An education network penetration vulnerability auxiliary analysis method based on retrieval enhancement generation

Abstract

The application discloses an education network penetration vulnerability auxiliary analysis method based on retrieval enhancement generation, and belongs to the network security field, and comprises the following steps: constructing a historical vulnerability knowledge base to obtain a vector database containing vulnerability semantic vectors; performing fingerprint scanning on an education website to obtain structured fingerprint information containing protocols, ports, URLs and technology stack labels; after the fingerprint information is vectorized, similarity retrieval is performed in the vector database to obtain candidate vulnerability texts matched with the fingerprint information; the candidate vulnerability texts and the fingerprint information are combined to generate prompts, which are input into a large language model to obtain vulnerability analysis and repair suggestions for the education website. Through the fingerprint scanning function, the method can accurately reveal the fingerprint feature details of the education website. And corresponding potential hazard analysis and targeted repair suggestions can be generated for the identified fingerprint information through the large language model.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to an auxiliary analysis method for penetration vulnerabilities in educational networks based on search enhancement generation. Background Technology

[0002] With the increasing informatization of the education sector, the number of educational websites has exploded. Their security directly affects the personal information security of teachers and students, as well as the stable operation of education management systems. However, due to the widespread use of open-source frameworks for rapid construction, coupled with weak security awareness among developers and inconsistent quality of outsourced development, educational websites have become a prime target for attackers, resulting in frequent and highly similar vulnerabilities.

[0003] Currently, web vulnerability detection mainly relies on two types of technical solutions: one is traditional penetration testing tools such as Nmap and Burp Suite, which scan targets through preset rules or scripts. While simple to implement, they lack the ability to effectively identify complex business logic and deep vulnerability exploitation chains. The other is AI-based intelligent penetration platforms, such as the FlySecAgent system. This system uses a Large Language Model (LLM) as its cognitive center, and through the collaborative work of modules such as a task orchestrator, plug-in executors, and a knowledge augmentation retrieval engine (RAG Retriever), it achieves automated generation from natural language requirements to structured security reports. However, FlySecAgent runs model inference, vector retrieval, and multi-plugin scanning in the same framework, resulting in extremely high instantaneous GPU and CPU usage. This makes it difficult to deploy in resource-constrained scenarios. Furthermore, it lacks fine-grained domain customization for the specific business processes, data interaction patterns, and system architecture of educational websites, limiting its generalization capabilities and making it difficult to meet the lightweight, highly targeted, and low-resource-consumption penetration assistance needs of educational networks. Summary of the Invention

[0004] This invention proposes an auxiliary analysis method for educational network penetration vulnerabilities based on retrieval enhancement, in order to solve the problems existing in the above-mentioned prior art.

[0005] To achieve the above objectives, this invention provides a method for assisting in the analysis of educational network penetration vulnerabilities based on retrieval enhancement, comprising the following steps:

[0006] Build a historical vulnerability knowledge base to obtain a vector database containing vulnerability semantic vectors;

[0007] Perform fingerprint scanning on educational websites to obtain structured fingerprint information containing protocols, ports, URLs, and technology stack tags;

[0008] After the fingerprint information is vectorized, a similarity search is performed in the vector database to obtain candidate vulnerability texts that match the fingerprint information.

[0009] The candidate vulnerability text is combined with the fingerprint information to generate a prompt, which is then input into a large language model to obtain vulnerability analysis and remediation suggestions for educational websites.

[0010] Optionally, the construction of the historical vulnerability knowledge base includes:

[0011] Download raw text data from historical vulnerability data sources, and segment the raw text data according to vulnerability instances to obtain several independent vulnerability description texts;

[0012] Each independent vulnerability description text is divided into several vulnerability text blocks by sliding blocks according to a preset length and overlapping window.

[0013] The factory function that encapsulates the HuggingFace BGE embedding model is called to perform vectorization encoding on each vulnerability text block and L2 normalization on the output vector to obtain vulnerability semantic vectors that correspond one-to-one with the corresponding vulnerability text blocks.

[0014] Initialize a FAISS vector database instance, write the vulnerability semantic vector into the FAISS vector database, and establish an external mapping table from the FAISS internal integer index to the vulnerability's unique identifier. Store the external mapping table and the vector index together on the local disk to complete the construction of the vector database.

[0015] Optionally, performing fingerprint scanning on the educational website includes:

[0016] Perform full port or custom range port detection on the target IP to obtain a list of open ports;

[0017] Perform protocol identification on each open port to obtain the protocol name;

[0018] The URL is constructed based on the protocol, IP address, and port, and a third-party fingerprinting tool is used to extract information about the CMS, middleware, development framework, and front-end library to obtain a structured fingerprint record.

[0019] Optionally, performing protocol identification for each open port includes:

[0020] Extract the list of open ports using regular expressions;

[0021] Take each combination of IP address and port number from the list of open ports as input and call the service identification component;

[0022] The service identification component processes the input using string segmentation and matching techniques to identify the name of the application layer protocol running on the port.

[0023] Based on the identified application layer protocol name, the network service corresponding to the port is semantically labeled.

[0024] Optionally, the step of calling a third-party fingerprint tool to extract information includes: when the target port does not recognize the Web service or the fingerprint is missing, a default symbol is used as a placeholder to ensure the integrity of the fingerprint record fields.

[0025] Optionally, the similarity retrieval includes:

[0026] Fingerprint information is transformed into query vectors using a pre-trained text embedding model;

[0027] Calculate the cosine similarity between the query vector and the vulnerability semantic vector;

[0028] If the maximum similarity exceeds the preset threshold, the corresponding vulnerability text is selected as the candidate vulnerability text.

[0029] Optionally, combining the candidate vulnerability text with the fingerprint information to generate a prompt includes: using the candidate vulnerability text as context and concatenating it with the fingerprint information to form a natural language prompt sequence.

[0030] The present invention also proposes a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method.

[0031] The present invention also proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method.

[0032] The present invention also proposes an electronic device, comprising: a memory and a processor; the memory for storing a program; and the processor for executing the program to implement the various steps of the method.

[0033] Compared with the prior art, the present invention has the following advantages and technical effects:

[0034] Compared to existing technologies like FlySecAgent, which concentrates large-scale model inference, vector retrieval, and multi-plugin scanning in the same framework, resulting in extremely high GPU / CPU instantaneous usage and difficulty in deployment in resource-constrained educational network scenarios, and lacks domain customization for the specific architecture of educational websites, this invention first constructs an offline vector database containing historical vulnerability semantic vectors, then performs a lightweight fingerprint scan on the educational website, and subsequently vectorizes the fingerprint information to quickly retrieve and match candidate vulnerability texts in the local vector database. Finally, the candidate vulnerability texts and fingerprint information are combined to generate prompts and input into a large language model. Thus, without relying on cloud computing power or increasing the load on real-time plugins, it significantly reduces hardware resource requirements through a decoupled approach of "offline knowledge base + online retrieval and inference." At the same time, it utilizes the semantic space formed by targeted training with educational-specific historical vulnerability data to achieve vulnerability analysis and remediation suggestions that accurately correspond to the technology stack of the educational website, overcoming the problems of high resource consumption and poor domain adaptability in the background technologies. Attached Figure Description

[0035] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention. Detailed Implementation

[0037] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0038] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0039] like Figure 1 As shown, this embodiment provides a method for assisting in the analysis of educational network penetration vulnerabilities based on retrieval enhancement, including the following steps:

[0040] Build a historical vulnerability knowledge base to obtain a vector database containing vulnerability semantic vectors;

[0041] Perform fingerprint scanning on educational websites to obtain structured fingerprint information containing protocols, ports, URLs, and technology stack tags;

[0042] After the fingerprint information is vectorized, a similarity search is performed in the vector database to obtain candidate vulnerability texts that match the fingerprint information.

[0043] The candidate vulnerability text is combined with the fingerprint information to generate a prompt, which is then input into a large language model to obtain vulnerability analysis and remediation suggestions for educational websites.

[0044] Table 1 shows the specific algorithm flow.

[0045] Table 1

[0046]

[0047]

[0048] Furthermore, the vulnerability database construction includes: downloading raw text data from historical vulnerability data sources, segmenting the raw text data according to vulnerability instances, and obtaining several independent vulnerability description texts;

[0049] Each independent vulnerability description text is divided into several vulnerability text blocks by sliding blocks according to a preset length and overlapping window.

[0050] The factory function that encapsulates the HuggingFace BGE embedding model is called to perform vectorization encoding on each vulnerability text block and L2 normalization on the output vector to obtain vulnerability semantic vectors that correspond one-to-one with the corresponding vulnerability text blocks.

[0051] Initialize a FAISS vector database instance, write the vulnerability semantic vector into the FAISS vector database, and establish an external mapping table from the FAISS internal integer index to the vulnerability's unique identifier. Store the external mapping table and the vector index together on the local disk to complete the construction of the vector database.

[0052] Specifically, relevant information needs to be obtained from historical knowledge sources. https: / / github.com / Threekiii / Awesome-POC serves as an important historical vulnerability information repository, providing abundant vulnerability sample data. After acquiring the data, text segmentation technology is used to decompose each vulnerability instance into independent text units, forming basic historical information content. To achieve efficient information retrieval and processing, this embodiment utilizes the Bert BGE embedding model to vectorize the text. Specific details are shown in Table 2.

[0053] Table 2

[0054]

[0055] First, by encapsulating the factory function `load_bge` of `HuggingFace BgeEmbeddings`, the Bert BGenbedding model is loaded at the specified path. Then, the embedding mode for the retrieval task is explicitly triggered with the instruction "Generate a representation for this sentence to retrieve related articles:", while simultaneously performing L2 normalization on the output vector. ,in This is the prompt template; "text" is the user-input text. · This represents the L2 norm, and ⊕ indicates concatenation, used to combine user input text and suggestion templates. This lays the foundation for geometric consistency in subsequent dense retrieval.

[0056] Subsequently, the system takes a local CSV format proof-of-concept knowledge base as input and uses the document loader built into the LangChain framework to parse the file line by line into structured objects. Each record is delimited by the separator "&", with the front-end field carrying the unique PoC identifier and the back-end field carrying the corresponding vulnerability description or exploit script text.

[0057] ;

[0058] The `split(row)` function iterates through each row of the CSV file, splitting it into an ID number and a Content number. The resulting new CSV file contains the processed vulnerability information, consisting only of the text description and the ID number.

[0059] Next, the system calls the `from_documents` interface of the FAISS library to encode the above corpus into high-dimensional dense vectors in batches and build an inverted index, forming a persistent vector database. Simultaneously, by traversing the internal mapping of `faiss_db.index_to_docstore_id`, a mapping table is established from the internal integer index of FAISS to the unique identifier of the PoC, and this mapping is serialized into CSV to achieve externally readable key-value alignment. Finally, if the vector database directory does not exist, it is automatically created, and the `faiss` index file and `id_data.csv` are stored separately, thus completing an offline knowledge distillation and index solidification. The entire process transforms discrete and heterogeneous vulnerability intelligence into a searchable vector set in a unified semantic space without requiring an internet connection.

[0060] Furthermore, fingerprint information scanning includes: performing full port or custom range port detection on the target IP to obtain a list of open ports;

[0061] Perform protocol identification on each open port to obtain the protocol name;

[0062] The URL is constructed based on the protocol, IP address, and port, and a third-party fingerprinting tool is used to extract information about the CMS, middleware, development framework, and front-end library to obtain a structured fingerprint record.

[0063] Specifically, it invokes a concurrent port scanning executable written in Go to perform full port or custom module-wide probing on a specified IP address.

[0064] ;

[0065] in, Indicates the port. This indicates the range of port numbers, from 1 to 65535, which represents all possible ports. This means that it can be started from the smallest port. To the maximum port .

[0066] Extract the list of open ports returned within square brackets using regular expressions This completes asset mapping at the network reachability level. Subsequently, the program takes each pair of "IP and port" as input and calls the service identification component again, using string segmentation and matching techniques to obtain the application layer protocol name (such as http, https, ssh, etc.) running on that port, thus achieving semantic annotation of network services.

[0067] ;

[0068] in, It is the application layer protocol name identified on this port, such as http, https, ssh, etc.

[0069] Based on this, the program follows the "agreement". +IP +port "Construct a complete Uniform Resource Locator" The system then uses third-party tools based on browser characteristics and response fingerprinting to extract multi-dimensional fingerprints from surviving web services, including CMS, middleware, development frameworks, and even front-end libraries. If a target web service is not found or cannot be identified, a default "-" symbol is used as a placeholder to ensure data structure integrity. Finally, all ports, services, URLs (Uniform Resource Locators), and fingerprints are recorded in a dictionary with the port as the primary key, saved in CSV format, and used to generate a structured report.

[0070] Furthermore, cue word construction includes:

[0071] User input queries, serving as the initial trigger for the entire system operation, must also be converted into vector form and normalized using the Bert BGE embedding model. This vectorization process ensures that the user query vector and the text block vectors stored in the system reside in the same semantic vector space. During the similarity measurement phase, the system employs the classic cosine similarity algorithm. This algorithm quantifies the directional similarity of vectors in high-dimensional space by calculating the cosine of the angle between two vectors. The closer the value is to 1, the higher the similarity between the vectors.

[0072] ;

[0073] Among them, v i It is a vulnerability vector in a vector database. j It is a vector derived from user input.

[0074] Specifically, the system performs pairwise calculations between the user query vector and the text block vectors stored in the vector database, comparing their respective vector representations. Then, in this embodiment, a similarity threshold of 0.6 is set as the decision criterion. If the calculated similarity score exceeds this threshold, the current user query is determined to involve content related to the vulnerability. Conversely, if the score is below the threshold, the query is considered unrelated to the vulnerability, and a "not a vulnerability" response is returned.

[0075] ;

[0076] This rigorous similarity calculation and judgment mechanism ensures the accuracy and reliability of the system's classification of user queries, enabling precise identification of vulnerability-related issues and facilitating subsequent processing.

[0077] When a vulnerability with a similarity exceeding 0.6 is found, the system combines the detected vulnerability content with the highest similarity to the original input to form input text with a clear contextual guide, and then calls the large model.

[0078] Furthermore, generating a response includes:

[0079] The final generated hints are input into the LLM (primarily DeepSeek). The system's final response not only includes a direct answer to the user's question but also integrates retrieved vulnerability information, providing a comprehensive summary of the vulnerabilities. It also offers professional suggestions for vulnerability remediation and defense strategies. User input and EduAttackGraph output are recorded and saved to a txt file.

[0080] The present invention achieves the following effects:

[0081] EduAttackGraph is used to identify and monitor vulnerabilities in educational websites. During the model fine-tuning phase, it undergoes targeted training by injecting vulnerability datasets from educational websites, making penetration testing more specifically tailored to these websites. When adapted to the unique technical architecture and business logic characteristics of educational websites, EduAttackGraph significantly improves the targeting and accuracy of penetration tests. By continuously updating its vulnerability knowledge base, EduAttackGraph ensures it can promptly discover and exploit newly emerging vulnerabilities, maintaining its leading position in educational website security. Simultaneously, the system's automated processing capabilities greatly reduce the workload of security operations personnel and improve overall security efficiency.

[0082] This embodiment also proposes a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method.

[0083] This embodiment also proposes a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method.

[0084] This embodiment also proposes an electronic device, including: a memory and a processor; the memory is used to store a program; the processor is used to execute the program to implement the various steps of the method.

[0085] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for assisting in the analysis of educational network penetration vulnerabilities based on retrieval enhancement, characterized in that, Includes the following steps: Build a historical vulnerability knowledge base to obtain a vector database containing vulnerability semantic vectors; The construction of the historical vulnerability knowledge base includes: Download raw text data from historical vulnerability data sources, and segment the raw text data according to vulnerability instances to obtain several independent vulnerability description texts; Each independent vulnerability description text is divided into several vulnerability text blocks by sliding blocks according to a preset length and overlapping window. The factory function that encapsulates the HuggingFace BGE embedding model is called to perform vectorization encoding on each vulnerability text block and L2 normalization on the output vector to obtain vulnerability semantic vectors that correspond one-to-one with the corresponding vulnerability text blocks. Initialize a FAISS vector database instance, write the vulnerability semantic vector into the FAISS vector database, and establish an external mapping table from the FAISS internal integer index to the vulnerability unique identifier. Store the external mapping table and the vector index together on the local disk to complete the construction of the vector database. Perform fingerprint scanning on educational websites to obtain structured fingerprint information containing protocols, ports, URLs, and technology stack tags; The fingerprint scanning of the educational website includes: Perform full port or custom range port detection on the target IP to obtain a list of open ports; Perform protocol identification on each open port to obtain the protocol name; A URL is constructed based on the protocol, IP address, and port, and a third-party fingerprinting tool is used to extract information about the CMS, middleware, development framework, and front-end library to obtain a structured fingerprint record. The protocol identification for each open port includes: Extract the list of open ports using regular expressions; Take each combination of IP address and port number from the list of open ports as input and call the service identification component; The service identification component processes the input using string segmentation and matching techniques to identify the application layer protocol name running on the port. Based on the identified application layer protocol names, the network services corresponding to the ports are semantically labeled; After the structured fingerprint information is vectorized, a similarity search is performed in the vector database to obtain candidate vulnerability texts that match the structured fingerprint information. The candidate vulnerability text is combined with the structured fingerprint information to generate a hint, which is then input into a large language model to obtain vulnerability analysis and remediation suggestions for educational websites.

2. The method according to claim 1, characterized in that, The process of using third-party fingerprinting tools to extract information includes: when the target port does not recognize the web service or the fingerprint is missing, a default symbol is used as a placeholder to ensure the integrity of the fingerprint record fields.

3. The method according to claim 1, characterized in that, The similarity search includes: Fingerprint information is transformed into query vectors using a pre-trained text embedding model; Calculate the cosine similarity between the query vector and the vulnerability semantic vector; If the maximum similarity exceeds the preset threshold, the corresponding vulnerability text is selected as the candidate vulnerability text.

4. The method according to claim 1, characterized in that, The process of combining the candidate vulnerability text with the fingerprint information to generate a prompt includes: using the candidate vulnerability text as context and concatenating it with the structured fingerprint information to form a natural language prompt sequence.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1-4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method according to any one of claims 1-4.

7. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is configured to execute the program to implement the steps of the method as described in any one of claims 1-4.

Images