Ransomware threat resistant test case generation method and device based on multilayer network

Abstract

The invention relates to the technical field of network security assessment, in particular to a multi-layer network-based ransomware threat-resistant test case generation method and device, and the method comprises the steps: firstly constructing a ransomware threat knowledge base which integrates multi-source threat intelligence, and depicts a ransomware family-vulnerability-component dynamic association by a time sequence tetrad; the method comprises the following steps: establishing a ransomware family-vulnerability-component-system-service five-layer network, identifying a vulnerable component in combination with SBOM data of a target system, constructing a ransomware family-vulnerability-component-system-service five-layer network, executing an interlayer-intra-layer bidirectional association analysis algorithm to generate explicit and implicit threat paths, and finally generating a test case containing an attack step sequence based on LLM. According to the test case generation method for resisting the ransomware threat based on the multilayer network, the reachable path from the ransomware to the core service can be quantitatively evaluated before the ransomware invades, the system security risk is recognized in advance, verification and protection are assisted, and the attack risk of the core service is effectively reduced.

Description

Technical Field

[0001] This invention relates to the field of network security assessment technology, specifically to a method and apparatus for generating test cases for resisting ransomware threats in multi-layered networks. Background Technology

[0002] Ransomware attacks target systems by encrypting critical files or locking system resources, posing a significant threat to the normal operations of government agencies, financial institutions, and corporations. Many organizations have been forced to halt operations due to ransomware attacks, and ransomware as a service is emerging as a new threat trend. Traditional defense measures such as firewalls and intrusion detection rely on rule matching and known attack patterns, making them technically reactive and ill-equipped to address the rapid evolution and increasingly concealed attack paths of ransomware. To achieve proactive risk prevention, existing technologies primarily rely on vulnerability scanning and asset inventory. Software Bill of Materials (SBOM) systems manage system components and dependencies, and common vulnerability databases (such as NVD and CNVD) are used to identify potential vulnerabilities in business systems, demonstrating some effectiveness in basic security assessments.

[0003] However, existing technologies still have significant shortcomings in the pre-emptive assessment and protection against ransomware. First, they struggle to effectively characterize dynamic attack chains, failing to capture threat evolution scenarios such as new variants of ransomware families exploiting unknown vulnerabilities or component version updates patching vulnerabilities, and they do not consider dynamic changes in dependencies. Second, they cannot achieve multi-dimensional correlation modeling between external threat intelligence and internal asset dependencies, making it difficult to construct a complete correlation threat chain from ransomware family to vulnerability to component to system to business, especially lacking coverage of indirect threats (i.e., implicit paths) caused by dependencies on components, systems, and businesses, resulting in blind spots in risk identification. Third, they lack the ability to directly convert threat paths into penetration tests, failing to generate usable test plans, thus hindering the systematic verification of business threat accessibility and the early blocking of attack paths. Therefore, in response to the above situation, there is an urgent need to develop test case generation methods and devices based on multi-layered network anti-ransomware threats to overcome the shortcomings in current practical applications. Summary of the Invention

[0004] The purpose of this invention is to provide a method and apparatus for generating test cases for resisting ransomware threats based on multi-layer networks, so as to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A test case generation method for resisting ransomware threats based on multi-layered networks includes the following steps:

[0007] Step S1: Construct a ransomware threat knowledge base based on a time-series knowledge graph. The knowledge base integrates multi-source threat intelligence and depicts the dynamic relationship between ransomware families, vulnerabilities, and components.

[0008] Step S2: Obtain the Software Bill of Materials (SBOM) data of the target system, identify vulnerable components by combining the ransomware threat knowledge base, and construct a five-layer directed relational network including the ransomware family layer, vulnerability layer, component layer, system layer and business layer based on the vulnerable components and the dependencies in the SBOM data;

[0009] Step S3: Execute a bidirectional association analysis algorithm in the five-layer directed association network to generate explicit threat paths and implicit threat paths;

[0010] Step S4: Based on the explicit threat path and the implicit threat path, generate anti-ransomware test cases containing the attack step sequence using a large language model (LLM).

[0011] As a further aspect of the present invention: step S1 includes the following sub-steps:

[0012] Step S11: Collect threat intelligence from multiple sources, filter ransomware families with attack activity records, and build a standardized ransomware family library;

[0013] Step S12: Collect vulnerability information exploited by ransomware families, use CVE numbers as unique identifiers to complete multi-dimensional metadata, and build a multi-source heterogeneous vulnerability database;

[0014] Step S13: Extract the component information affected by the vulnerability, standardize the component names and version numbers, and build a component library with version tags;

[0015] Step S14: Use temporal quadruples to characterize the dynamic relationships between ransomware families, vulnerabilities, and components, form a temporal knowledge graph and store it in a graph database, integrate a temporal reasoning engine and support periodic reasoning updates and incremental updates.

[0016] As a further aspect of the present invention: step S2 includes the following sub-steps:

[0017] Step S21: Collect the original SBOM data of the target system, perform data cleaning and format standardization, and transform it into machine-parseable structured data;

[0018] Step S22: Match the standardized SBOM data with the component information in the ransomware threat knowledge base, and identify vulnerable components by accurately matching component names and verifying the version number and the version range affected by the vulnerability;

[0019] Step S23: Based on the component-system-business dependency relationship in the vulnerable components and SBOM data, construct a five-layer directed association network, establish utilization-influence-being used-support associations between layers, and establish system / business dependency associations within layers.

[0020] As a further aspect of the present invention: step S3 includes the following sub-steps:

[0021] Step S31: Traverse the five-layer network in the order of ransomware family layer, vulnerability layer, component layer, system layer, and business layer to extract explicit threat paths between layers;

[0022] Step S32: Using the threatened nodes in the explicit path as the initial nodes, a depth-first search strategy is adopted to propagate along the intra-layer dependencies and discover the intra-layer implicit threat diffusion path;

[0023] Step S33: Integrate explicit paths between layers and implicit paths within layers to construct a complete bidirectional associated threat network for ransomware threats.

[0024] As a further aspect of the present invention: step S4 includes the following sub-steps:

[0025] Step S41: Predefine a structured test case template containing a unique identifier, test target, environment requirements, preconditions, attack step sequence, and expected results;

[0026] Step S42: Input threat path parameters, vulnerability details, environmental constraints, historical cases and quality requirements into the LLM to generate an attack step sequence. Fill the template parameters with deterministic rules and the LLM to form initial test cases.

[0027] Step S43: Perform manual review of the initial test cases, supplement operational details and adjust the order of steps.

[0028] Step S44: Build a test case management library, establish an association mapping between test cases and threat paths, and support version tracking and synchronous updates of test cases.

[0029] As a further aspect of the present invention: in step S14, the time-series quadruple includes two types of association forms: ransomware family-exploitation-vulnerability-time and vulnerability-impact-component-time, and the graph database is the Neo4j graph database.

[0030] As a further aspect of the present invention: in step S21, the structured format of the SBOM data is JSON format, and the dependency relationship includes the usage relationship between components and the system, the support relationship between the system and the business, and the dependency relationship between systems and businesses.

[0031] As a further aspect of the present invention: in step S31, the SBOM data is parsed using a threat path analysis algorithm and matched with component, vulnerability and ransomware family information in the graph database to generate a structured explicit threat path;

[0032] In step S32, the threat is recursively propagated through the dependency analysis algorithm, and the affected components, systems and business nodes are marked.

[0033] A test case generation device for multi-layer network anti-ransomware threats, used to implement the aforementioned test case generation method for multi-layer network anti-ransomware threats, includes:

[0034] The knowledge base construction module is used to integrate multi-source threat intelligence and build a ransomware threat knowledge base based on a time-series knowledge graph.

[0035] The multi-layer network construction module is used to acquire SBOM data, identify vulnerable components, and construct a five-layer directed relational network.

[0036] The threat path generation module is used to perform bidirectional correlation analysis algorithms in a five-layer network to generate explicit and implicit threat paths;

[0037] The test case generation module is used to generate anti-ransomware test cases containing attack step sequences based on threat paths and LLM.

[0038] As a further aspect of the present invention: the knowledge base construction module includes a temporal knowledge graph generation unit and a knowledge base maintenance unit. The temporal knowledge graph generation unit is used to construct a family library, a vulnerability library, and a component library and to characterize dynamic relationships. The knowledge base maintenance unit is used to maintain the effectiveness of the knowledge base through temporal reasoning and incremental update mechanisms.

[0039] Compared with the prior art, the beneficial effects of the present invention are:

[0040] The test case generation method and apparatus for resisting ransomware threats based on multi-layer networks provided by this invention first constructs a ransomware threat knowledge base with dynamic reasoning capabilities based on a temporal knowledge graph. It can integrate threat intelligence from multiple sources, depict the dynamic relationship between ransomware families, vulnerabilities, and components, and support dynamic reasoning in scenarios such as new variants of ransomware families exploiting unknown vulnerabilities and component version updates fixing vulnerabilities. Furthermore, through regular reasoning updates and incremental update mechanisms, it ensures the timeliness of vulnerable component identification and the efficient maintenance of the knowledge base.

[0041] The resulting five-layer network structure—ransomware family—vulnerability—component—system—business—achieved multi-dimensional correlation modeling between external threat intelligence and internal asset dependence. Combined with inter-layer and intra-layer bidirectional correlation analysis algorithms, it comprehensively depicted the explicit and implicit propagation path of ransomware threats from external attack sources to core businesses, filling the gap in existing technology coverage of implicit threat paths and eliminating blind spots in risk identification.

[0042] Meanwhile, this invention combines LLM output with threat path test cases that can guide penetration testing, realizing the direct conversion from threat path to test plan. The test cases are generated through templates and parameters, clearly describing the attack step sequence, and support manual review and version management, ensuring the executability of the test cases and their synchronization with the threat situation.

[0043] Overall, this invention can quantitatively assess multiple reachable paths of ransomware to core businesses before actual intrusion, enabling a reasonable and verifiable panoramic analysis of ransomware threats. It can identify potential security risks of the system under test in advance and provide test cases to assist in verification and subsequent protection, effectively reducing the risk of attacks on core businesses. Attached Figure Description

[0044] Figure 1 This is a flowchart of a test case generation method for resisting ransomware threats based on a multi-layer network, as described in this embodiment of the invention.

[0045] Figure 2 This is a flowchart illustrating the construction process of a multi-layered ransomware threat network in an embodiment of the present invention.

[0046] Figure 3 This is a flowchart of multi-layer network threat analysis in an embodiment of the present invention.

[0047] Figure 4 This is a flowchart for generating threat path test cases in an embodiment of the present invention.

[0048] Figure 5 This is a schematic diagram of the electronic device structure generated from test cases of multi-layer network anti-ransomware threat in an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] The specific implementation of the present invention will be described in detail below with reference to specific embodiments.

[0051] Please see Figures 1-5 The test case generation method and apparatus for resisting ransomware threats based on multi-layer networks provided in this invention can solve the problems of existing technologies being unable to dynamically depict attack chains, lacking multi-dimensional correlation modeling, and having insufficient test scheme implementation capabilities. It enables reasonable and verifiable panoramic analysis of ransomware threats, identifies system security risks in advance, and assists in subsequent protection.

[0052] like Figure 1 As shown, the overall process includes steps S1 to S4, and the specific implementation details of each step are as follows:

[0053] Step S1: Construct a ransomware threat knowledge base based on a time-series knowledge graph

[0054] This step involves collecting threat intelligence from multiple sources to build a ransomware threat knowledge base with dynamic reasoning capabilities, providing data support for subsequent vulnerability identification and threat path analysis. Specifically, it includes the following sub-steps:

[0055] S11: Building a Ransomware Family Library

[0056] The system collects information on major ransomware families based on publicly available threat intelligence platforms and security vendor reports, filters out representative ransomware families with attack activity records, and constructs a ransomware family collection. Among them, r i This represents the i-th ransomware family, whose attributes include family name, attack characteristics, target industry, and activity cycle. To ensure data standardization, the system standardizes family names, eliminating aliases, abbreviations, or spelling differences from different intelligence sources. This ensures the uniqueness and traceability of family information, laying the foundation for accurate matching of ransomware families and vulnerabilities in the future.

[0057] S12: Building a Multi-Source Heterogeneous Vulnerability Database

[0058] Based on the ransomware family database, vulnerability information actually exploited by ransomware families is collected to form a vulnerability database. Data sources cover the CVE international vulnerability database, the NVD national vulnerability database, and various threat intelligence reports. Vulnerabilities are uniquely identified by their CVE numbers, and multi-dimensional metadata is supplemented, including basic identification information (CVE number, vulnerability type, CWE category), technical attribute information (vulnerability description, attack vector, exploitation complexity, required privileges), risk quantification information (CVSS basic score, time score, environment score, severity level), and related exploitation relationships (known ransomware families exploiting the vulnerability, the scope of affected components, and version ranges). During the data cleaning phase, the system standardizes, eliminates redundancy, and corrects conflicts in the collected data to ensure the consistency and authority of the vulnerability data, ultimately forming a vulnerability collection. , where v i This indicates the i-th vulnerability that has been exploited by the ransomware family, providing data assurance for accurately identifying the impact relationship between the vulnerability and the component.

[0059] S13: Building a Component Library with Versioning

[0060] To reconstruct the exploit path, a component library is established by extracting specific component information affected by the vulnerability from the vulnerability database. Component information is sourced from vulnerability database metadata, software vendor security announcements, and technical communities. For each component, the system includes basic information (component name, vendor information), version attributes (the range of versions affected by the vulnerability), and relationships (the mapping between the vulnerability and the component). During processing, the system standardizes the transliteration of component names and version numbers, removing differences and redundancies in descriptions from different platforms or vendors, achieving unified matching across system environments. The component library set C is represented as... , where c i This represents the i-th component, which provides support for accurate matching with the target system's SBOM data in the future.

[0061] S14: Construction of Temporal Knowledge Graph

[0062] Based on the aforementioned family database, vulnerability database, and component database, the dynamic relationships between entities in the ransomware threat path are depicted in the form of four-tuples. The relationship between ransomware families and vulnerabilities is represented as follows: The meaning is family r i exploiting the vulnerability at time t j The relationship between vulnerabilities and components is represented as follows: The meaning is vulnerability v. j The component affected at time t By constructing layer by layer, a complete set of threat path quadruples is formed:

[0063]

[0064] Where s1 and s2 represent specific entities (family, vulnerability, or component), r represents the relationship type such as exploitation or influence, and t represents time.

[0065] This collection is uniformly stored in the Neo4j graph database, leveraging its native support for directed graphs to achieve flexible modeling, visualization, and efficient querying of ransomware attack paths. It also integrates a temporal reasoning engine (based on rule-based reasoning, such as "if a component version is updated and not within the vulnerability's impact range, the 'vulnerability-component' relationship is automatically removed"), enabling dynamic reasoning about threat evolution relationships. The knowledge base data is periodically updated with reasoning to ensure the timeliness of vulnerable component identification. An incremental update mechanism is supported to improve knowledge base maintenance efficiency. This mechanism employs multi-source intelligence monitoring, polling CVE, NVD, and various threat intelligence reports daily. When new CVEs, vendor security advisories, or ransomware reports are captured, or new vulnerabilities and threat methods are detected, an intelligence event is generated. The system responds to these events by executing a "minimum subgraph" update strategy, adding or modifying only nodes directly associated with the event and their 1-hop neighbors. When different intelligence sources provide contradictory attributes for the same entity, the system performs three-level arbitration based on "authority level, timeliness, and number of sources." The authority levels, from highest to lowest, are: official CVE / NVD, vendor security announcements, community blogs, and Twitter, with the highest authority level being directly covered. If the authority levels are the same, the most recent information will be used. If both the authority level and the release time are the same, the number of sources will be counted, and the number of times different information sources mention the attribute will be counted within a specified time period. The majority vote will determine the final result.

[0066] Step S2: Construct a five-layer network structure integrating "ransomware family - vulnerability - component - system - business".

[0067] This step, based on the target system's SBOM data and the threat knowledge base built in step S1, identifies vulnerable components and constructs a five-layer directed relational network to fully depict the entire threat propagation chain. The process is as follows: Figure 2 As shown, the specific steps include the following:

[0068] S21: Obtaining Business System Related Data Based on SBOM

[0069] Collect the original Software Bill of Materials (SBOM) data of the target business system. This data records components (name, version number, vendor, etc.), systems (name, IP address, open ports, etc.), business functions (name, core functions, data flow, etc.), and the dependencies between them (including dependencies between components and systems, systems and business functions, and components and business functions). The original SBOM data is represented as a set:

[0070]

[0071] in, For a collection of components, For system sets, It is a set of business functions; its internal relationships include:

[0072]

[0073]

[0074]

[0075]

[0076] The raw SBOM data undergoes data cleaning, redundant information removal, and format standardization preprocessing to transform it into machine-parsable JSON-formatted structured data, providing standardized input for subsequent network construction and threat analysis.

[0077] S22: Identifying Vulnerable Components of Business Systems Based on Ransomware Threat Knowledge Base

[0078] Based on the ransomware threat knowledge base constructed in step S1, the preprocessed JSON-formatted SBOM data is matched and analyzed with the component information in the knowledge base. Specifically, this is done by analyzing the component names in the SBOM data. With knowledge base component name Precise matching is performed, and the component version numbers in the SBOM data are verified by combining them with the component version range affected by the vulnerability in the knowledge base (component versions within the affected version range are considered to have passed verification). By leveraging the graph association characteristics of the knowledge base, potential vulnerable components that may be exploited by related ransomware families are inferred. Finally, the set of vulnerable components that exist in the business system to be tested and can be exploited by ransomware is screened and identified, providing core node data for subsequent network construction.

[0079] S23: Generating a five-layer directed multi-layer network based on a knowledge base of vulnerable components and ransomware threats.

[0080] Based on the vulnerability component identification results and combined with the "component-system-business" dependency relationships recorded in the SBOM data, a five-layer directed relational network model is constructed, comprising the ransomware family layer R, the vulnerability layer V, the component layer (component set C), the system layer (system set S), and the business layer (business set B):

[0081]

[0082] In this network, layers are connected through directed edges, and the specific relationships include:

[0083] : Represents the extortion family Exploitable vulnerabilities ;

[0084] : Indicates a vulnerability Affected components ;

[0085] : Represents a component By system Used;

[0086] : indicates system Carry and support business ;

[0087] Within a layer, nodes are connected by directed edges based on dependency relationships. Specific relationships include:

[0088] : indicates system For the system There is a dependency relationship;

[0089] : Indicates business For business There is a dependency relationship;

[0090] This five-layer network structure fully depicts the path of threat propagation across layers and diffusion within layers, realizing the full-link threat representation from the threat source to the service bearer.

[0091] Step S3: Threat Reachability Analysis Based on Bidirectional Correlation Analysis Algorithm

[0092] This step executes a bidirectional correlation analysis algorithm within the five-layer network constructed in step S2 to generate explicit and implicit threat paths, comprehensively covering both direct and indirect threats. The process is as follows: Figure 3 As shown, the specific steps include the following:

[0093] S31: Generating explicit threat paths between layers based on multi-layer networks

[0094] Based on the threat path analysis algorithm (as shown in Algorithm 1), the algorithm starts from the component set C, system set S, and business set B parsed from the target system's SBOM data and performs matching analysis with the vulnerability knowledge base. The algorithm first parses the SBOM's JSON file to extract component and version information; then it matches the components in the Neo4j database by name and version (including fixed version verification and version range judgment); for successfully matched components, it uses the MATCH query language to retrieve relevant vulnerability information and ransomware families; finally, it integrates system attribution and business association information to generate a structured threat path output.

[0095] The set of explicit threat paths across layers is represented as follows:

[0096]

[0097] in, Indicates the component version information of the target system. This refers to information from the vulnerability knowledge base about components that are identical to those in the target system being detected. The component version matching function is defined as follows:

[0098]

[0099] in, This indicates the version information of component c. Components corresponding to the vulnerability knowledge base Version information same; This indicates the version information of component c. Falling into the component corresponding to the vulnerability knowledge base Between the recorded version information, and These represent the initial and final versions of the component that contain the vulnerability, respectively. This indicates that the version information of component c is not recorded in the vulnerability knowledge base.

[0100] This step traverses the reachable path in the order of "ransomware family layer → vulnerability layer → component layer → system layer → business layer", generating an explicit attack chain from the attack source to the business target, clearly presenting the direct threat propagation path.

[0101] Algorithm 1: Threat Path Analysis Algorithm

[0102] Input: JSON file containing the target system's SBOM information;

[0103] Output: Threat path analysis results.

[0104] DetectThreatpath(file): / / Detection function;

[0105] ComponentResults[], System[], Business[], Rel_SBOM[] / / Stores the components and versions, system, business information and their relationships in the SBOM;

[0106] ComponentResults, System, Business, Rel_SBOM ← ParseSBOM(file) / / Parse function to parse the JSON file of the SBOM and obtain the corresponding SBOM data;

[0107] For component in ComponentResults: / / Loop through the list of components;

[0108] IF com_name == component.name / / Exact match of component name;

[0109] IF stationary_version == component.version / / Component fixed version verification;

[0110] MATCH(c:Component{name:$C,version:$v}))-[:AFFECTS]->(v:Vulnerability)<-[:EXPLOITS]-(r:RansomwareFamily) / / Neo4j database query for vulnerabilities associated with vulnerable components and related ransomware family threat sources;

[0111] Return C[],V[],R[],S[],B[],Rel[] / / Returns information on components, vulnerabilities, ransomware families, systems, business processes, and related relationships;

[0112] Else

[0113] start_version <= component_version <= end_version / / Determine the component version range;

[0114] MATCH(c:Component{name:$C,version:$v})-[:AFFECTS]->(v:Vulnerability)<-[:EXPLOITS]-(r:RansomwareFamily) / / Neo4j database query to find vulnerabilities associated with vulnerable components and related ransomware family threat sources;

[0115] Return C[],V[],R[],S[],B[],Rel[] / / Returns information on components, vulnerabilities, ransomware families, systems, business processes, and related relationships;

[0116] Else

[0117] Break / / Component name does not match, terminate the current loop;

[0118] Return detectionResults / / Returns the threat path results.

[0119] S32: Mining Hidden Threat Paths Within Multi-Layer Networks

[0120] Based on the dependency analysis algorithm (as shown in Algorithm 2), the threat components, systems and services identified in the cross-layer path are used as the initial nodes. A depth-first search strategy is adopted to propagate downstream along the intra-layer dependency relationship, mark all affected components, systems and services, and explore the threat diffusion path caused by intra-layer dependency relationship.

[0121] Define the dependency propagation function within the layer:

[0122]

[0123] Where X is the initial set of threatened nodes; D is the dependency matrix, which describes the dependencies between nodes in the current layer, where the rows and columns of the matrix represent the number of nodes in the layer. This indicates the current layer node. To the node There is a dependency relationship. This indicates that there is no dependency between nodes i and j; DFS is the depth-first search function; the recursive definition is:

[0124]

[0125] The sets of implicit threat diffusion at each layer are as follows:

[0126] Component layer: ;

[0127] System layer: ;

[0128] Business layer:

[0129] Among them, D C D S D B These represent dependency matrices for components, systems, and business layers, respectively. These represent the nodes that are explicitly threatened at the corresponding layer. This represents the corresponding set of implicit threat propagation.

[0130] This step effectively uncovers indirect threat propagation caused by internal dependencies (such as upstream dependent components of vulnerable components in explicit paths that may be affected by compromised components even if they have no direct vulnerabilities), filling the blind spot of traditional methods in identifying implicit threats.

[0131] Algorithm 2: Dependency Analysis Algorithm

[0132] Input: List of threat components;

[0133] Output: Sets of components, systems, and services affected by the threat;

[0134] Function threat_spread(entity_id, entity_data, result_set, visited): / / Recursive propagation function;

[0135] If entity_id is in visited: / / , check if the node has already been visited to avoid duplicate processing;

[0136] return

[0137] visited.add(entity_id) / / Mark the node as visited;

[0138] result_set.add(entity_id) / / Add the node to the affected result set;

[0139] For downstream_id in entity_data[entity_id].depended_by: / / , iterate through all downstream dependent nodes;

[0140] threat_spread(downstream_id, entity_data, result_set, visited) / / Recursively propagate dependent threats;

[0141] related_components = set() / / Initialize the collection of affected components;

[0142] for threat_comp in detected_threat_components: / / Iterate through each threat component;

[0143] threat_spread(threat_comp,components_data;

[0144] related_components, new_set()) / / Propagate the threat to downstream dependent components;

[0145] related_systems = set() / / Initialize the set of affected systems;

[0146] for sys_id in initial_systems: / / Iterate through the initially affected systems;

[0147] threat_spread(sys_id,systems_data,related_systems,new_set()) / / Spreads the threat to downstream systems;

[0148] related_businesses = set() / / Initialize the set of affected businesses;

[0149] for biz_id in initial_businesses: / / Iterate through the initially affected businesses;

[0150] threat_spread(biz_id,businesses_data;

[0151] related_businesses,new_set()) / / Spread the threat to downstream businesses;

[0152] Return related_components, related_systems, related_businesses / / Returns the set of affected entities.

[0153] S33: Constructing a bidirectional, interconnected threat network based on explicit and implicit threat paths.

[0154] By integrating explicit cross-layer diffusion paths and implicit intra-layer diffusion paths, a complete bidirectional interconnected ransomware threat network is constructed.

[0155]

[0156] The set of all nodes. Let be the set of all edges, where:

[0157]

[0158]

[0159] ;

[0160] Represents a set of explicit dependencies across layers. This represents the set of explicit dependency paths across layers, with each path... This represents an explicit propagation path. Indicates the implicit diffusion edge set within the layer. Indicates implicit edges within the component layer. Implicit edges There is a dependency between node x and node y. The edge, It is a collection of edges such as component layer, system layer, and business layer.

[0161] This bidirectional, interconnected threat network provides a panoramic view of all the propagation paths of ransomware threats from external attack sources to core business operations. It includes both direct, explicit attack chains and indirect, implicit diffusion paths, providing data for the generation of subsequent ransomware threat test cases.

[0162] Step S4: Generating anti-ransomware threat test cases

[0163] This step, based on the threat path generated in step S3, uses a combination of templated and parameterized methods with an LLM framework to generate executable penetration test cases. It also supports manual review and version management. The process is as follows: Figure 4 As shown, the specific steps include the following:

[0164] S41: Define a test case template for anti-ransomware threat.

[0165] To achieve standardized generation of test cases, predefined structured test case templates are used:

[0166]

[0167] Here, `id` is the unique identifier for the test case, generated using a path hash value and timestamp to ensure uniqueness; `obj` is the test target, specifying the ultimate business impact and risk type of the threat path; `env` is the test environment requirements, based on SBOM data and network node attributes, specifying the target system configuration, component information, and network environment; `pres` are the threat prerequisites, including the required attack tools, vulnerability exploitation PoC code, permission requirements, and environment initialization scripts; and `steps` is the attack step sequence, an ordered list. The steps are listed in the order of the threat path nodes, divided into explicit path steps and implicit path steps. Each step includes the operation content, execution command, execution conditions and dependent steps, etc. The results are the expected results, describing the system state or log characteristics that should be observed after each attack step is successful, that is, the characteristic behavior of each node being compromised.

[0168] This standardized template ensures the structural uniformity and completeness of test cases, providing a framework for subsequent automated generation.

[0169] S42: Generating test cases using LLM driven by test case template prompts

[0170] This step is the core of automatic test case generation, using the bidirectional related threat network G (including explicit paths) output in step S3. and implicit paths Using as input, the initial test case set TestCases is generated through the following process:

[0171] Path traversal and test case initialization: For each threat path p∈P, traverse in node order to extract the path node set and edge set; initialize the test case framework T for path p, where, , ,in (To extract the description of the affected business / component from the end node of the path); populate the structured fields of T.env with the SBOM data and the path-related environment context (such as the affected component version, exposed port, runtime permissions).

[0172] Attack Step Sequence Generation: The attack sequence is generated by pulling CVE descriptions, PoC summaries, and known exploit vectors from a vulnerability database to construct a context. The LLM is then invoked with five-dimensional constraint data (path parameters, vulnerability details, environmental constraints, historical cases, and quality requirements). Path parameters are structured data extracted from threat paths (including path node sequences, threat propagation probabilities, and dependency attributes, in JSON format); vulnerability details are vulnerability PoC code snippets, exploit conditions, and verification commands extracted from a knowledge base; environmental constraints are a list of prohibited operations, compliance requirements, and network restrictions for the target system extracted from SBOM data; historical cases are past test cases (including reusable step templates) for similar paths from the enterprise test case library; and quality requirements are constraints on the LLM output (e.g., steps must include specific commands and parameters, avoid vague descriptions, and implicit path steps must be separately labeled). Based on the input, the LLM generates specific command lines, payload patterns, inter-step conditional checks, success detection probes, etc., and concatenates them in the path order to form an initial attack step sequence, `steps`. Each step is accompanied by a confidence level during generation for easy subsequent auditing.

[0173] Template parameter population: For fields that can be directly determined by structured data (such as CVE number, component version, IP / port, file path, and command line flag type), population is performed directly using deterministic rules or mapping tables; for fields that require natural language description (such as operation step details and expected result characteristics), an input context (including structured path parameters, target topology fragments, CVE summary text, PoC summary, organizational compliance constraints, and existing action template examples) is constructed and input into the LLM to obtain several candidate population values ​​and confidence descriptions, and the optimal value is selected to populate the template.

[0174] Through the above process, each threat path p is instantiated to generate a complete initial test case T with specific parameters. All initial test cases constitute the set TestCases. This process achieves efficient transformation from abstract threat paths to specific test steps, significantly improving the automation and accuracy of test case generation.

[0175] S43: Test Case Evaluation and Optimization

[0176] The generated initial test case set, TestCases, is provided to security testing experts for review. Based on their experience, the experts supplement operational details (such as command-line parameters and verification instructions), adjust the order of steps, and confirm the feasibility of the environment to ensure the executability of the test cases, ultimately forming a formal test plan.

[0177] S44: Test Case Entry Management

[0178] To keep test cases synchronized with the dynamically changing threat landscape, an association mapping M(T,P) between test cases and threat paths is established. When the threat knowledge base is updated or SBOM data changes, causing a change in the associated path P (such as adding nodes or deleting relationships), the system automatically triggers an update event to display the changed path. Generate new version test cases It is stored in the version control system along with the old version T, and a change log is recorded to enable version tracking and synchronous updates of test cases, ensuring that test cases are always consistent with the threat situation.

[0179] It should be noted that, in this invention, although the specification describes the embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

Claims

1. A test case generation method for resisting ransomware threats based on multi-layered networks, characterized in that, Includes the following steps: Step S1: Construct a ransomware threat knowledge base based on a time-series knowledge graph. The knowledge base integrates multi-source threat intelligence and depicts the dynamic relationship between ransomware families, vulnerabilities, and components. Step S2: Obtain the Software Bill of Materials (SBOM) data of the target system, identify vulnerable components by combining the ransomware threat knowledge base, and construct a five-layer directed relational network including the ransomware family layer, vulnerability layer, component layer, system layer and business layer based on the vulnerable components and the dependencies in the SBOM data; Step S3: Execute a bidirectional association analysis algorithm in the five-layer directed association network to generate explicit threat paths and implicit threat paths; Step S4: Based on the explicit threat path and the implicit threat path, generate anti-ransomware test cases containing the attack step sequence using a large language model (LLM).

2. The test case generation method for multi-layer network anti-ransomware threat based on claim 1, characterized in that, Step S1 includes the following sub-steps: Step S11: Collect threat intelligence from multiple sources, filter ransomware families with attack activity records, and build a standardized ransomware family library; Step S12: Collect vulnerability information exploited by ransomware families, use CVE numbers as unique identifiers to complete multi-dimensional metadata, and build a multi-source heterogeneous vulnerability database; Step S13: Extract the component information affected by the vulnerability, standardize the component names and version numbers, and build a component library with version tags; Step S14: Use temporal quadruples to characterize the dynamic relationships between ransomware families, vulnerabilities, and components, form a temporal knowledge graph and store it in a graph database, integrate a temporal reasoning engine and support periodic reasoning updates and incremental updates.

3. The test case generation method for multi-layer network anti-ransomware threat based on claim 1, characterized in that, Step S2 includes the following sub-steps: Step S21: Collect the original SBOM data of the target system, perform data cleaning and format standardization, and transform it into machine-parseable structured data; Step S22: Match the standardized SBOM data with the component information in the ransomware threat knowledge base, and identify vulnerable components by accurately matching component names and verifying the version number and the version range affected by the vulnerability; Step S23: Based on the component-system-business dependency relationship in the vulnerable components and SBOM data, construct a five-layer directed association network, establish utilization-influence-being used-support associations between layers, and establish system / business dependency associations within layers.

4. The test case generation method for anti-ransomware threats based on multi-layer networks according to claim 1, characterized in that, Step S3 includes the following sub-steps: Step S31: Traverse the five-layer network in the order of ransomware family layer, vulnerability layer, component layer, system layer, and business layer to extract explicit threat paths between layers; Step S32: Using the threatened nodes in the explicit path as the initial nodes, a depth-first search strategy is adopted to propagate along the intra-layer dependencies and discover the intra-layer implicit threat diffusion path; Step S33: Integrate explicit paths between layers and implicit paths within layers to construct a complete bidirectional correlation analysis network for ransomware threats.

5. The test case generation method for multi-layer network anti-ransomware threat based on claim 1, characterized in that, Step S4 includes the following sub-steps: Step S41: Predefine a structured test case template containing a unique identifier, test objective, environment requirements, preconditions, attack step sequence, and expected results; Step S42: Input threat path parameters, vulnerability details, environmental constraints, historical cases and quality requirements into the LLM to generate an attack step sequence. Fill the template parameters with deterministic rules and the LLM to form initial test cases. Step S43: Perform a manual review of the initial test cases, supplement the operation details and adjust the order of steps. Step S44: Build a test case management library, establish an association mapping between test cases and threat paths, and support version tracking and synchronous updates of test cases.

6. The test case generation method for multi-layer network anti-ransomware threat based on claim 2, characterized in that, In step S14, the temporal quadruple includes two types of association forms: ransomware family-exploitation-vulnerability-time and vulnerability-impact-component-time, and the graph database is the Neo4j graph database.

7. The test case generation method for multi-layer network anti-ransomware threat based on claim 3, characterized in that, In step S21, the structured format of the SBOM data is JSON format, and the dependency relationships include the usage relationship between components and the system, the support relationship between the system and the business, and the dependency relationships between systems and businesses.

8. The test case generation method for multi-layer network anti-ransomware threat based on claim 4, characterized in that, In step S31, the SBOM data is parsed using a threat path analysis algorithm and matched with component, vulnerability, and ransomware family information in the graph database to generate a structured explicit threat path. In step S32, the threat is recursively propagated through the dependency analysis algorithm, and the affected components, systems and business nodes are marked.

9. A test case generation device for multi-layer network anti-ransomware threat, used to implement the test case generation method for multi-layer network anti-ransomware threat as described in claim 1, characterized in that, include: The knowledge base construction module is used to integrate multi-source threat intelligence and build a ransomware threat knowledge base based on a time-series knowledge graph. The multi-layer network construction module is used to acquire SBOM data, identify vulnerable components, and construct a five-layer directed relational network. The threat path generation module is used to perform bidirectional correlation analysis algorithms in a five-layer network to generate explicit and implicit threat paths; The test case generation module is used to generate anti-ransomware test cases containing attack step sequences based on threat paths and LLM.

10. The test case generation device for anti-ransomware threats based on a multi-layer network according to claim 9, characterized in that, The knowledge base construction module includes a temporal knowledge graph generation unit and a knowledge base maintenance unit. The temporal knowledge graph generation unit is used to build a family library, a vulnerability library, and a component library and to characterize dynamic relationships. The knowledge base maintenance unit is used to maintain the effectiveness of the knowledge base through temporal reasoning and incremental update mechanisms.

Images