target script, the script running information, and the first prompt word template to generate the first input data includes: The target script is filled into the script variable parameter, the script running information is filled into the running variable parameter, and the script is combined with the task prompt information to generate the first input data.

7. The method according to claim 4, wherein: The step of inputting the first input data into at least one first model for detection and outputting at least one script detection result includes: inputting the first input data into at least one first model; The first model performs at least one of the following security detection processes based on the input data: function behavior security detection, permission security detection, data security detection, dependency security detection, and network behavior security detection; At least one script detection result in a predetermined format is generated.

8. The method according to claim 1, wherein The target model is a second model, and the script detection result is analyzed using the target model to generate a corresponding script detection tool, including: Obtain a second prompt word template for prompting a script detection tool; generating second input data based on the second prompt word template and the script detection result; The second input data is input into the second model for analysis, and the corresponding script detection tool is output.

9. The method according to claim 1, wherein The target model is a second model, further comprising: Using the generated script detection tool to detect the target script and generate corresponding tool detection results; The target model is used to analyze the script detection result to generate a corresponding script detection tool, including: Obtaining a third prompt word template for prompting analysis differences, and generating third input data based on the third prompt word template, the script detection result, and the tool detection result; Inputting the third input data into the second model to analyze differences, and outputting difference analysis results; Obtaining a fourth prompt word template for prompting the script detection tool to update, and generating fourth input data based on the fourth prompt word template, the difference analysis result, and the generated script detection tool; Inputting the fourth input data into the second model, and outputting update information of the generated script detection tool; The generated script detection tool is updated using the update information to obtain an updated script detection tool.

10. The method according to claim 8 or 9, wherein: Also includes: A test case of the script detection tool is generated based on the second model, so as to test the script detection tool based on the test case.

11. The method according to claim 4, wherein Also includes: The at least one script detection result is analyzed and the script detection result is screened for generating a script detection tool.

12. The method according to claim 11, wherein The analyzing the at least one script detection result and screening the script detection result for generating a script detection tool includes: obtaining a fifth prompt word template for prompting evaluation of processing results of different models; generating fifth input data based on the fifth prompt word template and at least one script detection result; The fifth input data is input into the third model for screening processing, and the screened script detection result is output.

13. An electronic device, wherein: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 12.

14. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 12 when executed by a processor.

15. A computer program product comprising a computer program / computer executable instructions, wherein: When the computer program / computer executable instructions are executed by a processor in an electronic device, the method according to any one of claims 1 to 12 is implemented.

Images