Network security test case generation method and device, electronic equipment and medium

Abstract

The invention provides a network security test case generation method and device, electronic equipment and a medium, and the method comprises the steps: carrying out the content analysis of a preset threat analysis and risk assessment file, so as to extract corresponding security test information; obtaining a risk processing strategy of a security test item corresponding to the threat analysis and risk assessment file; inputting the security test information and the risk processing strategy into the large language model to obtain a network security test case output by the large language model; the large language model is used for carrying out replacement processing on the security test information according to a preset prompt field template and carrying out knowledge retrieval processing according to a risk processing strategy so as to generate a network security test case corresponding to the threat analysis and risk assessment file, according to the method, the threat analysis and risk assessment file is subjected to natural semantic analysis through the large language model, and the retrieval result is summarized and optimized, so that the quality and coverage of the test case are improved, the test efficiency and accuracy are improved, and the implementation cost is reduced.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method, apparatus, electronic device, and medium for generating network security test cases. Background Technology

[0002] In cybersecurity testing, various testing methodologies are required, one of which is compliance testing as mandated by the standard GB44495-2024. For cybersecurity measures, the correct implementation and ability to address known cybersecurity risks are crucial considerations. Cybersecurity risks originate from the results of early-stage cybersecurity analysis (TARA, Threat Analysis and Risk Assessment) during development. However, for a complex electronic control unit (such as a vehicle's cockpit system), a complete cybersecurity analysis may yield thousands of data points. Each threat analysis may generate multiple test cases. Therefore, balancing the quantity, quality, and coverage of test cases presents a significant challenge for both the testing process and the knowledge base of the personnel. Summary of the Invention

[0003] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to one aspect of this application, a method for generating network security test cases is provided, comprising: The content of the pre-set threat analysis and risk assessment documents is parsed to extract the corresponding security test information; Obtain the risk handling strategies for security testing projects corresponding to threat analysis and risk assessment documents; Security test information and risk handling strategies are input into a pre-defined large language model to obtain network security test cases output by the large language model. The large language model is used to replace security test information according to preset prompt field templates and to perform knowledge retrieval according to risk handling strategies in order to generate network security test cases corresponding to threat analysis and risk assessment documents.

[0004] In one exemplary embodiment of this application, a preset threat analysis and risk assessment document is parsed to extract corresponding security test information, including: Obtain pre-defined threat analysis and risk assessment documents; The content of the threat analysis and risk assessment document is parsed to obtain the types of security tests included in the threat analysis and risk assessment document; Extract the security test information corresponding to each security test type from the threat analysis and risk assessment documents.

[0005] In one exemplary embodiment of this application, after receiving security testing information and risk handling strategies, the large language model performs the following steps: By comparing the types of each prompt field in the security test information and prompt field template, the prompt field template is replaced to obtain the target prompt field; Based on the risk handling strategy, the target prompt fields are parsed to generate cybersecurity test cases corresponding to the threat analysis and risk assessment documents.

[0006] In one exemplary embodiment of this application, a target prompt field is obtained by performing a type comparison on each prompt field in the security test information and prompt field template to replace the prompt field template, including: Obtain the relevant item definitions for each security test information; Retrieve the relevant item definitions for each prompt field in the prompt field template; Iterate through each security test information. If the definition of the relevant item corresponding to any security test information is the same as the definition of the relevant item corresponding to any prompt field in the prompt field template, replace the prompt field in the prompt field template with the security test information to obtain the target prompt field.

[0007] In one exemplary embodiment of this application, the target prompt field is parsed according to a risk handling strategy to generate cybersecurity test cases corresponding to the threat analysis and risk assessment document, including: Based on the risk handling strategy, the target prompt field is parsed to obtain the attack path information and security target information included in the target prompt field; Based on the attack path information, a knowledge retrieval process is performed on the preset network security database to obtain the test communication information of each test stage of the attack path corresponding to the attack path information from the network security database; the network security database stores a number of communication information. Based on preset data processing rules, logical reasoning is performed on test communication information and security target information to generate network security test cases corresponding to threat analysis and risk assessment documents.

[0008] In one exemplary embodiment of this application, the network security database is established according to the following steps: Obtain some raw data information from several preset information sources; According to the preset data cleaning rules, several raw data information are cleaned to obtain processed data information; Based on a preset text segmentation strategy, several processed data information are segmented into blocks to obtain several target data information. Numerical vector transformation is performed on the target data information to obtain the corresponding semantic vector; Several semantic vectors are stored in a pre-defined vector database to obtain a network security database.

[0009] In one exemplary embodiment of this application, several processed data information are segmented into blocks according to a preset text segmentation strategy to obtain several target data information, including: Based on the preset text segmentation strategy, several processed data information are segmented into blocks to obtain several segmented data information. Traverse each block of data information, and add the last preset length of data information in the block of data information preceding the block of data information to the starting position of the block of data information to obtain the target data information corresponding to the block of data information.

[0010] According to another aspect of this application, a network security test case generation apparatus is provided, comprising: The security test information extraction module is used to parse the content of preset threat analysis and risk assessment documents in order to extract the corresponding security test information. The risk handling strategy acquisition module is used to acquire the risk handling strategies for security test projects corresponding to threat analysis and risk assessment documents. The security test case generation module is used to input security test information and risk handling strategies into a preset large language model to obtain network security test cases output by the large language model. The large language model replaces security test information based on preset prompt field templates and performs knowledge retrieval based on risk handling strategies to generate cybersecurity test cases corresponding to threat analysis and risk assessment documents.

[0011] According to another aspect of this application, a non-transitory computer-readable storage medium is provided, wherein at least one instruction or at least one program is stored in the storage medium, the at least one instruction or the at least one program being loaded and executed by a processor to implement the aforementioned network security test case generation method.

[0012] According to another aspect of this application, an electronic device is provided, including a processor and the aforementioned non-transitory computer-readable storage medium.

[0013] The present invention has at least the following beneficial effects: The network security test case generation method of this invention involves parsing threat analysis and risk assessment documents to extract corresponding security test information, obtaining risk handling strategies for security test items corresponding to the threat analysis and risk assessment documents, and inputting the security test information and risk handling strategies into a large language model with pre-stored prompt field templates to obtain network security test cases output by the large language model. The large language model replaces the security test information according to the preset prompt field templates and performs knowledge retrieval processing according to the risk handling strategies to generate network security test cases corresponding to the threat analysis and risk assessment documents. This allows for the use of a large language model to perform natural language analysis on threat analysis and risk assessment documents and to summarize and optimize the retrieval results in the vehicle network security system, thereby improving the quality and coverage of test cases, increasing testing efficiency and accuracy, and reducing implementation costs. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 A flowchart of a network security test case generation method provided in an embodiment of the present invention; Figure 2 A schematic diagram illustrating the collaborative relationship between network security functional test cases, threat analysis, and risk assessment in the vehicle network security system, as provided in this embodiment of the invention. Figure 3 Example diagrams showing the definitions of relevant items for the vehicle control unit provided in embodiments of the present invention; Figure 4 This is a data processing diagram of the network security test case generation method provided in an embodiment of the present invention; Figure 5 This is a block diagram of a network security test case generation device provided in an embodiment of the present invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] This application proposes a method for generating network security test cases, such as... Figure 1As shown, it includes: Step S100: Parse the content of the preset threat analysis and risk assessment document to extract the corresponding security test information; Threat Analysis and Risk Assessment (TARA) documents are the core process of cybersecurity for intelligent connected vehicles. They systematically identify critical assets (such as ECUs (Electronic Control Units), CAN buses, etc.), analyze potential threats (such as OTA (Over-The-Air) hijacking, sensor spoofing, etc.), assess the impact of vulnerabilities, and ultimately quantify the risk level (based on the ISO 21434 standard, a joint automotive cybersecurity standard published by the International Organization for Standardization (ISO) and SAE (Society of Automotive Engineers). ISO 21434 provides a risk management framework for the entire lifecycle (design, development, production, and maintenance). Its core requirements include: Threat Analysis and Risk Assessment (TARA), security requirement definition, vulnerability monitoring and response mechanisms, ensuring that intelligent connected vehicles comply with regulations such as WP.29. Through process-oriented methods (such as supply chain security and penetration testing), it reduces the risk of cyberattacks and is a fundamental specification for automakers to achieve synergy between functional safety (ISO 26262) and cybersecurity. Its output consists of targeted protection strategies covering hardware, communication, and cloud layers, achieving closed-loop management from attack prevention to emergency response. It is a necessary technical means to meet the requirements of regulations such as WP.29. In-vehicle network security is a technical system that protects the electronic systems of intelligent connected vehicles from cyberattacks and data leaks, encompassing ECU protection, in-vehicle communication encryption (such as CAN bus), OTA upgrade authentication, and cloud interface protection. Its core is to build a three-in-one "end-pipe-cloud" defense mechanism to address risks such as remote control hijacking and sensitive data theft, and must comply with international standards such as ISO / SAE 21434. With the increasing intelligence of automobiles, in-vehicle network security has become a fundamental guarantee for intelligent connected vehicles. Therefore, by obtaining threat analysis and risk assessment documents to extract corresponding security test information, functional test cases for network security can be generated.

[0018] Among them, the cybersecurity functional test cases and TARA have a close collaborative relationship in the vehicle cybersecurity system, and the two together constitute a "risk identification-verification closed loop," such as... Figure 2 As shown, its core association and interaction logic is as follows: 1. TARA provides input for network security functional test cases: risk-driven test objective definition, mapping of attack paths to test steps, and risk level guidance for test priority; 2. Network security functional test cases are a means of verifying TARA's risk handling measures to validate their effectiveness. For example, TARA's risk handling decisions (such as "reducing risk: adding TLS encryption to communication") need to be verified through functional testing to confirm their implementation effect. This involves designing test cases to verify TLS handshake protocol verification, certificate validity checks, and other steps to confirm that the encryption mechanism works as expected. It also includes closed-loop feedback to optimize risk assessment. For example, test results (such as discovering encryption implementation vulnerabilities) can be fed back to the TARA process to trigger a risk reassessment. 3. The collaborative model between the two in engineering practice; 4. Differences and Complementarity: The limitation of TARA is that it focuses on theoretical risk analysis and relies on expert experience, which may overlook actual code defects (such as buffer overflows); the limitation of network security functional test cases is that it focuses on the verification of implemented functions and lacks the ability to proactively discover unknown threats; the complementary value between the two is that TARA provides a systemic threat perspective, while network security functional test cases provide technical verification capabilities. Therefore, the combination of the two can cover the entire chain "from risk identification to implementation verification".

[0019] Therefore, by combining network security functional test cases with TARA, the application coverage of network security functional test cases can be improved.

[0020] Furthermore, in step S100, the preset threat analysis and risk assessment document is parsed to extract the corresponding security test information, including steps S110-S130: Step S110: Obtain the preset threat analysis and risk assessment document; Threat Analysis and Risk Assessment (TARA) documents contain basic information about the ECU's functionality, such as asset name and type, threat type, scenario, functional impairment caused by the threat and its severity, possible attack paths and their feasibility, risk scores for the combined severity and feasibility of the impairment, and risk management decisions for the threat (e.g., avoidance, reduction, sharing, and retention). In practical applications, TARA documents are commonly formatted as tables. Table 1 shows an example of a table in a Threat Analysis and Risk Assessment document that records attack paths and security objectives, including attack paths (Attack Path). A Path (ATR) refers to the vulnerability chain and technical steps an attacker takes from the initial intrusion point to achieving their attack goal (such as controlling the ECU or stealing data). This could be represented by actions like penetrating a gateway via in-vehicle Wi-Fi, hijacking the CAN bus, or altering vehicle speed signals. Analysis requires consideration of system architecture (e.g., communication topology), attack surface (open ports / interfaces), and potential attack methods (e.g., man-in-the-middle attacks). In TARA, the attack path is the construction of a threat scenario. A threat is a potential event or behavior that could compromise system security (e.g., hacking, malware), originating from human factors (attackers), environmental defects (vulnerabilities), or unexpected failures. A threat scenario is the specific implementation path of a threat, describing how an attacker exploits vulnerabilities (e.g., injecting malicious code via OTA to hijack the ECU). Its feasibility and impact need to be analyzed in conjunction with the system context (e.g., vehicle operating status). Both are core inputs to TARA, used to quantify risk and develop protective measures (ISO). The core elements of 21434) are used to assess attack feasibility and design defense depth (such as segmented isolation) and security objectives (the core requirements for ensuring system security by protecting assets associated with protection functions and their security attributes, preventing threat scenarios and damage scenarios).

[0021] The threat analysis and risk assessment document can be retrieved using the table API (Application Programming Interface) of pre-defined communication software (such as Lark). This retrieves the JSON-formatted table content and cell row and column numbers, as shown in Table 1 (O5:O5). Simultaneously, it also requires obtaining the organization's access permissions (i.e., the Authorization field) for this threat analysis and risk assessment document. An example of a constructed WebAPI request is shown below:

[0022] The API output, in JSON format, is a threat analysis and risk assessment file. The cell content is as follows:

[0023] The values ​​field contains the attack path description from the TARA analysis. This method allows you to read the attack path description of all threats in the table sequentially. In addition, this method can also be used to read the corresponding threat's score, risk treatment decision, and cybersecurity target number.

[0024] Furthermore, Table 2 provides examples of cybersecurity objectives and cybersecurity specifications. It is possible to programmatically map cybersecurity objective numbers to corresponding descriptive text and submit them as prompts to the large language model. This serves as a reminder to the large language model to focus on verifying security measures targeting that security attribute when generating cybersecurity test cases.

[0025] Step S120: Parse the threat analysis and risk assessment document to obtain the types of security tests included in the threat analysis and risk assessment document; Security test types refer to the test types, such as asset names and threat types, included in the threat analysis and risk assessment documents; that is, the types of projects that require security testing.

[0026] Step S130: Extract the security test information corresponding to each security test type from the threat analysis and risk assessment file.

[0027] Each security test type corresponds to security test information. For example, when the security test type is a threat type, the corresponding security test information is the threat type information included in the threat analysis and risk assessment document.

[0028] Step S200: Obtain the risk handling strategy for the security test project corresponding to the threat analysis and risk assessment documents; A security test project is a project that requires security testing of the vehicle network security system. The risk handling strategy is the rule for handling the security risks corresponding to the security test project, which can be developed by developers through programming based on the specific security test project.

[0029] Step S300: Input the security test information and risk handling strategy into the preset large language model to obtain the network security test cases output by the large language model; The large language model is used to replace security test information according to preset prompt field templates and to perform knowledge retrieval according to risk handling strategies in order to generate network security test cases corresponding to threat analysis and risk assessment documents.

[0030] Since this application uses the Big Prophecy model to generate cybersecurity test cases, it is necessary to define the role of the Big Prophecy model through system prompt words. At the same time, different security test projects have different system-related item definitions (ItemDefinition, which is the first step in ISO 21434 cybersecurity development, used to clarify the functional boundaries, component composition and interaction relationships of the system to be evaluated (such as vehicle network architecture, ECU function list), and its core outputs include: system-level technical description (hardware / software interface), asset list (such as T-Box, OTA module), and operating scenario (communication protocol, external dependency), providing a baseline for subsequent threat analysis (TARA) and ensuring that risk assessment covers all elements). Therefore, it is necessary to adopt the form of prompt field template (i.e. prompt word template) to increase the reusability of system prompt words.

[0031] One embodiment of the prompt field template in this application is a prompt word template based on langchain (a programming framework for a large oracle model). It allows for the programmatic replacement of variables within the large oracle model and reuse in different security testing projects. Here, variables refer to system-related item definition diagrams drawn using pre-defined communication software (such as Lark), containing key information such as the ECU's physical interface, communication bus, peripherals, main chip, operating system, and software components. This descriptive information can be read through the communication software's API and used to replace the corresponding content in the prompt field template. An example is given below:

[0032] like Figure 3 Here is an example diagram defining a related item of the given vehicle control unit. The elements and text descriptions therein can be read through the API of the communication software. The read information is used to replace the content in {} in the above prompt field template example. The process is illustrated below:

[0033] Specifically, after receiving security test information and risk handling strategies, the large language model executes steps S310-S320: Step S310: Based on the type comparison of each prompt field in the security test information and prompt field template, the prompt field template is replaced to obtain the target prompt field; Further, in step S310, the prompt field template is replaced by comparing the type of each prompt field in the security test information and the prompt field template to obtain the target prompt field, including steps S311-S313: Step S311: Obtain the relevant item definitions corresponding to each security test information; Step S312: Obtain the relevant item definition for each prompt field in the prompt field template; Step S313: Traverse each security test information. If the definition of the relevant item corresponding to any security test information is the same as the definition of the relevant item corresponding to any prompt field in the prompt field template, replace the prompt field in the prompt field template with the security test information to obtain the target prompt field.

[0034] Step S320: Based on the risk handling strategy, parse the target prompt field to generate network security test cases corresponding to the threat analysis and risk assessment documents; Furthermore, in step S320, according to the risk handling strategy, the target prompt field is parsed to generate cybersecurity test cases corresponding to the threat analysis and risk assessment documents, including steps S321-S323: Step S321: According to the risk handling strategy, parse the target prompt field to obtain the attack path information and security target information included in the target prompt field; Step S322: Based on the attack path information, perform knowledge retrieval processing on the preset network security database to obtain the test communication information of each test stage of the attack path corresponding to the attack path information from the network security database. Step S323: Based on the preset data processing rules, perform logical reasoning on the test communication information and security target information to generate network security test cases corresponding to the threat analysis and risk assessment documents.

[0035] One feasible implementation is proposed, which designs the following target prompt field to generate prompt words (i.e., prompt field) for risk items whose risk handling strategy is to reduce risk:

[0036] The following example procedure can be used to replace the variables in the target hint field with the actual attack path for different attack paths:

[0037] By combining a cybersecurity database with a large language model, the following steps are used to generate cybersecurity test cases:

[0038] Network security test cases generated using large language models can be imported into online documentation via the API of communication software for management and implementation by testers. An example process is as follows:

[0039] Because a large amount of private data exists during project development, such as product-related item definitions, network security specifications, communication matrices, communication protocols, and test cases from previous projects, this private data is usually not included in the training data of the large language model. At the same time, this data also poses information security issues and cannot be used outside the organization. Therefore, building a local knowledge base has become an important means to solve the problems of poor timeliness of knowledge, insufficient domain knowledge, and model illusion. This application solves the above-mentioned problems by establishing a network security database, which is a local knowledge base. The network security database stores a number of communication information for the large language model to retrieve and call.

[0040] The cybersecurity database is established based on RAG (Retrieval-augmented Generation) technology. Specifically, the cybersecurity database is established according to steps S3221-S3225: Step S3221: Obtain several raw data information from several preset information sources; Raw data information is obtained from various sources, such as system requirement documents for vehicle ECUs, communication matrix tables, in-vehicle network communication protocols (e.g., Ethernet, CAN, LIN), and inter-chip communication protocols (UART, SPI, I2C). The documents containing the raw data information can be in formats such as PDF, Word, Excel, TXT, and Lark Cloud documents. The method for extracting the content from these documents depends on the document format. Based on the Python language, the document loader in langchain is used to load raw data information in different formats such as PDF, Word, Excel, TXT, or Lark Cloud documents.

[0041] Step S3222: According to the preset data cleaning rules, perform data cleaning on several raw data information to obtain processed data information; After obtaining the raw data, the raw data is cleaned to remove irrelevant content from the document, such as headers, footers, duplicate text, and encoding errors.

[0042] Step S3223: According to the preset text segmentation strategy, the processed data information is segmented into blocks to obtain several target data information. In step S3223, according to a preset text segmentation strategy, several processed data information are segmented into blocks to obtain several target data information, including steps S32231-S32232: Step S32231: According to the preset text segmentation strategy, the processed data information is segmented into blocks to obtain several segmented data information. Text segmentation strategies are segmentation rules defined by developers, such as rules for segmenting based on a specified length (e.g., 500 characters), based on lines, or based on paragraphs.

[0043] Step S32232: Traverse each block of data information, and add the last preset length of data information in the block of data information preceding the block of data information to the starting position of the block of data information to obtain the target data information corresponding to the block of data information.

[0044] In addition, to avoid semantic errors caused by segmentation, an overlap length (i.e., a preset length) is set, meaning that each target data information includes part of the content of its predecessor (e.g., 50 words), in order to avoid misunderstandings in the large language model due to missing context.

[0045] Step S3224: Perform numerical vector transformation on the target data information to obtain the corresponding semantic vector; Numerical vector transformation processing can use tools such as HuggingFace, Ollama, and OpenAI to create corresponding semantic vectors (i.e., embedding vectors) based on the target data information after data cleaning and block segmentation.

[0046] Step S3225: Store several semantic vectors in a preset vector database to obtain a network security database.

[0047] After obtaining the semantic vectors, a dedicated vector database (such as FAISS, Milvus, Pinecone, etc.) is used to store the generated semantic vectors in the vector database for later use, in order to obtain a network security database.

[0048] When the network security test case generation method of this application is applied to a vehicle cockpit safety testing system, such as Figure 4As shown, the TARA report file of the vehicle cockpit safety test system is first obtained through the API interface of the communication software, and the security test information (including security asset content (security assets refer to any valuable data, systems, devices or services that need to be protected in a cybersecurity environment, such as vehicle ECUs, keys, user privacy data, communication buses (CAN), etc., whose core characteristics are confidentiality, integrity or availability requirements, and which may lead to functional failure, data leakage or personal injury if attacked), threat type, attack path, risk handling strategy, etc.) is read. Based on each piece of security test information, a corresponding prompt field is generated. This prompt field replaces the sample prompt field in the prompt field template to obtain the target prompt field. The target prompt field is then input into the large language model. The system analyzes attack path and security target information from security test data. For each test stage in the attack path, it retrieves corresponding communication information (such as IP address, network port, and communication protocol) from the local knowledge base (i.e., network security database). Combined with the security attributes corresponding to the security target information, it generates network security test cases. The network security test cases output by the large language model are stored in cloud documents for testers to use. Since the documents read by the communication software have access control capabilities, access to these documents is only possible through API authorization. This effectively ensures the compliance and security of the documents and effectively solves the problem of insufficient security verification experience in enterprises. It avoids over-reliance on the personal abilities and experience of network security test engineers, which could lead to the risk of ECUs failing to achieve security objectives.

[0049] In addition, such as Figure 5 As shown, this application also proposes a network security test case generation device 100, which specifically includes: The security test information extraction module 110 is used to parse the content of the preset threat analysis and risk assessment documents in order to extract the corresponding security test information. The security test information extraction module 110 obtains a preset threat analysis and risk assessment file, parses the content of the threat analysis and risk assessment file to obtain the security test types included in the threat analysis and risk assessment file, and extracts the security test information corresponding to each security test type from the threat analysis and risk assessment file.

[0050] The risk handling strategy acquisition module 120 is used to acquire the risk handling strategy of the security test project corresponding to the threat analysis and risk assessment documents. The security test case generation module 130 is used to input security test information and risk handling strategies into a preset large language model to obtain network security test cases output by the large language model. The large language model is used to replace security test information according to preset prompt field templates and to perform knowledge retrieval processing according to risk handling strategies to generate network security test cases corresponding to threat analysis and risk assessment documents. After receiving security test information and risk handling strategies, the large language model first obtains the relevant item definitions corresponding to each security test information and the relevant item definitions corresponding to each prompt field in the prompt field template. Then, it traverses each security test information. If the relevant item definition corresponding to any security test information is the same as the relevant item definition corresponding to any prompt field in the prompt field template, the prompt field in the prompt field template is replaced with the security test information to obtain the target prompt field. Subsequently, according to the risk handling strategy, the target prompt field is parsed to obtain the attack path information and security target information included in the target prompt field. Then, according to the attack path information, knowledge retrieval processing is performed on the preset network security database to obtain the test communication information of each test stage of the attack path corresponding to the attack path information. Finally, according to preset data processing rules, logical reasoning is performed on the test communication information and security target information to generate network security test cases corresponding to threat analysis and risk assessment documents.

[0051] The network security database stores a number of communication information. The establishment process of the network security database is as follows: First, some raw data information is obtained from several preset information sources. Then, according to preset data cleaning rules, the raw data information is cleaned to obtain processed data information. According to a preset text segmentation strategy, the processed data information is segmented into blocks to obtain several block-based data information. Next, each block-based data information is traversed, and the last preset length of data information in the block-based data information preceding the block-based data information is added to the beginning position of the block-based data information to obtain the target data information corresponding to the block-based data information. Then, the target data information is subjected to numerical vector transformation processing to obtain the corresponding semantic vector. Finally, several semantic vectors are stored in a preset vector database to obtain the network security database.

[0052] The network security test case generation method of this invention involves parsing threat analysis and risk assessment documents to extract corresponding security test information, obtaining risk handling strategies for security test items corresponding to the threat analysis and risk assessment documents, and inputting the security test information and risk handling strategies into a large language model with pre-stored prompt field templates to obtain network security test cases output by the large language model. The large language model replaces the security test information according to the preset prompt field templates and performs knowledge retrieval processing according to the risk handling strategies to generate network security test cases corresponding to the threat analysis and risk assessment documents. This allows for the use of a large language model to perform natural language analysis on threat analysis and risk assessment documents and to summarize and optimize the retrieval results in the vehicle network security system, thereby improving the quality and coverage of network security test cases, increasing testing efficiency and accuracy, and reducing implementation costs.

[0053] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0054] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0055] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0056] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0057] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0058] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0059] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0060] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0061] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0062] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0063] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0064] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.

[0065] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0066] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0067] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0068] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0069] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0070] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0071] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0072] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0073] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for generating network security test cases, characterized in that, include: The content of the pre-set threat analysis and risk assessment documents is parsed to extract the corresponding security test information; Obtain the risk handling strategy for the security test project corresponding to the threat analysis and risk assessment document; The security test information and the risk handling strategy are input into a preset large language model to obtain the network security test cases output by the large language model. The large language model is used to replace the security test information according to the preset prompt field template, and to perform knowledge retrieval processing according to the risk handling strategy, so as to generate network security test cases corresponding to the threat analysis and risk assessment documents.

2. The method according to claim 1, characterized in that, The process of parsing the preset threat analysis and risk assessment documents to extract corresponding security test information includes: Obtain pre-defined threat analysis and risk assessment documents; The threat analysis and risk assessment document is parsed to obtain the types of security tests included in the document. From the threat analysis and risk assessment file, extract the security test information corresponding to each of the security test types.

3. The method according to claim 1 or 2, characterized in that, After receiving the security test information and the risk handling strategy, the large language model performs the following steps: The target prompt field is obtained by comparing the type of each prompt field in the security test information and the prompt field template, and then replacing the prompt field template. Based on the risk handling strategy, the target prompt field is parsed to generate network security test cases corresponding to the threat analysis and risk assessment document.

4. The method according to claim 3, characterized in that, The step involves comparing the type of each prompt field in the security test information and the prompt field template to replace the prompt field template, thereby obtaining the target prompt field, including: Obtain the relevant item definitions corresponding to each of the aforementioned security test information; Obtain the definition of the relevant item corresponding to each prompt field in the prompt field template; Iterate through each security test information. If the definition of the relevant item corresponding to any security test information is the same as the definition of the relevant item corresponding to any prompt field in the prompt field template, replace the prompt field in the prompt field template with the security test information to obtain the target prompt field.

5. The method according to claim 3, characterized in that, The step of parsing the target prompt field according to the risk handling strategy to generate cybersecurity test cases corresponding to the threat analysis and risk assessment document includes: According to the risk handling strategy, the target prompt field is parsed to obtain the attack path information and security target information included in the target prompt field; Based on the attack path information, a knowledge retrieval process is performed on a preset network security database to obtain test communication information for each test stage of the attack path corresponding to the attack path information from the network security database; the network security database stores a number of communication information. Based on preset data processing rules, logical reasoning is performed on the test communication information and the security target information to generate network security test cases corresponding to the threat analysis and risk assessment documents.

6. The method according to claim 5, characterized in that, The network security database is established according to the following steps: Obtain some raw data information from several preset information sources; According to preset data cleaning rules, the original data information is cleaned to obtain processed data information. According to the preset text segmentation strategy, the processed data information is segmented into blocks to obtain several target data information. The target data information is subjected to numerical vector transformation processing to obtain the corresponding semantic vector; Several semantic vectors are stored in a preset vector database to obtain a network security database.

7. The method according to claim 6, characterized in that, The step involves dividing the processed data into blocks according to a preset text segmentation strategy to obtain several target data pieces, including: According to the preset text segmentation strategy, the processed data information is segmented into blocks to obtain several segmented data information. Traverse each segmented data information, and add the last preset length of data information in the segmented data information preceding the segmented data information to the starting position of the segmented data information to obtain the target data information corresponding to the segmented data information.

8. A network security test case generation device, characterized in that, include: The security test information extraction module is used to parse the content of preset threat analysis and risk assessment documents in order to extract the corresponding security test information. The risk handling strategy acquisition module is used to acquire the risk handling strategies for security test projects corresponding to threat analysis and risk assessment documents. The security test case generation module is used to input security test information and risk handling strategies into a preset large language model to obtain network security test cases output by the large language model. The large language model is used to replace security test information according to preset prompt field templates and to perform knowledge retrieval according to risk handling strategies in order to generate network security test cases corresponding to threat analysis and risk assessment documents.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program segment, characterized in that the at least one instruction or the at least one program segment is loaded and executed by a processor to implement the method as described in any one of claims 1-7.

10. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium as described in claim 9.

Images