Rule testing method and device, electronic equipment, storage medium and computer program
By generating diverse test samples using a large language model, the problem of low testing efficiency of existing attack rules is solved, thereby improving the security and testing coverage of network protection systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-02-02
- Publication Date
- 2026-04-10
AI Technical Summary
Existing attack rule testing relies on manual writing and maintenance, resulting in low testing efficiency, limited coverage, and difficulty in adapting to rapidly changing network attack methods, thus affecting network protection effectiveness.
The Large Language Model (LLM) is used to generate test samples for attack rules targeting multiple targets. By obtaining specification information, a diverse set of test samples is generated, including normal, boundary, and anomalous samples, covering more test scenarios.
It improves the randomness and coverage of test samples, discovers system logic defects, and enhances the security and testing efficiency of network protection systems.
Smart Images
Figure CN121841828A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present disclosure relates to the field of rule testing, and particularly relates to a rule testing method and device, electronic equipment, storage medium and computer program. BACKGROUND
[0002] In a network security protection system, the effectiveness of attack detection rules directly determines the interception ability of security devices such as intrusion detection systems, firewalls, and Web application protection for different types of attacks.
[0003] However, the current attack test relies on the number of test samples, which relies on the accumulation and collection of staff, resulting in low test efficiency, limited coverage, and difficulty in adapting to rapidly changing network attack methods, thereby leading to poor network protection effect and affecting system security. SUMMARY
[0004] The present disclosure is proposed in view of the above problems. The present disclosure provides a rule testing method, device, electronic equipment, storage medium and computer program.
[0005] In a first aspect, the present disclosure provides a rule testing method, the method comprising: obtaining a test rule set; the test rule set comprising specification information of a target attack rule; generating a first sample set based on the specification information using a sample generation model; the sample generation model is a large language model (LLM); the first sample set comprises at least one test sample; performing rule testing on a system to be tested using the first sample set.
[0006] In one embodiment of the first aspect, the method further comprises: the specification information comprises at least one of the following: boundary conditions, abnormal situations, byte position requirements, application scenario information, and structure information.
[0007] In one embodiment of the first aspect, the method further comprises: generating a plurality of test samples using the sample generation model based on the test results of the test samples in the first sample set on the system to be tested and the test rule set, to obtain a second sample set.
[0008] In one embodiment of the first aspect, the method further comprises: converting the first sample set using the LLM to obtain a third sample set; the conversion processing comprises at least one of the following: format conversion, semantic conversion, and enhancement conversion.
[0009] In one embodiment of the first aspect, the sample set comprises at least one of the following: normal samples, boundary samples, and abnormal samples.
[0010] In one embodiment of the first aspect, the target attack rule comprises at least one of snort, suricata, YARA, and sigma.
[0011] In a second aspect, the disclosure provides a rule testing apparatus, specifically comprising: a rule acquisition module configured to acquire a test rule set; the test rule set comprising specification information of a target attack rule; a sample acquisition module configured to generate a first sample set based on the specification information using a sample generation model; the sample generation model being a large language model (LLM); the first sample set comprising at least one test sample; a rule testing module configured to perform rule testing on a system to be tested using the first sample set.
[0012] In a third aspect, the disclosure provides an electronic device, comprising: a memory for storing computer readable instructions; and a processor for running the computer readable instructions, so that the electronic device performs the method of any embodiment of the first aspect and / or the second aspect.
[0013] In a fourth aspect, the disclosure provides a non-transitory computer readable storage medium for storing computer readable instructions, which, when executed by a processor, cause the processor to perform the method of any embodiment of the first aspect and / or the second aspect.
[0014] In a fifth aspect, the disclosure provides a computer program product comprising a computer program, which, when executed by a processor, implements the method of any embodiment of the first aspect and / or the second aspect.
[0015] The disclosure provides a rule testing method, which comprises: acquiring a test rule set; the test rule set comprising specification information of a target attack rule; generating a first sample set based on the specification information using a sample generation model; the sample generation model being a large language model (LLM); the first sample set comprising at least one test sample; and performing rule testing on a system to be tested using the first sample set. In this way, the LLM can be used to understand and learn the specification information of the target attack rule, and generate a first sample set that meets the specification information, thereby expanding the number of test samples used for testing, thereby increasing the randomness of the test samples. Since the LLM can understand the specification information and generate diverse test samples, it is possible to cover test scenarios that are difficult for humans to think of, thereby increasing the coverage of the test samples to a certain extent. The first sample set obtained in this way helps to detect logical defects of the system to be detected, improves the network protection effect of the system to be detected, and thereby improves the security of the system to be detected.
[0016] It is to be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further explanation of the subject technology. BRIEF DESCRIPTION OF DRAWINGS
[0017] The above and other objects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which:
[0018] Figure 1 A schematic diagram of a rule testing method provided by an embodiment of the present disclosure; Figure 2 A schematic diagram of a snort rule provided by an embodiment of the present disclosure; Figure 3 A schematic diagram of a test sample provided by an embodiment of the present disclosure; Figure 4 A flowchart of a rule testing provided by an embodiment of the present disclosure; Figure 5 A schematic diagram of a rule testing apparatus provided by an embodiment of the present disclosure; Figure 6 A hardware block diagram of an electronic device provided by an embodiment of the present disclosure; Figure 7 A schematic diagram of a computer readable storage medium provided by an embodiment of the present disclosure. DETAILED DESCRIPTION
[0019] In order to make the objects, technical solutions and advantages of the present disclosure more apparent, the following will describe the example embodiments according to the present disclosure in detail with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited to the example embodiments described herein.
[0020] With the development of technology, the network has been fully utilized in various fields. At the same time, the importance of network security problems has also been improved with the widespread application of the network. The attack behavior of the network can be understood as illegal or malicious activities that maliciously destroy, invade, steal or interfere with computer network systems, data or services through technical means. The effectiveness of the attack rule directly determines the blocking ability of the intrusion detection system, firewall, Web application protection and other security devices.
[0021] However, traditional attack rule testing still relies on manually written and maintained test samples, resulting in low testing efficiency, limited coverage, and difficulty in adapting to rapidly changing network attack methods.
[0022] Existing attack rule testing mainly relies on static rule matching and simple traffic playback methods, which are difficult to simulate complex and variable attack behaviors, resulting in low testing efficiency, limited coverage, and difficulty in adapting to rapidly changing network attack methods, thus affecting the effectiveness of network protection and system security.
[0023] To solve the above problems, the present disclosure provides a rule testing method, which generates test samples corresponding to multiple target attack rules by using a sample generation model, thereby increasing the randomness of the test samples and providing a more comprehensive testing perspective for rule testing. For details, please refer to Figure 1 As shown in Figure 1 , the method comprises: S101, obtaining a test rule set; the test rule set includes specification information of a target attack rule; Specifically, the test rule set can include at least one target attack rule. The attack rule here refers to a rule that can be used to identify malicious network activities or behaviors that attempt to exploit system vulnerabilities, which can describe various attack behaviors through certain specifications and standards (i.e. specification information). The specification information includes but is not limited to at least one of the following: boundary conditions, abnormal situations, byte position requirements, application scenario information, and structure information. The target attack rule includes but is not limited to at least one of the following: snort, suricata, YARA, and sigma.
[0024] The boundary condition can be understood as the range limit and threshold setting in the attack rule, including but not limited to at least one of the following: character quantity limit, character type limit, and character length limit. In this way, according to the boundary condition, in the subsequent process of generating test samples, the sample generation model can generate test samples that touch the boundary condition by targeting, and by verifying the test samples that touch the boundary condition, it can more effectively find rule defects, thereby accurately verifying whether the rule works as expected and verifying the fault tolerance of the target attack rule.
[0025] The abnormal situation can be understood as an abnormal or malicious behavior pattern to be detected by the rule. Since the abnormal situation defines the core attack pattern to be detected by the target attack rule, it guides the sample generation model to understand and simulate the behavior of real attackers, generating diversified test samples, thereby improving the coverage and effectiveness of the first sample set.
[0026] The byte position requirement can specify the specific position of the detected content in the data packet. The byte position information can to some extent avoid the sample generation model in the subsequent steps to place the generated invalid samples in the position not detected by the target attack rule, so as to improve the generation of effective test samples that can participate in the test, avoid the generation of a large number of invalid test samples, and reduce unnecessary resource waste.
[0027] The application scenario information includes but is not limited to at least one of the following: a test environment for rule testing, and an attack rule application scenario. That is, the sample generation model can generate relevant test samples in the subsequent steps according to the application scenario information, to some extent, improve the adaptability of the sample generation model in a complex environment, and to some extent, improve the coverage and authenticity of the test samples.
[0028] The structure information can be understood as the composition structure and logical structure of the rule itself, including but not limited to at least one of the following: a rule header structure (for example, action, protocol, source address, source port, direction, target address, target port), and a rule option structure. The rule option structure can be understood as the organization form, syntax rule and logical relationship of all instructions.
[0029] For example, when the target attack rule is a snort rule, the specification information can be specifically represented with reference to Figure 2 For example, when the target attack rule is a snort rule, the specification information can be specifically represented with reference to Figure 2As shown, 201 is the structure information, 2011 is the rule header structure, alert is the action, http is the protocol, indicating that only http protocol traffic is detected, excluding other protocols such as TCP, UDP, ICMP, etc. any any ->any any is used to limit the address of sending behavior and the address of receiving behavior, the first any is the source address, the second any is the source port, the third any is the target address, and the fourth any is the target port. any means no specific address is limited. -> is the direction. to_server, established means to the server with an established connection. http_client_body, nocase are rule option structures in the structure information. http_client_body is used to modify the content in front of it to specify that its content should be located in the http request body. nocase is also used to modify the content in front of it to make it case-insensitive. http_method is used to modify the content immediately in front of it to search only "POST" in the method field of the HTTP request. When at least one of the strings java, Java, classloader, addheader, println, out.print, getruntime, exec, processbuilder, eval, getParameter is detected, it is considered that it may be an attack behavior generated by the target attack rule. flow:to_server,established; is a character condition limit, that is, the limit requires an established connection to the server. content:"POST"; http_method is a character condition limit, that is, the limit requires a POST request. content:!"pdf"; http_client_body; is a character condition limit, that is, the limit requires that the request body does not contain "pdf" content:"|3C 25|"; http_client_body; is a character condition limit, that is, the limit requires that it must contain "<%" (hexadecimal 3C 25).
[0030] It should be noted that the above is only an example for easy understanding, and the specific expression of the specification information can be limited by actual conditions, and the present disclosure does not make specific limitations.
[0031] In S102, a first sample set is generated based on the specification information using a sample generation model; the sample generation model is a large language model (LLM); and the first sample set includes at least one test sample.
[0032] After obtaining the specification information of the target attack rule, the basic structure of the target attack rule can be known, and at least one test sample can be simulated by using a sample generation model to obtain a first sample set.
[0033] It should be noted that the disclosure does not specifically limit the specific type of sample generation model, which includes but is not limited to at least one of the following: Large Language Model (LLM), VALL-E, and Sora. Preferably, the sample generation model type involved in the disclosure is LLM, which has shown strong capabilities in natural language processing, automatic coding, vulnerability mining, etc. That is, the sample generation model of the disclosure can generate diverse test samples covering different boundary conditions and abnormal situations according to the basic structure of the target attack rule.
[0034] The sample set includes at least one of the following: normal samples, boundary samples, and abnormal samples.
[0035] The normal sample here is a sample that conforms to the specification information of the target attack rule, that is, it can be used for normal attack testing. In this way, new test samples that conform to the target attack rule can be obtained, and the sensitivity of the test system to such attacks is improved, improving the comprehensiveness of the test.
[0036] The boundary sample refers to a test sample similar to the specification information but not completely consistent, and specifically can be understood as a test sample highly close to the rule matching mode in structure, character and semantics, only not meeting one or a small number of key constraints, and just falling outside the rule judgment boundary. For the convenience of understanding, the following will be explained in combination with specific examples. Exemplarily, the specification information can be represented as: pcre: " / select \d, \d from / i", wherein d is any digit from 0 to 9. At this time, \d, \d is a boundary condition for limiting the character type in the target attack rule, that is, the format after select must be one digit + comma + one digit, such as 1,2 or 9,0. For example, when the string is select 1,2 from, it meets the specification information, and an alarm is issued, and when the string is select 12 from, it does not meet the requirement that the format must be one digit + comma + one digit, that is, it is considered not to be an attack behavior from the target attack rule. In this way, the boundary sample similar to the specification information can be used for testing, which improves the coverage of the test sample and avoids the situation that the system incorrectly judges the attack rule due to the proximity of the boundary to a certain extent in the training process. It should be noted that the similarity of the boundary sample to the specification information can be set according to the actual situation, and is not specifically limited here. Exemplarily, the boundary sample can be limited to a test sample that meets most of the key conditions in the rule and only lacks one key matching point value.
[0037] The abnormal sample refers to a test sample completely different from the specification information of the target trajectory rule.
[0038] For the convenience of understanding, please refer to Figure 3 , Figure 3 That is, three test samples generated by the sample generation model according to the snort rule. In the 301 test sample, the out.print string is present, the PDF character is not included, it is a POST request, and "<%" or |3C 25| is included, that is, it meets the snort specification information, so 301 is a normal sample. In the 302 test sample, it does not include "<%" or |3C 25|, which does not meet the snort rule, but meets other conditions, so it is a boundary sample. The 303 sample meets the snort specification information and is a normal sample.
[0039] In this way, in combination with the normal sample, the boundary sample and the abnormal sample, the sample type for attack testing is increased, various extreme cases are considered, the test coverage is improved, and the overall test efficiency is improved.
[0040] S103, performing rule testing on the to-be-tested system by using the first sample set.
[0041] Finally, the first sample set can be used to perform rule testing on the system under test. It should be noted that the present disclosure does not specifically limit the specific type of the system under test, which includes but is not limited to at least one of the following: software application, hardware device, embedded system. The present disclosure also does not specifically limit the system performing rule testing, which includes but is not limited to at least one of the following: Metasploit Framework, Suricata, Snort Rule Tester.
[0042] Optionally, after performing attack testing on the system under test, the test results of the attack testing can be recorded, which includes but is not limited to at least one of the following: log, system response. In this way, it can be judged according to the test results whether the reaction to each test sample is correct, so as to facilitate subsequent improvement.
[0043] Optionally, after obtaining the test results, the test results can be compared with the expected output to determine whether it is correct output. If they are the same, the test results are correct output, which means that the system response meets the expectation. If an undefined or abnormal test result is identified, it means that the test result is abnormal output, which means that it does not run as expected and there is an error information. The test sample and its corresponding target rule recorded in the log can be traced back. At this time, it means that the system has identification problems for this type of test sample of the target rule. In order to improve the completeness of the system, optionally, based on the test results of the test samples in the first sample set on the system under test and the test rule set, the sample generation model can be used to generate multiple test samples in a loop to obtain a second sample set, and the second sample set can be used to perform rule testing. That is, more variants are generated specifically for this type of failure mode, so as to accurately focus the test resources on the weak links found, realize deep mining, and greatly improve the vulnerability discovery efficiency.
[0044] In summary, the present disclosure provides a rule testing method, the present disclosure obtains a test rule set; the test rule set includes specification information of a target attack rule; based on the specification information, a first sample set is generated using a sample generation model; the sample generation model is a large language model (LLM); the first sample set includes at least one test sample; and the first sample set is used to perform rule testing on a system to be tested. In this way, the LLM can be used to understand and learn the specification information of the target attack rule, and generate a first sample set that meets the specification information, thereby increasing the number of test samples for testing, thereby increasing the randomness of the test samples. Since the LLM can understand the specification information and generate diversified test samples, it may cover test scenarios that are difficult for humans to think of, thereby increasing the coverage of the test samples to a certain extent. The first sample set obtained in this way is used for testing, which helps to detect logical defects of the system to be detected, improves the network protection effect of the system to be detected, and thereby improves the security of the system to be detected.
[0045] In addition, before S103, the first sample set can also be processed using a sample generation model to obtain a third sample set. The conversion processing includes at least one of the following: format conversion, semantic conversion, and enhancement conversion. The format conversion can be understood as adjusting the input format of the test samples in the first sample set to meet the input requirements of the device or system under test. The semantic conversion can be understood as adjusting the expression of the sample without changing the test target, thereby improving the comprehensiveness of the test and increasing the coverage of the sample set. The enhancement conversion is to generate more diverse test samples using data enhancement techniques to improve test coverage and improve the completeness of the sample set.
[0046] It should be noted that the sample generation model is the same as or different from the device where the system to be tested is located. That is, the sample generation model and the system to be tested can be on the same device, so that they directly communicate and avoid network serialization overhead. The two can also be on different devices. That is, after the sample generation model generates the sample set, it sends the sample set to the device where the system to be tested is located. Since the sample generation model usually requires a high-performance GPU, and the system to be tested can be deployed in a special hardware or production environment, when a malicious sample causes the system to be tested to crash, it does not affect the generation of the sample generation model itself, thereby improving the security.
[0047] The above is a rule testing method provided by the present disclosure. It should be understood that the above examples can be combined as needed, and the present disclosure does not make specific limitations here.
[0048] For the convenience of understanding the examples, please refer to Figure 4 For example, Figure 4As shown, the LLM sample generation module generates a test sample set (i.e., the first sample set) after obtaining the rule set (i.e., the above specification information), and transforms the sample set (i.e., the third sample set) by using the LLM conversion module, and sends the third sample set to the device under test (i.e., the system to be tested) by using the sample generation module to generate a test result.
[0049] In summary, the above method can solve the problems of insufficient test samples and insufficient coverage, and cannot fully test the rules.
[0050] The present disclosure also provides a rule testing device. Figure 5 A schematic diagram of a rule testing device provided by an embodiment of the present disclosure is shown in Figure 5 As shown, the rule testing device 500 includes: A rule acquisition module 501 configured to acquire a test rule set; the test rule set includes specification information of a target attack rule; A sample acquisition module 502 configured to generate a first sample set by using a sample generation model based on the specification information; the sample generation model is a large language model (LLM); the first sample set includes at least one test sample; A rule testing module 503 configured to perform rule testing on a system to be tested by using the first sample set.
[0051] In an illustrative example, the rule testing device 500 is further configured such that the specification information includes at least one of the following: boundary conditions, abnormal situations, byte position requirements, application scenario information, and structure information.
[0052] In an illustrative example, the rule testing device 500 is further configured to generate multiple test samples by using the sample generation model based on the test results of the system to be tested by the test samples in the first sample set and the test rule set, to obtain a second sample set.
[0053] In an illustrative example, the rule testing device 500 is further configured to perform conversion processing on the first sample set by using the LLM to obtain a third sample set; the conversion processing includes at least one of the following: format conversion, semantic conversion, and enhancement conversion.
[0054] In an illustrative example, the rule testing device 500 is further configured such that the sample set includes at least one of the following: normal samples, boundary samples, and abnormal samples.
[0055] In an illustrative example, the rule testing device 500 is further configured such that the target attack rule includes at least one of the following: snort, suricata, YARA, and sigma.
[0056] Figure 6 This is a hardware block diagram of an electronic device provided according to an embodiment of the present disclosure. The electronic device 600 according to an embodiment of the present disclosure includes at least a processor; and a memory for storing computer-readable instructions. When the computer-readable instructions are loaded and executed by the processor, the processor performs the rule-based testing method described in any of the preceding embodiments of the present disclosure.
[0057] Figure 6 The illustrated electronic device 600 specifically includes a central processing unit (CPU) 601, a graphics processing unit (GPU) 602, and a memory 603. These units are interconnected via a bus 604. The CPU 601 and / or GPU 602 can function as the aforementioned processor, and the memory 603 can function as the aforementioned memory storing computer-readable instructions. Furthermore, the electronic device 600 may also include a communication unit 605, a storage unit 606, an output unit 607, an input unit 608, and an external device 609, all of which are also connected to the bus 604.
[0058] Figure 7 This is a schematic diagram of a computer-readable storage medium provided in an embodiment of this disclosure. (As shown...) Figure 7 As shown, a computer-readable storage medium 700 according to an embodiment of the present disclosure stores computer-readable instructions 701 thereon. When the computer-readable instructions 701 are executed by a processor, the rule-based testing method described with reference to the above figures according to any of the embodiments described above in this disclosure is performed. The computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.
[0059] This disclosure further provides a computer program product, including a computer program that, when executed by a processor, implements the rule testing method described in any of the preceding embodiments of this disclosure.
[0060] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this disclosure.
[0061] The above describes the basic principles of the present disclosure in conjunction with specific embodiments, but it should be noted that the advantages, benefits, effects and the like mentioned in the present disclosure are only examples and are not limiting, and these advantages, benefits, effects and the like cannot be considered as necessary for each embodiment of the present disclosure. In addition, the specific details of the above disclosure are only for the purpose of example and for the purpose of understanding, and are not limiting, and the above details do not limit the present disclosure to be necessarily implemented with the above specific details.
[0062] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only illustrative examples and are intended to require or imply that the connections, arrangements, numbering shown in the block diagrams must be connected, arranged, numbered. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, numbered in any manner. Words such as "include", "contain", "have" and the like are open-ended words, mean "include but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably unless the context clearly indicates otherwise. The word "such as" used herein means the phrase "such as but not limited to", and can be used interchangeably.
[0063] In addition, as used herein, "or" used in the list of items preceded by "at least one of" means a separate list, so that, for example, "at least one of A, B or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). In addition, the phrase "exemplary" does not mean that the described example is preferred or better than other examples.
[0064] It should also be noted that in the systems and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalents of the present disclosure.
[0065] Various changes, substitutions and alterations can be made to the techniques described herein without departing from the teachings of the technology defined by the appended claims. In addition, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of matter, means, methods and acts of the above described. Processes, machines, manufactures, compositions of matter, means, methods or acts currently existing or later developed that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Accordingly, the appended claims include within their scope such processes, machines, manufactures, compositions of matter, means, methods or acts.
[0066] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other aspects without departing from the scope of the disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
[0067] The above description has been given for the purposes of illustration and description. It is not intended to limit the embodiments of the disclosure to the form described herein. Although various example aspects and embodiments have been discussed above, a person of ordinary skill in the art will recognize certain variations, modifications, changes, additions, and sub-combinations thereof.
Claims
1. A rule-based testing method, characterized in that, The method includes: Obtain a set of test rules; the set of test rules includes specification information of the target attack rules; Based on the aforementioned specification information, a first sample set is generated using a sample generation model; the sample generation model is a Large Language Model (LLM); the first sample set includes at least one test sample. The first sample set is used to perform rule testing on the system under test.
2. The method according to claim 1, characterized in that, The specification information includes at least one of the following: boundary conditions, abnormal situations, byte position requirements, application scenario information, and structural information.
3. The method according to claim 1, characterized in that, The method further includes: Based on the test results of the system under test from the test samples in the first sample set and the test rule set, multiple test samples are generated cyclically using the sample generation model to obtain the second sample set.
4. The method according to claim 1, characterized in that, The method further includes: The LLM is used to transform the first sample set to obtain the third sample set; the transformation process includes at least one of the following: format transformation, semantic transformation, and enhancement transformation.
5. The method according to claim 1, characterized in that, The sample set includes at least one of the following: normal samples, boundary samples, and abnormal samples.
6. The method according to claim 1, characterized in that, The target attack rules include at least one of the following: snort, suricata, YARA, and sigma.
7. A rule-based testing device, characterized in that, The device includes: The rule acquisition module is configured to acquire a set of test rules; the set of test rules includes specification information of the target attack rules. The sample acquisition module is configured to generate a first sample set based on the specification information using a sample generation model; the sample generation model is a Large Language Model (LLM); the first sample set includes at least one test sample. The rule testing module is configured to perform rule testing on the system under test using the first sample set.
8. An electronic device, characterized in that, include: Memory, used to store computer-readable instructions; as well as A processor for executing the computer-readable instructions, causing the electronic device to perform the method as described in any one of claims 1-6.
9. A non-transitory computer-readable storage medium for storing computer-readable instructions, characterized in that, When the computer-readable instructions are executed by a processor, the processor performs the method as described in any one of claims 1-6.
10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1-6.