A method for generating cybersecurity test ranges based on artificial intelligence

Abstract

This invention belongs to the technical field of network security attack and defense simulation, specifically involving an artificial intelligence-based method for generating a network security practical training range. The method includes: using a first intelligent agent to generate a formal language script for the training range that meets the user's scenario requirements; using a compiler to parse the current script and generate a training range constraint file; iteratively correcting the code structure during the parsing process through a self-correction feedback mechanism; using a constraint solver to determine whether the network topology of the training range represented by the constraint file meets known network topology specifications, and generating a corresponding training range model file for constraint files that meet the requirements; otherwise, triggering intelligent agent correction; extracting information about each node involved in the training range from the training range model file to generate coarse-grained and fine-grained scripts; and sequentially using the coarse-grained and fine-grained scripts to generate the network security practical training range. This invention enables the automated construction of training ranges in network attack and defense training platforms.

Description

Technical Field

[0001] This invention belongs to the technical field of network security attack and defense simulation, and more specifically, relates to a method for generating a network security practical test range based on artificial intelligence. Background Technology

[0002] In an era of accelerated global digitalization, cybersecurity has become a crucial cornerstone of national security. Beyond classroom teaching, various cybersecurity resource platforms also undertake the task of cybersecurity education and training. Current cybersecurity training platforms typically employ manual configuration and static scenario construction to provide relatively realistic network environment simulations and support students in conducting attack and defense drills and skills training.

[0003] However, existing technologies suffer from drawbacks such as high reliance on manual labor, high construction costs and long development cycles, and weak timeliness. Therefore, there is a need to research a new type of cybersecurity training platform that can reduce platform construction costs, enable dynamic updates, and make the cybersecurity attack simulation environment more closely resemble real-world cyberattack scenarios, thereby greatly improving the effectiveness of cybersecurity attack and defense simulations. Summary of the Invention

[0004] In view of the above-mentioned defects or improvement needs of existing technologies, this invention provides a method for generating cybersecurity practical training ranges based on artificial intelligence, the purpose of which is to realize the automated construction of training ranges in network attack and defense training platforms.

[0005] To achieve the above objectives, according to one aspect of the present invention, a method for generating a cybersecurity practical training range based on artificial intelligence is provided, comprising:

[0006] S1. Employ the first intelligent agent to generate a target range formal language script that meets the user's scenario requirements;

[0007] S2. Using a compiler, perform lexical and syntactic analysis on the current target range formal language script to generate a target range SMT constraint file. During the analysis process, based on the known resource limitations of the target range deployment platform, if the target range resource requirements corresponding to the script exceed the resource limits or the script contains lexical and syntactic errors, the second intelligent agent corrects the current script and re-inputs it into the compiler. Using an SMT constraint solver, determine whether the target range network topology represented by the target range constraint file meets the known network topology specification requirements. For target range constraint files that meet the requirements, generate the corresponding target range model file. If not, trigger the second intelligent agent to correct the current script, return to execute the analysis operation, and re-optimize the script.

[0008] S3. Extract the hardware attributes of each node involved in the target range from the target range model file and the network topology between the nodes to generate a coarse-grained script that represents the hardware attributes of the node; extract the attributes of the software of each node involved in the target range from the target range model file to generate a fine-grained script that meets the requirements of the target range model file and is syntactically correct through a third-party intelligent agent.

[0009] S4. Deploy the platform at the test range, use coarse-grained scripts for all nodes to generate a test range framework containing all nodes; use fine-grained scripts for each type of node software to configure the software on the node containing that software in the test range framework, thus completing the generation of the cybersecurity practical test range.

[0010] Furthermore, the first intelligent agent includes a scene description intelligent agent, a commander intelligent agent, and a coding intelligent agent;

[0011] The implementation method of generating the target range formal language script using the first intelligent agent is as follows:

[0012] A scenario description agent is employed, and the Chain of Density iterative summary generation algorithm generates attack and defense scenario descriptions that meet the user's scenario requirements through multiple rounds of progressive analysis. In each iteration, based on the needs of the current iteration, the network device entity information and attack behavior characteristics in the user scenario requirements are parsed, the vulnerability exploitation conditions and dependent version information of a specific CVE number are retrieved from the vulnerability knowledge base in the practical case library, and / or, the semantic features and tactical logic of real attack and defense cases are parsed from the network attack and defense case library in the practical case library.

[0013] A commander agent is adopted to recursively decompose the attack and defense scenario description into atomic subtasks to be executed through a hierarchical task decomposition strategy, and the temporal dependencies between atomic subtasks are managed through a directed acyclic graph topology structure.

[0014] Using a coding agent, based on a pre-defined scripting language code guide, a script is generated for each atomic subtask. The scripts corresponding to all atomic subtasks are merged to obtain a target formal language script that meets the user scenario requirements.

[0015] Furthermore, in S1, the target formal language script is a VSDL script, and the compiler is a VSDL compiler.

[0016] Furthermore, both fine-grained and coarse-grained scripts are Infrastructure as Code, and the target range deployment platform is an Infrastructure as a Service platform.

[0017] Furthermore, hardware attributes include operating system and hardware configuration; the attributes of each node software include: software name, software version, software configuration information, and software dependencies.

[0018] Furthermore, the implementation method of using a third-party intelligent agent to generate fine-grained scripts is as follows:

[0019] The first language model is used to generate fine-grained scripts that represent the software attributes of each node. If the script does not meet the requirements of the target range model file and / or has syntax errors, the script is input into the second language model to generate modification suggestions, which are then input into the first language model to regenerate the fine-grained script until the script meets the requirements of the target range model file and is syntactically correct.

[0020] According to another aspect of the present invention, a cybersecurity combat system is provided, wherein the target range is generated by the cybersecurity combat target range generation method described above.

[0021] According to another aspect of the present invention, an electronic device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0022] According to another aspect of the invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is run by a processor, it controls the device where the storage medium is located to perform the steps of the method described above.

[0023] According to another aspect of the invention, a computer program product is provided, comprising a computer program or instructions that, when executed by a processor, implement the steps of the method described above.

[0024] In summary, compared with the prior art, the technical solutions conceived by this invention have the following main advantages:

[0025] 1. This invention automates the process from description to deployment through multiple modular steps, automating the construction of target ranges in a network attack and defense training platform. Specifically, first, it receives user-described scenario requirements in natural language and generates standardized formal language scripts for the target range through a multi-agent collaboration mechanism. In the verification phase, a rigorous "analysis-verification-repair" intelligent automated closed-loop process is employed to ensure script usability. In the deployment phase, the verified model is precisely converted into coarse-grained and fine-grained scripts and deployed on the platform. Infrastructure construction is implemented based on the granular scripts, and Ansible application configuration is implemented based on the fine-grained scripts, achieving complete deployment from underlying resources to the vulnerability environment. This invention achieves fully intelligent and automated target range generation based on intelligent agents, representing a low-time-cost, end-to-end fine-grained target range generation method that provides simulations closer to reality. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating a method for generating a cybersecurity practical training range based on artificial intelligence, as provided in an embodiment of the present invention.

[0027] Figure 2 This is a schematic diagram of a method for generating a cybersecurity practical training range, provided in an embodiment of the present invention.

[0028] Figure 3 This is a schematic diagram of the validity verification and analysis process provided in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0030] Example 1

[0031] A method for generating cybersecurity test ranges based on artificial intelligence, such as... Figure 1 As shown, the process includes steps S1-S4. S1 corresponds to receiving the user's scenario requirements described in natural language and automatically converting them from natural language to domain-specific language. S2 corresponds to the verification module, including syntax analysis and logic verification. S3-S4 correspond to automated deployment. The specific steps are as follows.

[0032] S1. Employ the first intelligent agent to generate a target range formal language script that meets the user's scenario requirements.

[0033] In this embodiment, step S1 achieves automatic conversion from natural language to domain-specific language through an intelligent agent, without relying on manual intervention.

[0034] This can be used as a preferred implementation method, such as Figure 2As shown, the first intelligent agent is configured to include a scene description agent, a commander agent, and a coder agent; the scene description agent is used, through the Chain of Density's iterative summary generation algorithm generates attack and defense scenario descriptions that meet user needs through multiple rounds of progressive analysis. In each iteration, based on the current iteration requirements, it parses network device entity information and attack behavior characteristics from the user scenario requirements; retrieves vulnerability exploitation conditions and dependent version information for specific CVE numbers from the vulnerability knowledge base in the practical case library; and / or parses the semantic features and tactical logic of real attack and defense cases from the network attack and defense case library in the practical case library. A commander agent is employed to recursively decompose the attack and defense scenario description into atomic subtasks to be executed through a hierarchical task decomposition strategy. For example, multi-segment penetration requirements are subdivided into basic units such as subnet architecture construction, node cluster deployment, and vulnerability exploitation paths. A directed acyclic graph topology structure is used to manage the temporal dependencies between atomic subtasks. A coding agent is employed to generate scripts for each subtask based on a pre-defined scripting language code guide. The scripts corresponding to all atomic subtasks are merged to obtain a target range formal language script that meets the user scenario requirements.

[0035] This preferred approach establishes a multi-source knowledge dynamic access mechanism, integrates a vulnerability knowledge base to automatically retrieve vulnerability exploitation conditions and dependent version information for specific CVE numbers, and simultaneously accesses a network attack and defense case library to analyze the semantic features and tactical logic of more than 500 real attack and defense cases in key fields such as finance and energy.

[0036] At the user requirement processing level, the Chain of Density iterative summary generation technology is adopted. Through a five-round progressive analysis process, each round can focus on 3-5 core architectural elements and fully extract seven types of structured sub-task parameters, including hardware resource configuration, network address planning, software service version, and vulnerability impact scope.

[0037] This preferred approach introduces three intelligent agents, each with clearly defined responsibilities and functions. It breaks down the complex task of generating target scripts from natural language into three specialized stages: requirement analysis, task planning, and code generation. In other words, it refines user scenario requirements layer by layer and, in a collaborative manner, ultimately transforms them into a complete process of specific code.

[0038] This ensures the logical rigor and accuracy of the final generated target range formal language script.

[0039] It should be noted that the configuration method of the first intelligent agent described here is only a preferred implementation method and should not be construed as the only limitation of the present invention. In other embodiments of the present invention, other intelligent agent forms can also be selected to generate target range formal language scripts that meet the needs of user scenarios.

[0040] Furthermore, as an extension, the intelligent agent can also incorporate user training capability profiles when generating scripts, creating scripts that meet both the user's scenario requirements and practical abilities. This necessitates prior assessment of user capabilities and optimization of script configuration based on the user profile. This personalized configuration utilizes data mining and natural language processing technologies to accurately extract key information from the assessment report and generate capability profiles in radar chart format, intuitively showcasing students' performance in various aspects of the training scenario. For example, in cybersecurity emergency response training, it clearly presents students' levels in event detection, response speed, and problem-solving abilities. Based on this, feedback can be used to reconstruct the scripts, forming a complete closed-loop system encompassing "semantic description - logical verification - automated deployment."

[0041] S2. Using a compiler, perform lexical and syntactic analysis on the current target range formal language script to generate a target range SMT constraint file. During the analysis, based on the known resource limitations of the target range deployment platform, if the target range resource requirements corresponding to the script exceed the resource limits or the script contains lexical and syntactic errors, the second intelligent agent corrects the current script and then re-inputs it into the compiler. Using an SMT constraint solver, determine whether the target range network topology represented by the target range constraint file meets the known network topology specification requirements. For target range constraint files that meet the requirements, generate the corresponding target range model file. If not, trigger the second intelligent agent to correct the current script, return to execute the analysis operation, and re-optimize the script.

[0042] Step S2 in this embodiment establishes a self-correction feedback mechanism, which is automatically implemented through intelligent agent collaboration to continuously iterate and correct the code structure until it fully conforms to the language specification.

[0043] Regarding the compiler's generation of SMT constraint files for the test range, in practice, the compiler converts memory capacity requirements (i.e., resource limitations of the test range deployment platform) into integer inequality constraints; and maps IP address segment declarations recorded in the test range's formal language script into expressions for consecutive address sets. When using the SMT constraint solver, if the SMT constraint solver detects resource allocation conflicts such as node IP conflicts, it will automatically generate a conflict diagnosis report and trigger a parameter adjustment mechanism, i.e., trigger a second intelligent agent correction script. An exemplary SMT constraint solver can be the Z3 solver.

[0044] As a preferred implementation, in S1, the target formal language script is a VSDL (Chinese name: Virtual Scene Description) script, and in S2, the compiler is a VSDL compiler.

[0045] The professional-grade VSDL compiler implements deep lexical and syntactic analysis, which can accurately mark the location and context of syntax exceptions through specific error tags. This ensures that the process fully covers basic syntactic rules such as keyword spelling verification and statement separator detection, and ensures that the script is compilable.

[0046] S3. Extract the hardware attributes of each node involved in the target range from the target range model file and the network topology between the nodes to generate a coarse-grained script that represents the hardware attributes of the node; extract the attributes of the software of each node involved in the target range from the target range model file to generate a fine-grained script that meets the requirements of the target range model file and is syntactically correct through a third-party intelligent agent.

[0047] Among them, coarse-grained attributes include operating system and hardware configuration; the attributes of each node software include: software name, software version, software configuration information (including the deployment path of the vulnerable application and the service startup order) and software dependencies.

[0048] As a preferred implementation, both fine-grained and coarse-grained scripts are Infrastructure as Code (IaaC), and the target range deployment platform is an IaaC platform. This preferred approach breaks through the limitations of traditional static images, using Ansible scripts for fine-grained scenario control to achieve runtime dynamic application configuration capabilities (or software configuration capabilities) and accurately simulate vulnerability environments. For coarse-grained scenario control, Terraform scripts are used to automatically build the hardware and network infrastructure of the target range nodes without relying on human intervention.

[0049] This step requires precise semantic mapping when extracting information from the target range model file. Then, when generating coarse-grained scripts based on hardware attributes and network topology, specifically, node hardware specification declarations can be converted into cloud platform specific instance types, and network topology definitions can be converted into subnet resource configuration parameters. The cloud platform specific instance types and subnet resource configuration parameters constitute the coarse-grained script. It should be noted that coarse-grained and fine-grained scripts can be processed in parallel to improve efficiency; however, during deployment (i.e., when executing S4), the coarse-grained and fine-grained scripts must be applied sequentially.

[0050] As a preferred implementation method, the fine-grained script generation method using a third-party intelligent agent is as follows:

[0051] The first language model is used to generate fine-grained scripts that represent the software attributes of each node. If the script does not meet the requirements of the target range model file and / or has syntax errors, the script is input into the second language model to generate modification suggestions, which are then input into the first language model to regenerate the fine-grained script until the script meets the requirements of the target range model file and is syntactically correct.

[0052] This preferred approach implements an automatic repair strategy for detected anomalies, including adaptive corrections such as syntax completion and default parameter injection, ensuring automation and accuracy.

[0053] S4. Deploy the platform at the test range, use coarse-grained scripts for all nodes to generate a test range framework containing all nodes; use fine-grained scripts for each type of node software to configure the software on the node containing that software in the test range framework, thus completing the generation of the cybersecurity practical test range.

[0054] This step establishes a sequential workflow mechanism: First, in the coarse-grained script application phase, virtual resources and network architecture are created through declarative commands to achieve a target range framework encompassing all nodes. Second, in the fine-grained script application phase, node reachability verification is performed, and runtime environment configuration, vulnerability component deployment, and service startup operations are carried out sequentially to achieve software configuration. During deployment, an exception handling mechanism is included: automatic rollback is triggered when resource creation conflicts occur, and an intelligent retry process is initiated when application deployment fails. Overall success is ensured through status monitoring.

[0055] To verify the effectiveness of the method in this embodiment, the following analysis method is presented:

[0056] like Figure 3 As shown, a comparative analysis process was designed. This process compares the method of this embodiment (the "CRCG system creation" path shown in the figure) with the traditional "manual creation" method. Both methods take the same "security analysis report" as input, with the goal of generating a VSDL script. Subsequently, the VSDL script undergoes lexical and syntactic parsing, and uses Terraform for network topology design and Ansible for software configuration, ultimately constructing a usable "network scenario".

[0057] The comparative analysis process mainly evaluates from the following three dimensions:

[0058] Time analysis: Evaluate and record the time cost required to generate the range using the method of this embodiment to measure its efficiency.

[0059] Accuracy calculation: After the VSDL script is parsed, its grammatical and lexical accuracy is calculated to compare the quality of automatically generated and manually written scripts.

[0060] Accuracy calculation: After the network scenario is finally generated, the accuracy of its implementation is calculated by comparing the actual configuration of the scenario with the requirements in the original security analysis report.

[0061] Through this series of comparative analyses, the effectiveness of the method in this embodiment in terms of target range generation efficiency, script correctness, and scene restoration accuracy can be fully verified.

[0062] In summary, this embodiment automates the process from description to deployment through multiple modular steps, automating the construction of the target range in the network attack and defense training platform. Specifically, firstly, it receives the user's scenario requirements described in natural language and generates a standardized formal language script for the target range through a multi-agent collaboration mechanism. During the verification phase, a rigorous "analysis-verification-repair" intelligent automated closed-loop process is employed to ensure script usability. In the deployment phase, the verified model is precisely converted into Terraform infrastructure construction scripts and Ansible application configuration scripts, and deployed on the platform, achieving complete deployment from underlying resources to the vulnerability environment. This invention, based on intelligent agents, achieves fully intelligent and automated target range generation, representing a low-time-cost, end-to-end fine-grained target range generation method that provides simulations closer to reality.

[0063] Finally, attack and defense scenarios can be instantiated based on the deployed infrastructure to perform practical tests, including Nmap vulnerability scanning and Metasploit attack verification. At the same time, the entire process operation logs can be collected in real time for effect evaluation or user capability evaluation, thus achieving a closed loop.

[0064] Example 2

[0065] A cybersecurity combat system, wherein the target range is generated by the cybersecurity combat target range generation method described in Embodiment 1 above.

[0066] The relevant technical solutions are the same as above, and will not be repeated here.

[0067] Example 3

[0068] This application also relates to an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0069] The electronic device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The memory can be used to store computer programs and / or modules. The processor performs various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory.

[0070] The relevant technical solutions are the same as above, and will not be repeated here.

[0071] Example 4

[0072] This application also relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0073] Specifically, the memory may include high-speed random access memory, as well as non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart media cards (SMC), secure digital (SD) cards, flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0074] The relevant technical solutions are the same as above, and will not be repeated here.

[0075] Example 5

[0076] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the method described in the above embodiments of this application.

[0077] The relevant technical solutions are the same as above, and will not be repeated here.

[0078] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An artificial intelligence-based network security live-fire range generation method, characterized in that, The method comprises the following steps: S1, a first intelligent agent is used to generate a target field formal language script meeting the user scene requirement; S2, a compiler is used to perform lexical and syntax analysis on the current target field formal language script, and generate a target field SMT constraint file; In the analysis process, based on the known target field deployment platform resource limit, if the script corresponding to the target field resource requirement exceeds the resource limit or the script has lexical and syntax errors, the second intelligent agent is used to modify the current script, and then the compiler is input again; an SMT constraint solver is used to judge whether the target field network topology represented by the target field constraint file meets the known network topology specification requirement, and generate a corresponding target field model file for the target field constraint file meeting the requirement, if not, trigger the second intelligent agent to modify the current script, return to execute the analysis operation, and optimize the script again; S3, the hardware properties of each node involved in the generated target field and the network topology between the nodes are extracted from the target field model file, so as to generate a coarse-grained script representing the hardware properties of the node; The properties of each kind of node software involved in the generated target field are extracted from the target field model file, so as to generate a fine-grained script meeting the requirement of the target field model file and being correct in syntax through the third intelligent agent; S4, on the target field deployment platform, the coarse-grained script of all nodes is used to generate a target field framework containing all nodes; the fine-grained script of each kind of node software is used to perform software configuration on the node where the software is located in the target field framework, and the generation of the network security practical target field is completed.

2. The cyber range generation method of claim 1, wherein, The first intelligent agent comprises a scene description intelligent agent, a commander intelligent agent and a coding intelligent agent; The implementation mode of the first intelligent agent for generating the target field formal language script is as follows: The scene description intelligent agent is used to generate an attack and defense scene description meeting the user scene requirement through the Chain of Density iterative abstract generation algorithm and through multiple rounds of progressive analysis; in each round of iteration, the network equipment entity information and attack behavior characteristics in the user scene requirement are analyzed, the vulnerability exploitation conditions and dependent version information of a specific CVE number are searched in the vulnerability knowledge base of the practical case library, and / or the semantic characteristics and tactical logic of a real attack and defense case are analyzed from the network attack and defense case library of the practical case library; The commander intelligent agent is used to recursively decompose the attack and defense scene description into atomic subtasks to be executed through a hierarchical task decomposition strategy, and manage the time sequence dependency relationship between the atomic subtasks through a directed acyclic graph topology structure; The coding intelligent agent is used to generate a script for each atomic subtask based on the code guide of a preset script language, and combine the scripts corresponding to all atomic subtasks to obtain a target field formal language script meeting the user scene requirement.

3. The cyber range generation method of claim 1 or 2, wherein, In S1, the target field formal language script is a VSDL script, and the compiler is a VSDL compiler.

4. The cyber range generation method of claim 1, wherein, Both the fine-grained script and the coarse-grained script are infrastructure as code, and the target field deployment platform is an infrastructure as a service platform.

5. The cyber range generation method of claim 1, wherein, The hardware properties include an operating system and hardware configuration; and the properties of each kind of node software include a software name, a software version, software configuration information and software dependency.

6. The cyber range generation method of claim 1, wherein, The implementation manner of generating the fine-grained script by the third intelligent agent is: The first large language model is used to generate a fine-grained script representing the properties of each node software. If the script does not meet the requirements of the target model file and / or has syntax errors, the script is input into the second large language model to generate modification suggestions and input into the first large language model to regenerate the fine-grained script until the script meets the requirements of the target model file and is syntax correct.

7. A cyber security live-fire system, comprising: The target is generated by the network security practical target generation method according to any one of claims 1 to 6. 8.An electronic device comprising a memory and a processor, the memory storing a computer program, wherein, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium includes a stored computer program, wherein when the computer program is run by a processor, the device where the storage medium is located is controlled to execute the steps of the method according to any one of claims 1 to 6.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1 to 6.

Images