Attack and defense scene automatic generation method and device based on large model and medium

Abstract

The invention provides an attack and defense scene automatic generation method and device based on a large model and a medium. The method comprises the steps that an attack and defense target range RAG knowledge base is constructed; on the basis of an input scene instruction, basic scene data are generated through the large model in combination with an attack and defense range RAG knowledge base; refining and verifying the basic scene data to generate required scene data; and instantiating the attack and defense scene based on the scene data. According to the method, the attack and defense scene generation efficiency can be remarkably improved, and the artificial scene design and deployment process originally needing several hours or even several days is shortened to several minutes.

Description

Technical Field

[0001] This invention relates to the fields of cybersecurity, artificial intelligence, and attack and defense exercises, and in particular to a method, device, and medium for automatically generating attack and defense scenarios based on large models. Background Technology

[0002] Currently, cyberspace offense and defense are evolving at an unprecedented pace, with new threats emerging constantly. As a key means of improving defense capabilities, the importance of cyber attack and defense drills is increasingly prominent. The efficiency and quality of generating attack and defense scenarios, which form the foundation of these drills, significantly impact their effectiveness. However, the current process of constructing cyber attack and defense scenarios heavily relies on the manual design and configuration of experienced network and security experts. This is not only time-consuming and labor-intensive but also difficult to customize and deploy quickly and on a large scale according to needs, resulting in low efficiency and high costs. Furthermore, scenario construction based on expert experience struggles to fully simulate the complex, ever-changing, and evolving real-world network environment and threats. Therefore, there is an urgent need for an innovative technology that can automatically generate diverse, highly realistic, and operational cyber adversarial scenarios from high-level, fuzzy natural language instructions, thereby significantly improving the efficiency and practical value of cybersecurity drills.

[0003] The powerful generative capabilities, natural language understanding and interaction capabilities, and retrieval enhancement capabilities of large models, combined with the ability of intelligent agents to call tools, provide the possibility for the automated generation of attack and defense exercise scenarios. However, the context length, illusions, and other issues of large models lead to disordered scenario data structures and data errors that prevent instantiation, which urgently need to be addressed. Summary of the Invention

[0004] This application provides a method, device, and medium for automatically generating attack and defense scenarios based on large models, in order to solve the problems in the background art.

[0005] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0006] According to a first aspect of the embodiments of this application, a method for automatically generating attack and defense scenarios based on a large model is provided, including: Construct a RAG knowledge base for offensive and defensive test ranges; Based on the input natural language scene instructions, basic scene data is generated by combining a large model with the RAG knowledge base of the attack and defense range; Refine and verify the basic scene data to generate the required scene data; Instantiation of attack and defense scenarios is completed based on scenario data.

[0007] According to one embodiment of this application, the attack and defense range RAG knowledge base includes vectorized data of targets, traffic, behavior, and topology of the construction platform.

[0008] According to one embodiment of this application, basic scenario data is generated by combining a large model with the RAG knowledge base of the attack and defense range, specifically including: Receive natural language scene instructions from users through a large model; The natural language scene instructions are converted into structured, coarse-grained basic scene data by combining a knowledge base; the basic scene data includes the basic elements of the network scene, service types, and preset vulnerabilities.

[0009] According to one embodiment of this application, when generating basic scene data, if the user provides specific instructions, the scene data is generated strictly according to the user's instructions; if the user provides ambiguous instructions, the scene data is generated based on the trusted data base provided by RAG and by leveraging the creative output characteristics of the large model to generate scene data that is beyond cognition, more challenging, and controllable. According to one embodiment of this application, refining the basic scene data includes: The basic scenario data was supplemented and completed according to the data format requirements of the target platform.

[0010] According to one embodiment of this application, the verification process includes: The platform calls the interface to perform actual construction process and deep rule verification on the basic scene data generated by the large model, and feeds back the verification results to the large model for correction, ultimately generating complete, accurate and runnable scene data; the scene data includes topology and configuration data.

[0011] According to one embodiment of this application, the actual construction process verification includes node instantiation, network connectivity, service availability, and vulnerability exploitability; deep rule verification includes checking route reachability, access control list conflict service dependencies, and resource quotas.

[0012] According to one embodiment of this application, the instantiation of the attack and defense scenario based on scenario data specifically includes: The system calls the interface of the scenario building platform to instantiate the attack and defense scenario based on the scenario data, generating a runtime environment for attack and defense drills. At the same time, based on the feedback from the scenario building platform, it performs dynamic error correction and optimization operations on the scenario data.

[0013] According to a second aspect of this application, an electronic device is provided, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method described in any of the first aspects.

[0014] According to a third aspect of this application, a computer-readable storage medium is provided for storing instructions that, when executed, cause the method described in the first aspect to be implemented.

[0015] Compared with existing technologies, the beneficial effects of adopting the above technical solution are as follows: 1. This invention realizes an end-to-end automated process, from the user inputting high-level intent through natural language, to generating basic scenario data through a large model, then refining and verifying the technology, and finally automatically instantiating the scenario, which significantly improves the efficiency of attack and defense scenario generation and shortens the original manual scenario design and deployment process that takes hours or even days to minutes.

[0016] 2. This invention simplifies the complex process of scene design and configuration by using a unified natural language interface, significantly lowers the technical threshold for building attack and defense scenarios, reduces the dependence on experts, and enables ordinary people to generate high-quality attack and defense scenarios.

[0017] 3. This invention combines RAG with the generative capabilities of large models. Through the RAG mechanism, it ensures that the system can acquire reliable key technology data from external knowledge sources, overcoming the illusion of large models. It also ensures the generativeability and accuracy of scenarios through iterative verification and optimization. Simultaneously, it leverages the "illusion" characteristic of large models, transforming this "illusion" into an advantage to generate more challenging offensive and defensive scenarios that transcend traditional understanding. This allows exercises to move beyond known scenarios and attack patterns, thus more effectively training defenders to cope with new scenarios and threats.

[0018] 4. This invention adopts a phased data generation method, which effectively solves the limitation of the large model context length on the scale of network scene generation and avoids the problem of construction failure caused by context truncation when generating large scenes. Attached Figure Description

[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0020] Figure 1This is a flowchart of the automated generation method for attack and defense scenarios based on a large model, according to an embodiment of this application.

[0021] Figure 2 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0022] The embodiments of this application are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar modules or modules having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. Rather, the embodiments of this application include all variations, modifications, and equivalents falling within the spirit and scope of the appended claims.

[0023] The problems of context length and illusion in large models, leading to disordered scene data structures and data errors that prevent instantiation, urgently need to be addressed. This application proposes an automated method for generating attack and defense scenarios based on large models. It combines the natural language understanding and content generation capabilities of large models, the knowledge expansion capabilities of RAG (Real-Agent Framework), and the tool invocation capabilities of intelligent agents to form an automated workflow from "coarse-grained intent" to "instantiable topological data" and then to "scene instantiation." Please refer to... Figure 1 The specific steps are as follows: S101. Construct the RAG knowledge base for attack and defense test ranges.

[0024] Before constructing the attack and defense scenario, this embodiment first quantifies the data such as targets, topology relationships, traffic, and behavior in the attack and defense range, and constructs an attack and defense RAG knowledge base for generating scenario data for large models.

[0025] S102. Based on the input natural language scene instructions, basic scene data is generated by combining a large model with the RAG knowledge base of the attack and defense test range.

[0026] In practical use, users provide scene instructions in natural language form. The large model receives and parses these instructions, then combines them with the constructed attack and defense range RAG knowledge base to transform high-level, ambiguous scene instructions into structured, coarse-grained basic scene data. If the user provides specific instructions, the model strictly follows these instructions to assist in scene generation. If the user only provides ambiguous instructions, the model leverages the trusted data foundation provided by RAG and the creative output characteristics of the large model to extend creative ideas, generating scenes that are more challenging and controllable, exceeding common understanding. In this embodiment, when generating basic scene data, data-level conflict verification is performed simultaneously, including comprehensive conflict detection such as node uniqueness, IP / subnet conflicts, port services, and topology consistency. Automatic correction is then performed through LLM to ensure the source data is error-free. This verification step significantly reduces the failure rate of subsequent construction. By combining the trusted knowledge foundation provided by RAG with the creative output of LLM, and by platform verification or rule-based filtering at each iteration stage, diversity is preserved while ensuring the technical feasibility of the scenes. This "creative control-verification filtering" model transforms the illusion of LLM into innovative resources.

[0027] By using a unified natural language interface for large models, the complex process of scene design and configuration is simplified, significantly reducing the technical threshold for building attack and defense scenarios and decreasing the reliance on experts. Ordinary people can generate high-quality attack and defense scenarios.

[0028] In this embodiment, the basic scenario data includes information such as basic elements of the network scenario (e.g., nodes, links), service types, and preset vulnerabilities.

[0029] S103. Refine and verify the basic scene data to generate the required scene data.

[0030] To correct the illusions that large models may create, this embodiment supplements the data according to the data format requirements of the target construction platform, ensuring that the data structure and type conform to the platform's requirements. Then, the construction platform interface is called to verify the actual construction process and deep rule verification of the data generated by the large model, and the results are fed back to the large model for iterative correction. Ultimately, the coarse-grained basic data is refined into complete, accurate, and executable topology and configuration data, achieving dual assurance of scenario executability and forming an engineering solution to combat the LLM illusion. Specifically, the actual construction process verification includes node instantiation, network connectivity, service availability, and vulnerability exploitability, while the deep rule verification includes routing reachability, ACL conflicts, service dependencies, and resource quotas.

[0031] By refining and verifying the basic scenario data, the logical correctness and technical feasibility of the generated data can be effectively guaranteed. S104. Instantiate the attack and defense scenario based on the scenario data.

[0032] Finally, based on the refined and verified scenario data, the interface of the scenario building platform (such as a network range platform) is invoked to instantiate the attack and defense scenario, ultimately generating a runtime environment that can be used for attack and defense drills. In practical applications, dynamic error correction and optimization operations can be further performed on the scenario data based on feedback from the scenario building platform.

[0033] The proposed automated attack and defense scenario generation method based on a large model in this embodiment employs an end-to-end closed-loop workflow. This workflow begins with the user inputting high-level intent via natural language, followed by the generation of basic scenario data by the large model, then refinement and technical verification by a constructed intelligent agent, and finally, automatic scenario instantiation. It encompasses multi-stage iterative feedback and real-world environment construction and verification, filling the gap in existing technologies that lack a closed-loop automated process. This significantly improves the efficiency of attack and defense scenario generation, reducing the manual scenario design and deployment process, which previously required hours or even days, to minutes.

[0034] Based on the same technical concept, this application also provides an electronic device that can implement the automated generation method, device, and media process for attack and defense scenarios based on large models provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 2 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 2 The example used is the connection between the processor and memory via a bus. The bus... Figure 2 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 2 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0035] In this embodiment of the invention, the memory stores instructions executable by at least one processor. By executing the instructions stored in the memory, the at least one processor can execute the previously described method, device, and medium for automatically generating attack and defense scenarios based on a large model. The processor can implement... Figure 2 The functions of each module in the device shown.

[0036] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0037] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0038] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable array, or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method, device, and medium for automatically generating attack and defense scenarios based on a large model disclosed in the embodiments of this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0039] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0040] By designing and programming the processor, the code corresponding to the automated generation method, device, and medium for large-model-based attack and defense scenarios described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the methods described in the foregoing embodiments during runtime. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0041] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions, which, when executed on a computer, cause the computer to execute the aforementioned method, device, and medium for automatically generating attack and defense scenarios based on a large model.

[0042] In some alternative embodiments, the present invention also provides a method, device, and medium for automatically generating attack and defense scenarios based on a large model, which can also be implemented in the form of a program product, including program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in the method, device, and medium for automatically generating attack and defense scenarios based on a large model according to various exemplary embodiments of the present invention as described in this specification.

[0043] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0044] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0045] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0046] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0047] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0048] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0049] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0050] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for automatically generating attack and defense scenarios based on a large model, characterized in that, include: Construct a RAG knowledge base for offensive and defensive test ranges; Based on the input natural language scene instructions, basic scene data is generated by combining a large model with the RAG knowledge base of the attack and defense range; Refine and verify the basic scene data to generate the required scene data; Instantiation of attack and defense scenarios is completed based on scenario data.

2. The method for automatically generating attack and defense scenarios based on a large model according to claim 1, characterized in that, The RAG knowledge base of the attack and defense range includes vectorized data on the targets, traffic, behavior, and topology of the platform.

3. The method for automatically generating attack and defense scenarios based on a large model according to claim 1 or 2, characterized in that, Basic scenario data is generated by combining a large model with the RAG knowledge base of the attack and defense test range, specifically including: Receive natural language scene instructions from users through a large model; The natural language scene instructions are converted into structured, coarse-grained basic scene data by combining a knowledge base; the basic scene data includes the basic elements of the network scene, service types, and preset vulnerabilities.

4. The method for automatically generating attack and defense scenarios based on a large model according to claim 3, characterized in that, When generating basic scene data, if the user gives specific instructions, the scene data is generated strictly according to the user's instructions; if the user gives vague instructions, the scene data is generated based on the trusted data base provided by RAG and with the help of the creative output characteristics of the large model to generate scene data that is beyond cognition, more challenging, and controllable.

5. The method for automatically generating attack and defense scenarios based on a large model according to claim 1, characterized in that, Refining the basic scenario data includes: The basic scenario data was supplemented and completed according to the data format requirements of the target platform.

6. The method for automatically generating attack and defense scenarios based on a large model according to claim 5, characterized in that, The verification process includes: The platform calls the interface to perform actual construction process and deep rule verification on the basic scene data generated by the large model, and feeds back the verification results to the large model for correction, ultimately generating complete, accurate and runnable scene data; the scene data includes topology and configuration data.

7. The method for automatically generating attack and defense scenarios based on a large model according to claim 6, characterized in that, The actual construction process verification includes node instantiation, network connectivity, service availability, and vulnerability exploitability; deep rule verification includes checking route reachability, access control list conflict service dependencies, and resource quotas.

8. The method for automatically generating attack and defense scenarios based on a large model according to claim 1, characterized in that, The instantiation of the attack and defense scenario based on scenario data specifically includes: The system calls the interface of the scenario building platform to instantiate the attack and defense scenario based on the scenario data, generating a runtime environment for attack and defense drills. At the same time, based on the feedback from the scenario building platform, it performs dynamic error correction and optimization operations on the scenario data.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-8 to be implemented.

Images