Context-based attack traffic generation method and system

Abstract

The embodiment of the invention discloses a context-based attack traffic generation method and system, and the method comprises the steps: receiving an attack test task which is sent by a user terminal and aims at a to-be-tested application, and the attack test task comprises a test target and an attack traffic generation mode; wherein the attack traffic generation modes can comprise an interaction mode or a log mode, and the types of the attack traffic generated by different attack traffic generation modes are different. Therefore, according to the test target, target context data related to the test target is extracted from the context data source of the to-be-tested application. And then, inputting the attack test task and the target context data into the target large language model, and guiding the target large language model to output attack traffic for the to-be-tested application through the attack traffic generation mode.

Description

Technical Field

[0001] This specification relates to the field of network security technology, and in particular to a context-based attack traffic generation method and system. Background Technology

[0002] Verifying cybersecurity capabilities is a core challenge in enterprise security operations. To assess the effectiveness of security systems, the industry has developed a range of automated testing technologies and platforms, such as vulnerability scanners and BAS (Breach and Attack Simulation) platforms.

[0003] However, vulnerability scanners typically scan the application under test and match its signatures against known vulnerability signature databases to check for known technical vulnerabilities (such as outdated software versions) or common configuration errors. While this allows them to discover technical flaws, they are powerless against vulnerabilities arising from poor business process design (such as payment bypass vulnerabilities, privacy breaches, and privilege escalation vulnerabilities). BAS platforms can generate standardized, generic attack traffic designed to simulate well-known attack techniques for verifying security products, but this approach has significant limitations in simulating real, complex attacks, especially those targeting specific business logic. Therefore, a better technical solution is needed to generate targeted attack traffic based on the specific business logic of the application under test. Summary of the Invention

[0004] The purpose of the embodiments in this specification is to provide a technical solution for generating targeted attack traffic for specific business logic of the application to be tested by utilizing the generation capability of large language models.

[0005] To achieve the above technical solution, the embodiments in this specification are implemented as follows: This specification provides a context-based attack traffic generation method, comprising: receiving an attack test task for an application under test sent by a user terminal, wherein the attack test task includes a test target and an attack traffic generation mode, wherein the attack traffic generation mode includes an interactive mode or a log-type mode, and different attack traffic generation modes generate different types of attack traffic; extracting target context data related to the test target from the context data source of the application under test according to the test target; inputting the attack test task and the target context data into a target large language model; and guiding the target large language model to output attack traffic for the application under test through the attack traffic generation mode.

[0006] This specification provides a context-based attack traffic generation system, including a user terminal and an attack traffic generation system. The attack traffic generation system includes a context orchestration module and an attack traffic generation module. The user terminal sends an attack test task targeting an application under test to the context orchestration module. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode; different attack traffic generation modes generate different types of attack traffic. The context orchestration module receives the attack test task sent by the user terminal, extracts target context data related to the test target from the context data source of the application under test according to the test target, and sends the attack test task and the target context data to the attack traffic generation module. The attack traffic generation module inputs the attack test task and the target context data into a target large language model, and guides the target large language model to output attack traffic targeting the application under test through the attack traffic generation mode.

[0007] This specification provides a context-based attack traffic generation device, comprising: a receiving module, which receives an attack test task sent by a user terminal targeting an application under test, the attack test task including a test target and an attack traffic generation mode, the attack traffic generation mode including an interactive mode or a log-type mode, the attack traffic generating modes generating different types of attack traffic; a context data extraction module, which extracts target context data related to the test target from the context data source of the application under test; and an attack traffic generation module, which inputs the attack test task and the target context data into a target large language model, and guides the target large language model to output attack traffic targeting the application under test through the attack traffic generation mode.

[0008] This specification provides a context-based attack traffic generation device, including: a processor; and a memory arranged to store computer-executable instructions. When the executable instructions are executed, the processor is able to: receive an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-type mode, and different attack traffic generation modes generate different types of attack traffic. Based on the test target, target context data related to the test target is extracted from the context data source of the application under test. The attack test task and the target context data are input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test.

[0009] This specification provides a storage medium for storing computer-executable instructions. When executed by a processor, these instructions implement the following process: receiving an attack test task from a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Based on the test target, target context data related to the test target is extracted from the context data source of the application under test. The attack test task and the target context data are input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test.

[0010] This specification provides a computer program product, including a computer program that, when executed by a processor, implements the following process: receiving an attack test task sent by a user terminal targeting an application under test, the attack test task including a test target and an attack traffic generation mode, the attack traffic generation mode including an interactive mode or a log-type mode, with different attack traffic generation modes generating different types of attack traffic; extracting target context data related to the test target from the context data source of the application under test according to the test target, inputting the attack test task and the target context data into a target large language model, and guiding the target large language model to output attack traffic targeting the application under test through the attack traffic generation mode. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in one or more embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a schematic block diagram of a context-based attack traffic generation system described in this specification. Figure 2 This is a schematic block diagram of another context-based attack traffic generation system described in this specification; Figure 3 This is a schematic flowchart illustrating a context-based attack traffic generation method described in this specification. Figure 4 This is a schematic swimlane diagram illustrating a context-based attack traffic generation method described in this specification. Figure 5 This is a schematic block diagram of a context-based attack traffic generation device described in this specification. Figure 6 This is a schematic diagram of the structure of a context-based attack traffic generation device described in this specification. Detailed Implementation

[0013] This specification provides one or more embodiments of a context-based attack traffic generation method and system to solve the problem that it is currently impossible to generate targeted attack traffic for specific business logic of an application under test.

[0014] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of one or more embodiments of this specification.

[0015] Verifying cybersecurity capabilities is a core challenge in enterprise security operations. To assess the effectiveness of security systems, the industry has developed a range of automated testing technologies and platforms, such as vulnerability scanners and BAS platforms.

[0016] Vulnerability scanners, at their core, rely on a large, known vulnerability signature database for signature matching. In practice, they scan the application under test to check for known technical vulnerabilities (such as outdated software versions) or common configuration errors. However, on one hand, because vulnerability scanners cannot understand the internal business logic of the application under test—that is, they lack understanding of business logic—they can discover technical flaws but are powerless against vulnerabilities arising from poorly designed business processes (such as payment bypass vulnerabilities, privilege escalation vulnerabilities, etc.). On the other hand, because vulnerability scanners rely on a known vulnerability signature database, they cannot discover unique, previously unseen business logic vulnerabilities specific to the application under test; that is, they cannot discover "zero-day" business vulnerabilities. A "zero-day" business vulnerability refers to a security flaw in software, hardware, or a system that has not been discovered by the developer and for which no targeted patch has been released. Its core characteristic is the "zero-day defense period" between the discovery of the vulnerability and its exploitation. Furthermore, the attack payloads used by vulnerability scanners are predefined and templated, lacking the creativity and specificity of real attackers, making their attack patterns rigid.

[0017] The BAS platform continuously validates the effectiveness of enterprise security controls by automating a series of attack tactics, techniques, and procedures aligned with frameworks such as MITRE ATT&CK. Enterprise security controls include firewalls and EDR (Endpoint Detection and Response). The MITRE ATT&CK framework is a universally accessible and continuously updated knowledge base used to simulate, detect, prevent, and combat cybersecurity threats based on known adversarial behaviors. ATT&CK in MITRE ATT&CK stands for adversarial tactics, techniques, and common sense. However, on the one hand, the attack traffic generated by the BAS platform is usually standardized and generic, designed to simulate well-known attack methods. This means that while it can verify the detection capabilities of security products against known attack patterns, it lacks awareness of the specific business context of the application under test. On the other hand, although the BAS platform can automate the attack process, it cannot process the "semantics" of the attack content. The attack payloads it generates are unrelated to the internal data structures, API (Application Programming Interface) patterns, and business processes of the application under test, thus making it difficult to trigger deep-seated business logic flaws.

[0018] This demonstrates that current automated testing technologies and platforms generally adopt an "outside-in" perspective, excelling at testing technical vulnerabilities such as SQL (Structured Query Language) injection vulnerabilities and cross-site scripting vulnerabilities as defined in the OWASP Top 10. However, they are almost incapable of generating attacks that can exploit flaws in the unique business logic of the application under test. The OWASP Top 10 refers to the ten most likely, common, and dangerous security vulnerabilities in web applications, published by OWASP (Open Web Application Security Project).

[0019] A typical example is that existing tools can generate generic SQL injection payloads, such as 'OR 1=1 --', but cannot generate SQL injection payloads targeting specific table and column names in the database of the application under test, let alone construct a complex attack scenario that utilizes multi-step, role-specific workflows. For example, in a proprietary e-commerce order cancellation process, a regular user could call a refund API that should only be accessible to administrators.

[0020] Clearly, current automated testing technologies and platforms can handle the technical syntax of attacks, but they cannot understand their semantic meaning within a specific business process. The effectiveness of an attack is often closely linked to its semantic relevance. Generative AI (Artificial Intelligence) possesses the ability to create semantically relevant content, such as the GPT (Generative Pre-trained Transformer) model, but it does not inherently understand the internal private knowledge of the application being tested.

[0021] Therefore, with advancements in automation and intelligence, the ceiling for discovering "technical" vulnerabilities has been reached. The next technological breakthrough lies in automating the discovery of "business logic" vulnerabilities, which requires a completely new approach to provide generative AI with the missing business context. To this end, embodiments of this specification provide a context-based attack traffic generation method and system.

[0022] Figure 1 This is a schematic block diagram of a context-based attack traffic generation system described in this specification, such as... Figure 1 As shown, the context-based attack traffic generation system includes a user terminal 10 and an attack traffic generation system 20. The attack traffic generation system 20 includes a context orchestration module 210 and an attack traffic generation module 220.

[0023] In this embodiment, the user terminal 10 sends an attack test task for the application to be tested to the context orchestration module 210. The attack test task may include a test target and an attack traffic generation mode. The attack traffic generation mode may include an interactive mode or a log-type mode, and different attack traffic generation modes generate different types of attack traffic.

[0024] In this embodiment, the context orchestration module 210 receives the attack test task sent by the user terminal 10, extracts the target context data related to the test target from the context data source of the application to be tested according to the test target, and then sends the attack test task and the target context data to the attack traffic generation module 220.

[0025] Among them, such as Figure 1 As shown, the context-based attack traffic generation system can include the context data source 30 of the application under test. The context data source of the application under test can be obtained in advance from data sources such as the application's requirements / design documents, API documents, internal knowledge bases, and source code.

[0026] In this embodiment, the attack traffic generation module 220 inputs the attack test task and target context data into the target large language model, and guides the target large language model to output attack traffic for the application to be tested through the attack traffic generation mode.

[0027] The attack traffic generation module deploys a target LLM (Large Language Model). The target LLM can be any closed-source or open-source model with powerful code generation and logical reasoning capabilities; this specification does not limit this approach. LLM refers to a large-scale neural network model trained on massive amounts of text data, capable of understanding and generating text similar to human language. Examples include, but are not limited to, models based on GPT or LLaMA (Large Language Model Meta AI) architectures.

[0028] The technical solutions of one or more embodiments of this specification, through a context orchestration module, receive attack test tasks for the application under test sent by a user terminal. The attack test tasks include test targets and attack traffic generation modes. The attack traffic generation modes include interactive modes or log-based modes, and different attack traffic generation modes generate different types of attack traffic. Thus, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test, and the attack test task and target context data can be sent to the attack traffic generation module. Through the attack traffic generation module, the attack test task and target context data are input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic for the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared with a fixed vulnerability signature library, the large language model has powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0029] In one embodiment, such as Figure 2 As shown, the context orchestration module 210 may include a retrieval enhancement generation unit 2110.

[0030] In this embodiment, the retrieval enhancement generation unit 2110 uses retrieval enhancement generation (RAG) technology to retrieve context data related to the test target from the context data source 30 of the application to be tested, based on the test target, to obtain retrieval results, and then performs enhancement generation processing on the retrieval results to obtain target context data.

[0031] In applications, the context orchestration module may not include a retrieval-augmented generation (RAG) unit. If so, RAG technology cannot be used to obtain the target context data. In this case, a simpler method can be used to obtain the target context data. For example, the test target can be parsed based on preset rules, and the parsed results can be matched with keywords from the context data source of the application under test to extract the context. This method is simpler to implement, but it is less effective than RAG technology when processing unstructured documents (such as design manuals).

[0032] In one embodiment, such as Figure 2 As shown, the context orchestration module 210 may include a protocol conversion unit 2120.

[0033] In this embodiment, the protocol conversion unit 2120, based on the Model Context Protocol (MCP) specification, assembles the target context data into a standardized, structured MCP message, thereby sending the attack test task and the MCP message to the attack traffic generation module 220.

[0034] In this embodiment, the attack traffic generation module 220 inputs the attack test task and MCP message into the target large language model, and guides the target large language model to output attack traffic for the application to be tested through the attack traffic generation mode.

[0035] While MCP (Model Context Protocol) is an excellent open protocol, and adopting an open standard like MCP can bring better interoperability and ecosystem compatibility, in practical applications, even within a completely closed-loop self-developed system, a proprietary, simplified data exchange format (such as a custom JSON Schema) can be designed to pass context between the context orchestration module and the attack traffic generation module. JSON Schema is a rule file written in JSON format (a lightweight data exchange format) used to validate whether JSON data conforms to the expected structure, type, format, and constraints.

[0036] In one embodiment, when the attack traffic generation mode is interactive, the type of attack traffic is an attack command. In this embodiment, the attack traffic generation module 220 inputs the attack test task and target context data into the target large language model and outputs a first attack command targeting the application to be tested.

[0037] In one embodiment, such as Figure 2 As shown, the attack traffic generation system 20 may include an automated interaction module 230. In this embodiment, the attack traffic generation module 220 sends a first attack command to the automated interaction module 230.

[0038] The automated interaction module 230, using an automated interaction agent, automatically executes attack behaviors on the application under test based on the first attack command, and receives the first attack result returned by the application under test. Then, based on the first attack result and / or the first number of attack commands generated by the target large language model for the attack test task, it determines whether the test termination condition is met; if not, it repeatedly executes the target interaction steps until the test termination condition is met.

[0039] The target interaction steps include: sending a first attack result to the attack traffic generation module 220 via the automated interaction module 230; inputting the first attack result into the target large language model via the attack traffic generation module 220, outputting a second attack command targeting the application under test, and sending the second attack command to the automated interaction module 230; and using an automated interaction agent, automatically executing attack behavior on the application under test based on the second attack command, receiving the second attack result returned by the application under test, and determining whether the test termination condition is met based on the second attack result and / or the first quantity.

[0040] The automated interaction module deploys an automated interaction proxy. This proxy can directly use the Playwright MCP service without secondary development, lowering the implementation threshold but sacrificing customization capabilities. Playwright MCP is an open-source browser automation framework based on the MCP protocol, which simulates user interactions through scripts for end-to-end testing of web applications. Alternatively, the automated interaction proxy in this embodiment can be obtained through secondary development based on the Playwright MCP service package. Alternatively, an MCP server based on other automation frameworks such as Selenium (a tool for web application testing) can be used as the automated interaction proxy in this embodiment, as long as it conforms to the MCP protocol specification.

[0041] In one embodiment, the automated interaction module 230 includes multiple testing tools 2310 and an execution log recording unit 2320.

[0042] In this embodiment, the automated interaction module 230 uses an automated interaction agent to determine the target testing tool corresponding to the first attack instruction, and then uses the target testing tool 2310 to automatically execute attack behavior on the application under test, receive the first attack result returned by the application under test, and determine whether the test termination condition is met based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task; if not, the target interaction steps are executed repeatedly until the test termination condition is met.

[0043] The execution log recording unit 2320 records attack logs. These logs may include the execution timestamps of the attack actions, the attack instructions generated by the target large language model for the attack test task, and the attack results obtained based on those instructions.

[0044] In this embodiment, the automated interaction agent is derived from a secondary development of the Playwright MCP service software package, which allows for greater flexibility. Multiple testing tools are newly added custom security tools, and the execution log recording unit is a product of performance and log optimization. These newly added custom security tools can be tools specifically designed for security testing that are not available in standard Playwright MCP, such as inject_malicious_header (injecting malicious HTTP (Hypertext Transfer Protocol) headers) and fuzz_parameter (fuzzing parameters). The target large language model can directly call these custom tools. Performance and log optimization involves optimizing server performance for security testing scenarios and adding detailed, structured execution logs to facilitate subsequent analysis and evaluation.

[0045] In one embodiment, when the attack traffic generation mode is log-based, the attack traffic type is an attack payload. In this embodiment, the attack traffic generation module 220 inputs the attack test task and target context data into the target large language model and outputs a log-based attack payload for the application under test.

[0046] In one embodiment, the attack traffic generation module 220 sends a log-type attack payload to the user terminal 10. The user terminal 10 then manually executes attack actions on the application under test based on the log-type attack payload.

[0047] The above describes a context-based attack traffic generation system provided by one or more embodiments of this specification. Based on the same idea, one or more embodiments of this specification also provide a context-based attack traffic generation method.

[0048] Figure 3 This is a schematic flowchart illustrating a context-based attack traffic generation method described in this specification, such as... Figure 3 As shown, the method may include: S302 receives an attack test task sent by a user terminal for the application to be tested. The attack test task includes the test target and the attack traffic generation mode.

[0049] Optionally, the application to be tested can be a web application. A web application is a client-server based software program accessed through a browser, which users can use via the internet without installation. Security aspects can be deployed on the web application side, which can detect malicious attacks targeting the web application.

[0050] In this embodiment, the attack testing task is used to instruct the generation of attack traffic targeting the application under test according to the attack traffic generation mode. The test target refers to which vulnerability(s) in the application under test needs to be tested. For example, the test target could be an unauthorized vulnerability in the user deletion function. The attack traffic generation mode can include an interactive mode or a log-based mode, and different attack traffic generation modes generate different types of attack traffic.

[0051] Optionally, when the attack traffic generation mode is interactive, the type of attack traffic is attack command. When the attack traffic generation mode is log-based, the type of attack traffic is attack payload.

[0052] S304. Based on the test objective, extract target context data related to the test objective from the context data source of the application under test.

[0053] The context data source for the application under test can be obtained in advance from sources such as the application's requirements / design documents, API documentation, internal knowledge base, and source code. Target context data can include a range of data related to the test target, such as specific business logic, data schema, API structure, user roles, permission system, and operational workflows.

[0054] S306 inputs the attack test task and target context data into the target large language model, and guides the target large language model to output attack traffic for the application under test through the attack traffic generation mode.

[0055] The target large language model can be any closed-source or open-source model with strong code generation and logical reasoning capabilities; this specification does not limit this in the embodiments.

[0056] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0057] In one embodiment, extracting target context data related to the test target from the context data source of the application under test according to the test target (i.e., S304) can be performed as follows: using retrieval enhancement generation RAG technology, based on the test target, retrieve context data related to the test target from the context data source of the application under test to obtain retrieval results, and obtain target context data by enhancing the retrieval results.

[0058] In practical applications, RAG technology comprises three main processes: retrieval, enhancement, and generation. The retrieval process involves retrieving relevant information from an external knowledge base based on the user's query. Specifically, the user's query is converted into a vector using an embedding model for comparison with relevant knowledge stored in a vector database. A similarity search identifies the top K most relevant data points. The enhancement process involves embedding the user's query and the retrieved relevant knowledge into a pre-defined prompt template. The generation process involves inputting the retrieved and enhanced prompts into a large language model to generate the desired output.

[0059] In this embodiment, by using RAG technology, the most relevant target context data can be extracted accurately and efficiently from the context data source of the application under test based on the test target. This provides a contextual basis for the large language model to generate attack traffic, which is beneficial for driving the large language model to generate attack traffic targeting the specific business logic of the application under test.

[0060] In practical applications, for highly structured data sources (such as API documentation that strictly adheres to the OpenAPI specification), a simpler method can be used to obtain the target context data. For example, the test target can be parsed based on preset rules, and the parsed results can be matched with keywords from the context data source of the application under test to extract the context. This method is simpler to implement, but it is less effective than RAG technology when processing unstructured documents (such as design manuals). The OpenAPI specification is an open standard used to define and describe RESTful APIs. RESTful APIs are an application programming interface design style based on the HTTP protocol, following the REST (Representational State Transfer) architectural principles, and are used to build scalable and maintainable web services.

[0061] In one embodiment, after extracting target context data (i.e., S304) related to the test target from the context data source of the application under test according to the test target, the target context data can be assembled into a standardized, structured MCP message based on the Model Context Protocol (MCP) specification.

[0062] In this embodiment, the attack test task and target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic for the application under test (i.e., S306). This can be executed as follows: the attack test task and MCP message are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic for the application under test.

[0063] In this embodiment, by applying the MCP protocol to the field of security testing, specifically to the construction of an attack traffic generation system, efficient and standardized integration between the large language model and the context data source of the application under test can be achieved. This ensures that the large language model can accurately understand the knowledge it is assigned. Thus, the large language model is no longer guessing out of thin air, but rather designs attacks after fully understanding the application's functions and data relationships. This allows the generated attacks to directly target the core of the business logic. For example, the large language model knows to try calling an API named / api / admin / deleteUser using a viewer role session, rather than randomly combining attack strings.

[0064] In practical applications, although MCP is a superior open protocol, adopting an open standard like MCP can bring better interoperability and ecosystem compatibility. However, within a completely closed-loop self-developed system, a proprietary, simplified data exchange format (such as a custom JSON Schema) can be designed to pass context between the context orchestration module and the attack traffic generation module.

[0065] In one embodiment, when the attack traffic generation mode is interactive, the type of attack traffic is an attack command. In this embodiment, the attack test task and target context data are input into the target large language model, and the target large language model is guided to output attack traffic for the application under test through the attack traffic generation mode (i.e., S306). This can be executed as follows: Step A1: Step A1: Input the attack test task and target context data into the target large language model, and output the first attack command for the application to be tested.

[0066] In the case of attack traffic generation mode being interactive, the target large language model does not generate executable code scripts, but instead generates a series of high-level, structured instructions, namely the attack instructions defined in this embodiment.

[0067] In this embodiment, by inputting the attack test task and target context data into the target large language model, the powerful generation capabilities and creativity of the large language model can be utilized to output the first attack command against the application to be tested, which makes the generated attack command highly semantically realistic.

[0068] In one embodiment, after performing step A1 above, the application under test can be automatically subjected to attack behavior using an automated interactive agent according to steps B1-B3 below.

[0069] Step B1: Using an automated interactive agent, based on the first attack command, automatically execute the attack behavior on the application under test and receive the first attack result returned by the application under test.

[0070] The first attack result can be either a successful attack or a failed attack. Optionally, the automated interaction agent can directly use the Playwright MCP service without secondary development, which lowers the implementation threshold but sacrifices customization capabilities. Alternatively, secondary development can be performed on the Playwright MCP service software package to obtain the automated interaction agent in this embodiment. Alternatively, an MCP server based on other automation frameworks such as Selenium (a tool for web application testing) can be used as the automated interaction agent in this embodiment, as long as it conforms to the MCP protocol specification.

[0071] Playwright's MCP service receives attack instructions from a large language model, transforms these instructions into low-level control parameters, and calls Playwright's underlying API to directly and deterministically execute these operations in the browser.

[0072] In implementation, by adopting the Playwright MCP service, which requires no secondary development, the large language model can directly drive the browser to execute attack actions by sending attack commands, bypassing the traditional code generation and execution stages, significantly improving the efficiency, stability, and determinism of automated attacks. Furthermore, by further developing the standard Playwright MCP service, adding custom tools specifically designed for security testing (such as malicious header injection and parameter fuzzing), and optimizing its performance and logging capabilities, the large language model can be endowed with more powerful execution capabilities that are closer to penetration testing scenarios.

[0073] Optionally, after each execution of step B1, an automated interactive agent can be used to record attack logs. The attack logs may include the execution timestamps of the attack behavior, the attack instructions generated by the target large language model for the attack test task, and the attack results obtained based on the attack instructions.

[0074] Step B2: Based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task, determine whether the test termination condition is met.

[0075] The test termination conditions may include a first quantity reaching a first preset threshold, a first attack result being an attack failure, or a cumulative number of attack failures reaching a second preset threshold, etc., but this embodiment does not limit these conditions.

[0076] Step B3: If it is determined that the test termination condition is not met, then the following target interaction steps are executed repeatedly until the test termination condition is met.

[0077] In practical applications, if it is determined that the test termination conditions are met, the response processing flow for the attack test task of the application under test will end.

[0078] The target interaction steps include: inputting the first attack result into the target large language model, outputting the second attack command for the application under test, using an automated interaction agent to automatically execute the attack behavior on the application under test based on the second attack command, receiving the second attack result returned by the application under test, and determining whether the test termination condition is met based on the second attack result and / or the first quantity.

[0079] Understandably, if based on the second attack result and / or the first quantity, it is determined that the test termination condition is not currently met, then the second attack result is input into the target large language model, outputting a third attack command targeting the application under test. Using an automated interactive agent, based on the third attack command, the attack behavior is automatically executed on the application under test, and the third attack result returned by the application under test is received. Based on the third attack result and / or the first quantity, it is determined whether the test termination condition is currently met. This process continues until the test termination condition is met.

[0080] In this embodiment, the thinking of a large language model is transformed into action through an automated interaction agent, which automatically executes complex interactions such as login, multi-step operations, and state maintenance, achieving end-to-end automation. This greatly improves the efficiency, depth, and coverage of security testing and reduces the reliance on security talent.

[0081] In one embodiment, when the attack traffic generation mode is log-based, the attack traffic type is an attack payload. In this embodiment, the attack test task and target context data are input into the target large language model, and the target large language model is guided to output attack traffic for the application under test through the attack traffic generation mode (i.e., S306). This can be executed as follows: Step C1: Step C1: Input the attack test task and target context data into the target large language model, and output the log-type attack payload for the application under test.

[0082] In the case of a log-based attack traffic generation mode, the target large language model directly generates the attack payload itself. This could be a malicious SQL query string, a carefully crafted XSS (Cross-Site Scripting) script, or a malformed JSON object.

[0083] In this embodiment, by inputting the attack test task and target context data into the target large language model, the powerful generative capabilities and creativity of the large language model can be leveraged. After obtaining the business context, the large language model can extrapolate and generate various attack variants targeting that context, i.e., log-based attack payloads. This makes the generated attack payloads highly semantically realistic and diverse. For example, if the large language model knows that there is a `transactions` table in the database, the generated SQL injection payload might contain `UNION SELECT card_number, expiry_date FROM transactions`, which is far more threatening and realistic than the generic `OR 1=1 --`. This capability makes it possible to improve the capabilities of aspect-based security products and discover "zero-day" business logic vulnerabilities.

[0084] In one embodiment, after performing step C1 above, a log-type attack payload can be sent to the user terminal to trigger the user on the user terminal to manually perform attack behavior on the application under test based on the log-type attack payload.

[0085] Figure 4 This is a schematic swimlane diagram illustrating a context-based attack traffic generation method described in this specification. Through the interaction between the user terminal, the context orchestration module, the attack traffic generation module, the automated interaction module, and the application under test, a flexible bimodal attack traffic generation framework is implemented. This framework can generate complex interactive attacks with session state through an automated interaction proxy, and can also directly generate lightweight log-based attack payloads for log analysis and large-scale testing, adapting to diverse security verification needs. Specifically, in implementing complex interactive attacks, the deep business context information of the application under test is provided to a large language model, and the automated interaction proxy enables the large language model to directly drive the browser to execute attacks with business logic targeting. Figure 4 As shown, the process includes the following steps S402-S430: In step S402, the user terminal sends an attack test task for the application to be tested to the context orchestration module. The attack test task includes the test target and the attack traffic generation mode.

[0086] Among them, attack traffic generation modes include interactive mode or log-type mode, and different attack traffic generation modes generate different types of attack traffic.

[0087] In step S404, the context orchestration module extracts target context data related to the test target from the context data source of the application under test, based on the test target.

[0088] Optionally, Retrieval Enhancement Generation (RAG) technology can be used to retrieve contextual data related to the test target from the contextual data source of the application under test, based on the test target, to obtain retrieval results. These retrieval results are then enhanced to generate the target contextual data. Based on the Model Context Protocol (MCP) specification, the target contextual data is assembled into a standardized, structured MCP message.

[0089] In step S406, the context orchestration module sends the attack test task and target context data to the attack traffic generation module.

[0090] Optionally, step S406 can be performed as follows: the context orchestration module sends the attack test task and MCP message to the attack traffic generation module.

[0091] In practice, the attack traffic generation steps differ depending on the attack traffic generation mode. When the attack traffic generation mode is interactive, the attack traffic type is an attack command, and the attack command generation step is step S408. When the attack traffic generation mode is log-based, the attack traffic type is an attack payload, and the attack payload generation step is step S426.

[0092] In step S408, the attack traffic generation module inputs the attack test task and target context data into the target large language model and outputs the first attack command for the application to be tested.

[0093] In step S410, the attack traffic generation module sends the first attack command to the automated interaction module.

[0094] In step S412, the automated interaction module uses the automated interaction agent to automatically execute attack behavior on the application under test based on the first attack command, and receives the first attack result returned by the application under test.

[0095] Step S414: The automated interaction module determines whether the test termination condition is met based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task.

[0096] In step S416, if the automated interaction module determines that the test termination conditions are not met, it sends the first attack result to the attack traffic generation module.

[0097] In step S418, the attack traffic generation module inputs the first attack result into the target large language model and outputs the second attack command for the application to be tested.

[0098] In step S420, the attack traffic generation module sends the second attack command to the automated interaction module.

[0099] In step S422, the automated interaction module uses the automated interaction agent to automatically execute attack behavior on the application under test based on the second attack command, and receives the second attack result returned by the application under test.

[0100] Step S424: The automated interaction module determines whether the test termination condition is met based on the second attack result and / or the first quantity. If not, the target interaction steps are executed repeatedly until the test termination condition is met.

[0101] The target interaction steps include: the automated interaction module sending the second attack result to the attack traffic generation module; the attack traffic generation module inputting the second attack result into the target large language model, outputting a third attack command for the application under test, and sending the third attack command to the automated interaction module; the automated interaction module using the automated interaction agent to automatically execute attack behavior on the application under test based on the third attack command, and receiving the third attack result returned by the application under test, and determining whether the test termination condition is met based on the third attack result and / or the first quantity.

[0102] In step S426, the attack traffic generation module inputs the attack test task and target context data into the target large language model and outputs a log-type attack payload for the application under test.

[0103] In step S428, the attack traffic generation module sends the log-type attack payload to the user terminal.

[0104] In step S430, the user terminal manually executes attack behavior on the application under test based on the log-type attack payload.

[0105] The specific processes of steps S402-S430 have been described in detail in the above embodiments and will not be repeated here.

[0106] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0107] In summary, specific embodiments of this subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing can be advantageous.

[0108] The above describes one or more embodiments of the context-based attack traffic generation method provided in this specification. Based on the same idea, one or more embodiments of this specification also provide a context-based attack traffic generation device.

[0109] Figure 5 This is a schematic block diagram of a context-based attack traffic generation device described in this specification. Please refer to [the diagram]. Figure 5 Context-based attack traffic generation apparatus may include: The receiving module 510 receives an attack test task sent by the user terminal for the application to be tested. The attack test task includes the test target and the attack traffic generation mode. The attack traffic generation mode includes interactive mode or log-type mode. Different attack traffic generation modes generate different types of attack traffic. The context data extraction module 520 extracts target context data related to the test target from the context data source of the application under test, based on the test target. The attack traffic generation module 530 inputs the attack test task and target context data into the target large language model, and guides the target large language model to output attack traffic for the application under test through the attack traffic generation mode.

[0110] In one embodiment, when the attack traffic generation mode is interactive mode, the type of attack traffic is attack command; The attack traffic generation module 530 includes: The attack command generation unit inputs the attack test task and target context data into the target large language model and outputs the first attack command for the application to be tested.

[0111] In one embodiment, the context-based attack traffic generation device further includes: The attack auto-execution module utilizes an automated interactive agent to automatically execute attack behaviors on the application under test based on the first attack command, and receives the first attack result returned by the application under test. The judgment module determines whether the test termination condition is met based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task. The loop execution module, if it determines that the test termination condition is not met, will repeatedly execute the following target interaction steps until the test termination condition is met; the target interaction steps include: inputting the first attack result into the target large language model and outputting the second attack instruction for the application under test; using an automated interaction agent, automatically executing the attack behavior for the application under test based on the second attack instruction, and receiving the second attack result returned by the application under test; and determining whether the test termination condition is met based on the second attack result and / or the first quantity.

[0112] In one embodiment, when the attack traffic generation mode is log-based, the type of attack traffic is attack payload; The attack traffic generation module 530 includes: The attack payload generation unit inputs the attack test task and target context data into the target large language model and outputs a log-type attack payload for the application under test.

[0113] In one embodiment, the context-based attack traffic generation device further includes: The sending module sends log-based attack payloads to the user terminal, triggering the user to manually execute attack behaviors on the application under test based on the log-based attack payloads.

[0114] In one embodiment, the context data extraction module 520 includes: The retrieval unit utilizes retrieval enhancement generation RAG technology to retrieve contextual data related to the test target from the contextual data source of the application under test, based on the test target, and obtains retrieval results. The enhancement generation processing unit performs enhancement generation processing on the search results to obtain target context data.

[0115] In one embodiment, the context-based attack traffic generation device further includes: The data structure transformation module extracts target context data related to the test target from the context data source of the application under test according to the test target, and then assembles the target context data into standardized, structured MCP messages based on the Model Context Protocol (MCP) specification. The attack traffic generation module 530 inputs the attack test task and MCP message into the target large language model.

[0116] For ease of description, the above devices are described by dividing them into various modules or units based on their functions. Of course, when implementing one or more embodiments of this specification, the functions of each module or unit can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative; the division of each module and unit is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or modules can be combined or integrated into another system, or some features can be ignored or not executed, etc.

[0117] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0118] Those skilled in the art will understand that the above-described context-based attack traffic generation device can be used to implement the context-based attack traffic generation method described above. The detailed description therein should be similar to the method description above, and will not be repeated here to avoid being cumbersome.

[0119] The above are examples of context-based attack traffic generation devices provided in this specification. Based on the same concept, this specification also provides a context-based attack traffic generation device, such as... Figure 6 As shown.

[0120] The context-based attack traffic generation device can provide terminal devices or servers, etc., for the above embodiments.

[0121] Context-based attack traffic generation devices can vary significantly in configuration and performance. They may include a communication interface 602, a user interface 604, a processor 606, and data storage 608. These components are interconnected and communicate with each other via a system bus, network, or other connection mechanism 610. The communication interface 602 enables the context-based attack traffic generation device 600 to communicate with other devices, access networks, and transport networks via analog or digital modulation. For example, the communication interface 602 may include a chipset and antenna for wireless communication with a radio access network or access point. Furthermore, the communication interface 602 can be a wired interface such as Ethernet, Token Ring, or a USB port, or a wireless interface such as Wi-Fi, Bluetooth, GPS, or a wide-area wireless interface (e.g., WiMAX or LTE). Of course, the communication interface 602 may also support other forms of physical layer interfaces and standard or proprietary communication protocols. The communication interface 602 may also include multiple physical communication interfaces, such as Wi-Fi, Bluetooth, and wide-area wireless interfaces.

[0122] User interface 604 includes receiving user input and providing output to the user. Therefore, user interface 604 may include input components such as a keypad, keyboard, touch-sensitive or presence-sensitive panel, computer mouse, trackball, joystick, microphone, still camera, and video camera, and output components such as a display screen (which may be combined with a touch-sensitive panel), CRT, LCD, LED, display using DLP technology, printer, and other similar devices known or developed in the future. User interface 604 may also generate auditory output via speakers, speaker jacks, audio output ports, audio output devices, headphones, and other similar devices known or developed in the future. In some embodiments, user interface 604 may include software, circuitry, or other forms of logic capable of transmitting and receiving data from external user input / output devices. Additionally or alternatively, context-based attack traffic generation device 600 may support remote access from other devices via communication interface 602 or another physical interface (not shown). User interface 604 may be configured to receive user input, the position and movement of which may be indicated by indicators or cursors described herein. User interface 604 can also be configured as a display device for rendering or displaying text fragments.

[0123] Processor 606 may contain one or more general-purpose processors and / or special-purpose processors.

[0124] Data storage 608 may include one or more volatile and / or non-volatile storage components and may be integrated wholly or partially with processor 606. Data storage 608 may include removable and non-removable components.

[0125] Processor 606 is capable of executing program instructions 618 (e.g., compiled or uncompiled program logic and / or machine code) stored in data storage 608 to perform the various functions described herein. Data storage 608 may contain a non-transitory computer-readable medium on which program instructions are stored, which, when executed by context-based attack traffic generation device 600, enable context-based attack traffic generation device 600 to perform any methods, processes, or functions disclosed in this specification and / or the accompanying drawings. Execution of program instructions 618 by processor 606 may result in processor 606 using data 612.

[0126] For example, program instructions 618 may include an operating system 622 (e.g., an operating system kernel, device drivers, and / or other modules) and one or more applications 620 (e.g., a browser, social application, or game application) installed on the context-based attack traffic generation device 600. Similarly, data 612 may include operating system data 616 and application data 614. Operating system data 616 is primarily accessible to the operating system 622, while application data 614 is primarily accessible to one or more applications 620. Application data 614 may reside in a file system that is visible or hidden from the user of the context-based attack traffic generation device 600.

[0127] Application 620 can communicate with operating system 612 through one or more application programming interfaces (APIs). These APIs help application 620 read and / or write application data 614, transmit or receive information via communication interface 602, receive or display information on user interface 604, etc.

[0128] In some terminology, application 620 may be simply referred to as "app". Furthermore, application 620 can be downloaded to context-based attack traffic generation device 600 through one or more online app stores or app markets. However, the application can also be installed on context-based attack traffic generation device 600 in other ways, such as through a web browser or a physical interface (e.g., a USB port) on context-based attack traffic generation device 600.

[0129] Specifically, in this embodiment, the context-based attack traffic generation device 600 includes a data storage 608 and one or more program instructions 618, wherein one or more program instructions 618 are stored in the data storage 608, and one or more program instructions 618 are configured to be executed by one or more processors. The one or more program instructions include computer-executable instructions for performing the following: It receives attack test tasks sent by user terminals targeting the application to be tested. The attack test tasks include the test target and the attack traffic generation mode. The attack traffic generation mode includes interactive mode or log-type mode. Different attack traffic generation modes generate different types of attack traffic. Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic against the application under test.

[0130] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0131] Furthermore, based on the above Figures 3 to 4 This specification also provides a storage medium for storing computer-executable instruction information in one or more embodiments. In one specific embodiment, the storage medium may be a USB flash drive, optical disc, hard disk, etc. When the computer-executable instruction information stored in the storage medium is executed by a processor, it can realize the following process: It receives attack test tasks sent by user terminals targeting the application to be tested. The attack test tasks include the test target and the attack traffic generation mode. The attack traffic generation mode includes interactive mode or log-type mode. Different attack traffic generation modes generate different types of attack traffic. Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic against the application under test.

[0132] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0133] Furthermore, based on the above Figures 3 to 4 This specification also provides one or more embodiments of a computer program product, including a computer program, which, when executed by a processor, can perform the following processes: It receives attack test tasks sent by user terminals targeting the application to be tested. The attack test tasks include the test target and the attack traffic generation mode. The attack traffic generation mode includes interactive mode or log-type mode. Different attack traffic generation modes generate different types of attack traffic. Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic against the application under test.

[0134] The technical solution employing one or more embodiments of this specification involves receiving an attack test task sent by a user terminal targeting an application under test. The attack test task includes a test target and an attack traffic generation mode. The attack traffic generation mode includes an interactive mode or a log-based mode, with different attack traffic generation modes generating different types of attack traffic. Therefore, based on the test target, target context data related to the test target can be extracted from the context data source of the application under test. The attack test task and target context data are then input into a target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic targeting the application under test. In this way, on the one hand, this technical solution uses a large language model to generate attack traffic. Compared to a fixed vulnerability signature database, the large language model possesses powerful generation capabilities and creativity. After obtaining the context related to the test target, the large language model can extrapolate and generate several attack variants targeting that context, thereby making the generated attack traffic highly semantically realistic and diverse. On the other hand, when generating attack traffic using a large language model, this technical solution no longer relies on the model to guess out of thin air. Instead, it enables the large language model to learn the business logic of the application under test based on the context relevant to the test target. After fully understanding the application's functions, data relationships, and other aspects, it designs the attack, ensuring that the generated attack traffic directly targets the core of the business logic. Therefore, this technical solution can generate targeted attack traffic based on the specific business logic of the application under test.

[0135] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps described in the claims may be performed in a different order than those shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired results. In some embodiments, multitasking and parallel processing are possible or may be advantageous. Moreover, although one or more embodiments of this specification provide method steps as described in the embodiments or flowcharts, it is understood that the order of steps listed in the embodiments or flowcharts is merely one possible execution order among many steps and does not represent the only execution order. Therefore, when method steps are involved in the claims, adjustments to the order of those steps, or parallelism between steps, are also within the scope of protection of the claims.

[0136] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0137] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0138] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0139] For ease of description, the above apparatus is described by dividing it into various functional units. Of course, when implementing one or more embodiments of this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0140] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] Embodiments in this specification are described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable parallel device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable parallel device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable fraud device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0144] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0145] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0146] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0147] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical or equivalent elements in the process, method, article, or apparatus that includes said element. Furthermore, "a," "an," and "the" are not specifically singular and may include plural forms. Ordinal numbers such as "first," "second," etc., do not necessarily indicate order; they are often used to distinguish objects. For example, "first server" and "second server" usually refer to two servers, described as "first server" and "second server" to differentiate them; however, sometimes these two servers may be the same server. Moreover, in this specification, unless explicitly stated otherwise, "receiving and sending data" does not necessarily mean direct receiving and sending; it can be indirect receiving and sending (i.e., receiving and sending indirectly through one or more entities). Similarly, in this specification, unless otherwise stated, the relationships between structures can be direct or indirect.

[0148] Furthermore, the specific terms used in this specification to describe embodiments, such as "an embodiment," "one embodiment," or "some embodiments," refer to a particular feature, structure, or characteristic related to at least one embodiment of this specification. Therefore, it should be emphasized and noted that "an embodiment," "one embodiment," or "an alternative embodiment" mentioned twice or more in different locations in this specification do not necessarily refer to the same embodiment. Moreover, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of those different embodiments or examples, without contradiction.

[0149] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0151] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0152] The above description is merely an embodiment of this specification and is not intended to limit this document. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims in this document.

Claims

1. A context-based attack traffic generation method, comprising: Receive an attack test task sent by a user terminal for the application to be tested, wherein the attack test task includes the test target and the attack traffic generation mode; The attack traffic generation mode includes interactive mode or log-type mode, and different attack traffic generation modes generate different types of attack traffic; Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and the target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic against the application under test.

2. The method according to claim 1, wherein when the attack traffic generation mode is the interactive mode, the type of the attack traffic is an attack command; The step of inputting the attack test task and the target context data into the target large language model, and guiding the target large language model to output attack traffic against the application under test through the attack traffic generation mode, includes: The attack test task and the target context data are input into the target large language model, and a first attack command is output for the application to be tested.

3. The method according to claim 2, further comprising: Using an automated interactive agent, based on the first attack command, the agent automatically performs attack actions on the application under test and receives the first attack result returned by the application under test. Based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task, determine whether the test termination condition is currently met. If not, the following target interaction steps are executed repeatedly until the test termination condition is met; The target interaction step includes: inputting the first attack result into the target large language model and outputting a second attack instruction for the application under test; using the automated interaction agent, automatically performing attack behavior on the application under test based on the second attack instruction, and receiving the second attack result returned by the application under test; and determining whether the test termination condition is met based on the second attack result and / or the first quantity.

4. The method according to claim 1, wherein when the attack traffic generation mode is the log-type mode, the type of the attack traffic is an attack payload; The step of inputting the attack test task and the target context data into the target large language model, and guiding the target large language model to output attack traffic against the application under test through the attack traffic generation mode, includes: The attack test task and the target context data are input into the target large language model, and a log-type attack payload is output for the application to be tested.

5. The method according to claim 4, further comprising: The log-based attack payload is sent to the user terminal to trigger the user on the user terminal to manually perform an attack on the application under test based on the log-based attack payload.

6. The method according to claim 1, wherein extracting target context data related to the test target from the context data source of the application under test according to the test target includes: Using the search enhancement generation RAG technology, based on the test target, contextual data related to the test target is retrieved from the contextual data source of the application under test to obtain the search results; The search results are enhanced to obtain the target context data.

7. The method according to claim 1, further comprising, after extracting target context data related to the test target from the context data source of the application under test according to the test target: Based on the Model Context Protocol (MCP) specification, the target context data is assembled into standardized, structured MCP messages. The step of inputting the attack test task and the target context data into the target large language model includes: inputting the attack test task and the MCP message into the target large language model.

8. A context-based attack traffic generation system, comprising: User terminal and attack traffic generation system, wherein the attack traffic generation system includes a context orchestration module and an attack traffic generation module; The user terminal sends an attack test task for the application to be tested to the context orchestration module; the attack test task includes a test target and an attack traffic generation mode; the attack traffic generation mode includes an interactive mode or a log-type mode, and different attack traffic generation modes generate different types of attack traffic; The context orchestration module receives the attack test task sent by the user terminal; Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and the target context data are sent to the attack traffic generation module; The attack traffic generation module inputs the attack test task and the target context data into the target large language model, and guides the target large language model to output attack traffic against the application under test through the attack traffic generation mode.

9. The system according to claim 8, wherein when the attack traffic generation mode is the interactive mode, the type of the attack traffic is an attack command; The attack traffic generation module inputs the attack test task and the target context data into the target large language model and outputs a first attack command for the application to be tested.

10. The system according to claim 9, wherein the attack traffic generation system further includes an automated interaction module; The attack traffic generation module sends the first attack command to the automated interaction module; The automated interaction module, using an automated interaction agent, automatically performs attack actions on the application under test based on the first attack command, and receives the first attack result returned by the application under test. Based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task, determine whether the test termination condition is currently met. If not, the target interaction steps are executed repeatedly until the test termination condition is met; The target interaction steps include: the automated interaction module sending the first attack result to the attack traffic generation module; the attack traffic generation module inputting the first attack result into the target large language model, outputting a second attack command against the application under test, and sending the second attack command to the automated interaction module; the automated interaction module using the automated interaction agent, based on the second attack command, automatically executing attack behavior on the application under test, receiving the second attack result returned by the application under test, and determining whether the test termination condition is met based on the second attack result and / or the first quantity.

11. The system according to claim 10, wherein the automated interaction module includes multiple testing tools and an execution log recording unit; The automated interaction module uses an automated interaction agent to determine the target testing tool corresponding to the first attack command; Using the target testing tool, attack behaviors are automatically executed on the application under test; Receive the first attack result returned by the application under test; based on the first attack result and / or the first number of attack instructions generated by the target large language model for the attack test task, determine whether the test termination condition is met. If not, the target interaction steps are executed repeatedly until the test termination condition is met; The execution log recording unit records attack logs; the attack logs include the execution timestamp of the attack behavior, the attack instructions generated by the target large language model for the attack test task, and the attack results obtained based on the attack instructions.

12. The system according to claim 8, wherein the context orchestration module includes a retrieval enhancement generation unit; The retrieval enhancement generation unit utilizes retrieval enhancement generation (RAG) technology to retrieve contextual data related to the test target from the contextual data source of the application under test, based on the test target, and obtain retrieval results; it then performs enhancement generation processing on the retrieval results to obtain the target contextual data.

13. The system according to claim 8, wherein the context orchestration module further comprises a protocol conversion unit; The protocol conversion unit, based on the Model Context Protocol (MCP) specification, assembles the target context data into a standardized, structured MCP message; and sends the attack test task and the MCP message to the attack traffic generation module. The attack traffic generation module inputs the attack test task and the MCP message into the target large language model, and guides the target large language model to output attack traffic against the application under test through the attack traffic generation mode.

14. A context-based attack traffic generation device, comprising: The receiving module receives an attack test task sent by a user terminal for the application to be tested. The attack test task includes the test target and the attack traffic generation mode. The attack traffic generation mode includes interactive mode or log-type mode, and different attack traffic generation modes generate different types of attack traffic; The context data extraction module extracts target context data related to the test target from the context data source of the application under test, based on the test target. The attack traffic generation module inputs the attack test task and the target context data into the target large language model, and guides the target large language model to output attack traffic against the application under test through the attack traffic generation mode.

15. A context-based attack traffic generation device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, enable the processor to: The system receives attack test tasks sent by user terminals for the application under test. The attack test tasks include test targets and attack traffic generation modes. The attack traffic generation modes include interactive mode or log-type mode, and different attack traffic generation modes generate different types of attack traffic. Based on the test objective, extract target context data related to the test objective from the context data source of the application under test; The attack test task and the target context data are input into the target large language model, and the attack traffic generation mode guides the target large language model to output attack traffic against the application under test.

Images