Attack code generation method and device, equipment, storage medium and computer program product

Abstract

The invention relates to the technical field of network security, and discloses an attack code generation method and device, equipment, a storage medium and a computer program product.The method comprises the steps that in response to an input attack description, intention recognition is conducted on the attack description through a preset large language model, and an attack demand structured description is obtained, the missing attack technology implementation is supplemented through reasoning based on the attack demand structured description and an attack technology knowledge graph, an attack technology chain is generated according to the supplemented attack technology implementation, and the attack technology knowledge graph is used for storing attack technology related knowledge and generating attack technology information. Generating an attack code corresponding to the attack description through a preset large language model according to the attack technology chain; according to the application, the missing steps of the attack chain are supplemented through reasoning based on the attack demand structured description and the pre-constructed attack technology knowledge graph, so that the accuracy of the attack code can be improved, the attack code meeting the demand can be generated, and the aggressive security verification demand can be met.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to an attack code generation method, apparatus, device, storage medium, and computer program product. Background Technology

[0002] Currently, the most direct and effective method for verifying an enterprise's cybersecurity defense level is offensive security verification, which involves assessing the enterprise's defense status by simulating attack payloads. Attack payloads are generated directly or indirectly from attack code. Directly, the code itself is the payload. Examples include attack scripts (Bash scripts, Bat scripts, Javascript scripts, PowerShell scripts, etc.). Indirectly, the code needs to be compiled to generate a binary payload. Examples include C / C++ code and Java code. Using wild-world attack payloads directly has uncontrollable consequences. Using readily available attack tools (e.g., Metasploit, Cobalt Strike) can negatively impact the enterprise's perception of its actual defense status because commercially available security devices and tools are specifically optimized for the characteristics of well-known attack tools. If the defender programs the attack code, it places high demands on security personnel. This significantly increases the cost of offensive security verification for enterprises. Therefore, with the rapid development of large language models, the industry is also exploring the direct use of large language models to generate attack code to assist in offensive security verification. Users describe the attack techniques they want to implement using natural language, and then pass them to a large model for generation.

[0003] However, when generating attack code from natural language descriptions of related technologies, it's difficult for users to provide a comprehensive and accurate description of each attack technique. In most cases, users will only clearly state the main technique and the intended purpose. If a large model is generated directly in this situation, it often skips other steps, generating only the main technique and ignoring the prerequisites for its implementation, which require other attack techniques. This results in insufficient code accuracy, making it difficult to meet the requirements of offensive security verification. Summary of the Invention

[0004] The main objective of this application is to provide an attack code generation method, apparatus, device, storage medium, and computer program product, aiming to solve the technical problem that related attack code generation methods tend to generate only the main attack techniques while ignoring the prerequisites for implementing these main techniques, which require other attack techniques to be acquired, resulting in insufficient code accuracy and difficulty in meeting the requirements of offensive security verification.

[0005] To achieve the above objectives, this application provides an attack code generation method, the attack code generation method comprising: In response to the input attack description, the intent of the attack description is identified by a preset large language model to obtain a structured description of the attack requirements; Based on the structured description of attack requirements and the attack technology knowledge graph, missing attack technologies are supplemented through reasoning, and an attack technology chain is generated based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. Based on the attack technique chain, the attack code corresponding to the attack description is generated using the preset large language model.

[0006] Furthermore, to achieve the above objectives, this application also proposes an attack code generation apparatus, which includes: The intent recognition module is used to respond to the input attack description by performing intent recognition on the attack description through a preset large language model to obtain a structured description of the attack requirements. The attack chain generation module is used to supplement missing attack technologies based on the structured description of attack requirements and the attack technology knowledge graph through reasoning, and to generate an attack technology chain based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. The code generation module is used to generate attack code corresponding to the attack description based on the attack technique chain and the preset large language model.

[0007] In addition, to achieve the above objectives, this application also proposes an attack code generation device, which includes a memory, a processor, and an attack code generation program stored in the memory and executable on the processor. The attack code generation program is configured to implement the attack code generation method described above.

[0008] In addition, to achieve the above objectives, this application also proposes a storage medium storing an attack code generation program, which, when executed by a processor, implements the attack code generation method described above.

[0009] In addition, to achieve the above objectives, this application also provides a computer program product, which includes an attack code generation program, and the attack code generation program implements the attack code generation method described above when executed by a processor.

[0010] One or more technical solutions proposed in this application have at least the following technical effects: This application discloses a method that responds to an input attack description by performing intent recognition on the attack description using a pre-built large language model to obtain a structured description of attack requirements. Based on the structured description of attack requirements and an attack technology knowledge graph, missing attack technology implementations are supplemented through reasoning. An attack technology chain is then generated based on the supplemented attack technology implementations. The attack technology knowledge graph is used to store knowledge related to attack technologies. Attack code corresponding to the attack description is generated based on the attack technology chain using the pre-built large language model. Because this application supplements the missing steps of the attack chain through reasoning based on the structured description of attack requirements and the pre-built attack technology knowledge graph, the accuracy of the attack code can be improved, thereby generating attack code that meets the requirements and satisfying the offensive security verification needs. Attached Figure Description

[0011] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0012] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart illustrating the first embodiment of the attack code generation method of this application; Figure 2 This is a flowchart illustrating the second embodiment of the attack code generation method of this application; Figure 3 This is a schematic diagram of an attack intent recognition module according to an embodiment of the attack code generation method of this application; Figure 4 This is a schematic diagram of an attack chain generation module according to an embodiment of the attack code generation method of this application; Figure 5 This is a schematic diagram of the code generation module of one embodiment of the attack code generation method of this application; Figure 6 This is a flowchart illustrating the third embodiment of the attack code generation method of this application; Figure 7 This is a schematic diagram of the static review module for attack code in one embodiment of the attack code generation method of this application; Figure 8 This is a schematic diagram of the attack code dynamic review module in one embodiment of the attack code generation method of this application; Figure 9 This is a schematic diagram of module interaction in one embodiment of the attack code generation method of this application; Figure 10This is a schematic diagram of the module structure of the attack code generation device according to an embodiment of this application; Figure 11 This is a schematic diagram of the device structure of the hardware operating environment involved in the attack code generation method in the embodiments of this application.

[0014] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0015] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0016] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0017] Currently, the most direct and effective method for verifying an enterprise's cybersecurity defense level is offensive security verification, which involves assessing the enterprise's defense status by simulating attack payloads. Attack payloads are generated directly or indirectly from attack code. Directly, the code itself is the payload. Examples include attack scripts (Bash scripts, Bat scripts, Javascript scripts, PowerShell scripts, etc.). Indirectly, the code needs to be compiled to generate a binary payload. Examples include C / C++ code and Java code. Using wild-world attack payloads directly has uncontrollable consequences. Using readily available attack tools (e.g., Metasploit, Cobalt Strike) can negatively impact the enterprise's perception of its actual defense status because commercially available security devices and tools are specifically optimized for the characteristics of well-known attack tools. If the defender programs the attack code, it places high demands on security personnel. This significantly increases the cost of offensive security verification for enterprises. Therefore, with the rapid development of large language models, the industry is also exploring the direct use of large language models to generate attack code to assist in offensive security verification. Users describe the attack techniques they want to implement using natural language, and then pass them to a large model for generation.

[0018] However, when related technologies generate attack code from natural language descriptions, the accuracy of the generated attack code is often weak, meaning the generated code cannot accurately match the user's desired attack. This is because an attack payload is an attack chain composed of multiple interlocking attack techniques. The conditions for an attack technique to run are created by the preceding attack techniques. For example, in the user requirement of "injecting and executing the code that launches the calculator into the explore.exe process," process injection is the primary attack technique, but it requires preceding attack techniques to enumerate processes to obtain the target process, and also to escalate privileges to allow injection, etc. Users rarely describe each attack technique in detail; in most cases, they only clearly state the main technique and the desired outcome. If a large model is generated directly in this situation, it often skips other steps, generating only the main technique and ignoring the prerequisites for its implementation, which require other attack techniques to obtain the necessary information.

[0019] Therefore, to overcome the above-mentioned deficiencies, this application provides a solution comprising: responding to an input attack description, performing intent recognition on the attack description through a pre-set large language model to obtain a structured description of attack requirements; supplementing missing attack technology implementations through reasoning based on the structured description of attack requirements and an attack technology knowledge graph; and generating an attack technology chain based on the supplemented attack technology implementations. The attack technology knowledge graph is used to store attack technology-related knowledge. Attack code corresponding to the attack description is generated based on the attack technology chain through the pre-set large language model. Because this application supplements the missing steps of the attack chain through reasoning based on the structured description of attack requirements and a pre-built attack technology knowledge graph, the accuracy of the attack code can be improved, thereby generating attack code that meets the requirements and satisfying offensive security verification needs.

[0020] It should be noted that the execution subject of this embodiment can be an attack code generation device with data processing, network communication and program execution functions, such as a computer, server, or other electronic devices that can achieve the same or similar functions. This embodiment does not limit this.

[0021] Based on this, embodiments of this application provide an attack code generation method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the attack code generation method of this application.

[0022] In the first embodiment, the attack code generation method includes: Step S10: In response to the input attack description, the intent of the attack description is identified by a preset large language model to obtain a structured description of the attack requirements.

[0023] It should be understood that an attack description can refer to a user's attack request expressed in natural language, such as "injecting the explore.exe process of another account," which is the starting point of the entire process. Intent recognition can refer to the process of mining the true needs behind the user's natural language attack description based on a pre-set Large Language Model (LLM) and attack technology knowledge graph, supplementing key information through interaction, and forming a standardized description. The pre-set Large Language Model (LLM) can refer to a pre-trained natural language processing model with capabilities such as information extraction, interactive guidance, code generation, and error analysis; it is the core tool for achieving intent recognition, attack chain fusion, code generation, and iterative optimization. The structured description of attack requirements can contain standardized data with two core components: first, the initial state before the attack (such as user permissions, operating environment, etc.); and second, detailed information on the implementation of one or more attack technologies (including entity name, type, detailed description, required parameters, etc.).

[0024] In its implementation, after receiving the attack description input by the user, the pre-defined large language model first extracts key information about the attack techniques (e.g., extracting "injection," "other accounts," "explore.exe," and "process" from "injecting into the explore.exe process of other accounts"). Then, it calls the entity similarity retrieval submodule of the attack technique knowledge graph. This module, based on pre-stored graph entity vectors in a vector database (encoded using algorithms such as Word2Vec and BERT), uses similarity algorithms such as vector distance to match the most fitting attack technique implementation entity in the graph. Afterward, the large language model guides the user interaction: confirming the matched attack technique implementation, supplementing necessary parameters (such as target account and process identifier), and initial state (such as user permissions). For parameters not provided by the user, the model will appropriately supplement them based on the graph entity information, ultimately forming a standardized, structured description of the attack requirements.

[0025] Step S20: Based on the structured description of the attack requirements and the attack technology knowledge graph, the missing attack technology implementation is supplemented by reasoning, and an attack technology chain is generated according to the supplemented attack technology implementation. The attack technology knowledge graph is used to store knowledge related to attack technologies.

[0026] Understandably, an attack technique knowledge graph can refer to a structured system that stores attack-related knowledge. Its core includes two types of entities ("attack technique implementation": the specific process of implementing the attack technique; "attack conditions": the prerequisites for implementing the attack technique) and two types of relationships ("leading to": attack conditions supporting the implementation of the attack technique; "generating": the implementation of the attack technique generates new attack conditions). Attack technique implementation can refer to the specific execution process of an attack technique, such as "achieving auto-start by modifying the registry" or "using Fodhelper.exe to bypass UAC," which are the basic building blocks of an attack technique chain. An attack technique chain can refer to a complete attack process formed by multiple attack technique implementations linked together according to the dependency relationship of "attack conditions - attack techniques," including the core attack techniques required by the user and supplementary pre- / connecting attack techniques.

[0027] In its implementation, based on structured descriptions and combined with an attack technology knowledge graph, the reasoning submodule analyzes the matching degree between the preconditions and initial state of the attack technology implementation. If the initial state cannot meet the implementation conditions of the core attack technology (e.g., ordinary user privileges cannot support "injecting other user processes"), or if there is a lack of connection between multiple attack technology implementations, the reasoning submodule will use the "cause" and "generate" relationships in the graph to search for and supplement the missing attack technology implementations (e.g., supplementing "UAC bypass" privilege escalation technology). Subsequently, the large language model will integrate the supplemented attack technology implementations into an easy-to-understand attack flow description, confirm with the user, and finally generate a complete structured description of the attack technology chain.

[0028] Furthermore, the dispersed attack technology information is integrated into a traceable and reasonable knowledge network, providing core knowledge support for attack intent identification and attack chain generation. The attack technology knowledge graph includes entities and relationships. The entities include attack technology implementation and attack conditions. The relationships include causal relationships and generation relationships. The causal relationship describes the relationship in which the attack conditions make the attack technology implementation possible. The generation relationship describes the attack technology implementation generating new attack conditions.

[0029] For ease of understanding, the following examples are provided, but they are not intended to limit this application. As an example, this embodiment involves a self-built attack technique knowledge graph. The attack technique knowledge graph primarily consists of two entity types and two relationships: 1. "Attack Technique Implementation" Entity Type: Represents the specific implementation process of an attack technique.

[0030] For example, you can achieve automatic startup by modifying the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.

[0031] 2. "Attack Condition" Entity Type: Represents a prerequisite required for the implementation of an attack technique. The implementation of an attack technique requires one or more prerequisites.

[0032] For example, a prerequisite for the attack technique to achieve "auto-start by modifying the registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" is "a process with administrator privileges".

[0033] Two main relationships: 1. "Cause" relationship: This describes the relationship in which attack conditions make the implementation of attack techniques possible.

[0034] "Attack Conditions" entity type - ["Cause"] -> "Attack Technique Implementation" entity type; For example: "Processes with administrator privileges" - ["cause"] -> "achieve automatic startup by modifying the registry HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run".

[0035] 2. "Generation" relationship: This describes how attack techniques generate new attack conditions.

[0036] "Attack Technique Implementation" entity type - ["Generation"] -> "Attack Condition" entity type; For example: "Use Fodhelper.exe to bypass UAC" -> ["Generate"] -> "Process with administrator privileges".

[0037] Step S30: Generate attack code corresponding to the attack description based on the attack technique chain and the preset large language model.

[0038] It should be understood that attack code can refer to executable code that can implement the attack technique chain, including script-type code (such as PowerShell scripts) or compiled binary files, and also includes supporting code to verify whether the attack was successful.

[0039] In its implementation, the pre-defined large language model receives a structured description of the attack technique chain. It first determines whether to retrieve corresponding code examples from the attack technique knowledge graph. If so, it uses the graph retrieval function to obtain code examples of each attack technique implementation, then integrates the logical relationships of the attack technique chain to form prompt words. If no retrieval is needed, the model directly generates code based on the attack technique chain logic. The generated code must include core attack functionality code and verification code, and support iterative adjustments after subsequent static and dynamic reviews. If errors are found during review, the model optimizes the code based on the reasons for failure, ensuring the code's completeness and feasibility.

[0040] This embodiment, based on a structured description of attack requirements and a pre-built knowledge graph of attack techniques, supplements the missing steps of the attack chain through reasoning, thereby improving the accuracy of the attack code and generating attack code that meets the requirements, thus satisfying the offensive security verification needs.

[0041] Reference Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the attack code generation method of this application, based on the above. Figure 1 The first embodiment shown is followed by a second embodiment of the attack code generation method of this application.

[0042] In the second embodiment, step S10 includes: Step S101: In response to the input attack description, extract key attack technology information from the attack description using the preset large language model.

[0043] It should be understood that key information about attack techniques can refer to the core elements directly related to the attack techniques extracted from the user's attack description. It is an "index" for retrieving the knowledge graph of attack techniques. For example, "injection" (attack action), "other account" (target subject), "explore.exe" (target object), and "process" (object type) can be extracted from "explore.exe process that injects into other accounts".

[0044] Step S102: Based on the key information of the attack technique, retrieve the matching attack technique implementation entity in the preset vector database, wherein the preset vector database stores the vectorized encoding results of the entity description in the attack technique knowledge graph.

[0045] Understandably, an "attack technique implementation entity" can refer to one of the core entity types in an attack technique knowledge graph, representing the specific implementation process of a certain attack technique. It includes information such as entity name, detailed description, required parameters, and applicable platform, for example, "injecting a process belonging to another user onto a Windows host." A pre-defined vector database can refer to a dedicated database that stores the vectorized encoding results of the description information of all entities (including attack technique implementation and attack conditions) in the attack technique knowledge graph. It supports efficient similarity retrieval and includes types such as FAISS and Milvus, serving as the data carrier for entity matching. The vectorized encoding result of the entity description can refer to the text information of entities in the attack technique knowledge graph (such as a detailed description and parameter requirements of an "attack technique implementation"), which is converted into computer-computable vector data through vectorization algorithms (such as BERT). This vector reflects the semantic features of the entity and is the core data form for similarity matching in the vector database.

[0046] Furthermore, in order to accurately identify attack technology implementation entities that match user needs from the attack technology knowledge graph, providing a reliable core basis for subsequent generation of structured descriptions of attack requirements and construction of attack technology chains, and avoiding deviations from user needs in subsequent processes due to entity matching errors, step S102 includes: converting the extracted key information of the attack technology into a retrieval vector using a vectorization encoding algorithm consistent with the preset vector database; calculating the similarity between the retrieval vector and entity vectors in the preset vector database using a preset similarity algorithm; selecting attack technology implementation entities with similarity not lower than a preset similarity threshold as candidate entities; if there are multiple candidate entities, performing an adaptation ranking of the candidate entities using the preset large language model combined with the semantics of the attack description, and selecting at least one entity as the matching attack technology implementation entity based on the ranking result.

[0047] It should be understood that vectorization encoding algorithms refer to algorithms that convert textual entity descriptions or key information of attack techniques into computer-computable vector data. The encoding results must reflect the semantic features of the text. Examples include Word2Vec, BERT, SBERT, and BGE, which are core technologies for semantic matching. Retrieval vectors refer to vector data obtained after the key information of attack techniques is converted using a vectorization encoding algorithm. Their encoding algorithm must be consistent with the encoding algorithm of entity vectors in the pre-defined vector database to ensure they are in the same vector space and can be used for similarity calculation. Entity vectors refer to vector data generated after vectorization encoding of entities in the attack technique knowledge graph (such as detailed descriptions of attack techniques and parameter requirements). This is the core storage content of the pre-defined vector database and is used for similarity comparison with retrieval vectors. Pre-defined similarity algorithms refer to algorithms used to calculate the similarity between retrieval vectors and entity vectors. The core of these algorithms is to determine semantic relevance by measuring the distance between vectors (such as Euclidean distance or cosine distance). The smaller the distance, the higher the similarity, which is the basis for selecting candidate entities. The preset similarity threshold refers to a pre-defined similarity judgment standard (e.g., 0.8). When the similarity result between the search vector and the entity vector is not lower than this threshold, the corresponding entity is judged to meet the requirements and can be included in the candidate range to filter irrelevant or low-related entities. Candidate entities refer to attack technology implementation entities whose similarity results are not lower than the preset threshold after similarity calculation. They are the objects of subsequent adaptation ranking and may be single or multiple. Adaptation ranking refers to the process of prioritizing the fit between candidate entities and user needs by combining a preset large language model with the semantics of the user's original attack description when there are multiple candidate entities. The ranking criteria include the semantic matching degree between the entity and the attack description, consistency of applicable scenarios, etc. The matched attack technology implementation entity refers to the attack technology implementation entity that best fits the user's attack needs after adaptation ranking (entities confirmed by the user from the Top 1 or Top N can be selected). It is the core basis for generating a structured description of the attack needs.

[0048] Step S103: Based on the attack technique, the entity generates a structured description of the attack requirements through the preset large language model.

[0049] Understandably, a structured description of attack requirements can include standardized data containing two core elements: first, the initial state before the attack is launched (such as user permissions, runtime environment, etc.); and second, detailed information on the implementation of one or more attack techniques (including entity name, type, detailed description, required parameters, etc.).

[0050] Furthermore, in order to integrate the initial attack state with the complete attack technology implementation entity information and provide clear and directly usable input for the subsequent attack technology chain generation module, step S103 includes: obtaining detailed information of the attack technology implementation entity from the attack technology knowledge graph; confirming the initial state before the attack is launched and the required parameters of the attack technology implementation entity based on the detailed information through the preset large language model; and generating a structured description of the attack requirements based on the initial state and the required parameters.

[0051] It should be understood that detailed information can refer to the complete data stored in the knowledge graph of the entity implementing the attack technique, covering the entity name, entity type (attack technique implementation), description of the technique implementation steps, required configuration parameters (such as target account, process ID), applicable operating system platform (such as Windows / Linux), etc., which is the basis for subsequent confirmation of the initial state and parameters. The initial state before the attack can refer to the pre-attack environment conditions before the attack is implemented, the core of which includes the user's current permissions (such as ordinary user, administrator permissions), the operating system platform of the attack target (such as Windows 10), etc., which is a key prerequisite for determining whether the attack technique can be implemented. The required parameters of the entity implementing the attack technique can refer to the key information that must be configured for the normal operation of the entity implementing the attack technique, which is explicitly specified by the "detailed information" of the entity in the knowledge graph. For example, "process injection" requires "target account name" and "target process name / ID". If these are missing, the attack technique cannot be executed accurately.

[0052] For ease of understanding, please refer to Figure 3 This explanation is provided, but does not limit the scope of this application. Figure 3 This diagram illustrates an attack intent recognition module according to an embodiment of the attack code generation method of this application. This module receives an attack description expressed by the user in natural language, and uses an LLM (Learning Power Management) based on the user's attack description, combined with attack technique knowledge from an attack technique knowledge graph, to guide the user's interaction step-by-step, obtaining an accurate and complete structured description of one or more attack techniques that accurately expresses the user's attack requirements. Figure 3 As shown, the workflow of the attack intent identification module is as follows: 1. Users input attack descriptions using natural language.

[0053] For example: The user enters "inject the explore.exe process of another account".

[0054] 2. The system calls LLM to process the input: extract information related to attack techniques, and then use the extracted information to retrieve the corresponding attack technique data in the attack technique knowledge graph.

[0055] For example: key information extracted from the user: "injection", "other accounts", "explore.exe", "process".

[0056] 3. The system transmits the extracted key information to the attack technique knowledge graph entity similarity retrieval submodule for similarity retrieval.

[0057] The attack technique knowledge graph entity similarity retrieval submodule is primarily responsible for integrating one or more input key information pieces and searching for the most similar entities in the graph using a similarity algorithm. There are various similarity algorithms, including but not limited to vector distance and keyword matching. The following examples assume the use of vector distance for similarity matching.

[0058] 4. To enable rapid retrieval of entity data in the attack technique knowledge graph, the descriptive information of the entities in the graph is vectorized and encoded, and the vector data is stored in a vector database (i.e., the attack technique knowledge graph entity vector library). Various vectorization encoding algorithms are available, including but not limited to: Word2Vec, BERT, SBERT, BGE, etc. Multiple vector databases are also available, including but not limited to: FAISS, Milvus, etc. The system searches the vector database for the most similar entity based on the vectorized results of the key information input in step 3. "Most similar" can be a range, meaning either the most similar entity or n similar entities.

[0059] 5. The system retrieves the entities from the vector database and obtains detailed information about these entities from the attack technology knowledge graph, such as detailed descriptions and parameters.

[0060] For example: information about the most similar entity obtained from the graph: { Entity name: Injecting a process belonging to another user into a Windows host; Entity type: Attack technique implementation; Detailed description: ...; Required parameter: target process name or ID; ...... } 6. The system obtained detailed information about the entity that implemented the attack technique most similar to the user's input.

[0061] 7. If no information about the entities in the map is obtained, ask the user for more information.

[0062] 8. If the user provides more information, continue to step 2.

[0063] 9. If one or more highly similar attack technique implementations are obtained, the system calls the LLM (Local Management Model) to combine the user's information and select the best match. If it can be selected, the attack technique implementation is rewritten based on the user's input to better suit the user's expectations and make it easier for the user to understand. These become the alternatives, and then the user is asked to select and confirm.

[0064] 10. If the user is not satisfied with any of the options, they can provide additional information to continue to step 2.

[0065] 11. The system utilizes LLM to query the necessary parameters for each attack technique selected by the user and to clearly communicate the initial state before the attack is launched (including user permissions, etc.). For example: The system prompts you to enter the user account, process name, or process ID you want to inject.

[0066] User input: User account is Jack, process is explore.exe.

[0067] The system asks: What are your initial permissions? User input: Regular user.

[0068] 12. The user provides the parameters and initial state. If not provided, they will be completed in a later step.

[0069] 13. The system calls LLM to analyze and extract parameters from the user's input to supplement the attack technique implementation. If no parameters are provided, the LLM is called to supplement the parameters appropriately based on the entity's detailed information. Then, the structured information content of the attack technique implementation is output as this module.

[0070] For example: { Entity name: Injecting a process belonging to another user into a Windows host; Entity type: Attack technique implementation; Detailed description: ...; Required parameter: {process name: explore.exe}; ...... } The attack technique intent identification module outputs two main parts: (1) the initial state; and (2) detailed information on the implementation of one or more attack techniques.

[0071] This embodiment combines the semantic understanding capabilities of a large language model with the efficient retrieval capabilities of a vector database to identify the intent of an attack description and obtain a structured description of the attack requirements. This not only accurately captures the user's true attack intent but also standardizes the requirements through structured description, thus laying a solid foundation for subsequent attack technology chain reasoning and attack code generation.

[0072] In the second embodiment, step S20 includes: Step S201: Analyze the matching degree between the initial state in the structured description of the attack requirements and the preconditions for the implementation of each attack technique.

[0073] It should be understood that this embodiment relies on the reasoning capabilities of the knowledge graph to ensure the technical feasibility of the attack chain, and through user interaction, it can further ensure the scenario adaptability of the attack chain. The precondition matching degree refers to the degree of fit between the initial state and the preconditions for implementing the attack technique. If the initial state meets the preconditions, the matching degree is high (it can be executed directly); if it does not meet the preconditions, the matching degree is low (pre-attack techniques need to be added). This is the core basis for determining whether additional attack techniques are needed.

[0074] Step S202: Based on the preset entities and relationships in the attack technology knowledge graph, missing attack technologies are supplemented through reasoning retrieval.

[0075] Understandably, reasoning retrieval refers to the process of finding missing attack technology implementations by logically traversing entities and relationships within an attack technology knowledge graph (e.g., "initial state → missing condition → attack technology that can generate the condition"). The core is to fill gaps in the attack process using the "cause" and "generate" relationships. Missing attack technology implementations can refer to the necessary pre-attack technologies (or connecting technologies) that need to be added when the initial state and the preconditions for the target attack technology implementation do not match. These technologies are used to construct a feasible path from the initial state to the target technology, such as the missing "UAC bypass" technology between "ordinary user privileges" and "process injection."

[0076] Furthermore, in order to both overcome the initial obstacle from the starting point to the target through pre-supplementary techniques and eliminate the gaps in the chain through intermediate supplementary techniques, ultimately forming a logically closed-loop, conditionally adapted attack technique chain, step S202 includes: if the initial state does not meet the preconditions for the implementation of the first target attack technique, then an attack technique implementation that enables the preconditions to be met based on the relationship retrieval is used as a pre-supplementary technique; if there is a conditional gap between two adjacent attack technique implementations, then an attack condition that can be generated based on the relationship retrieval of the preceding technique implementation is used, and an attack technique implementation that enables the relationship retrieval to connect the condition with the preconditions of the subsequent technique implementation is used as an intermediate supplementary technique, and the supplementary attack technique implementations are chained together in a preset logical order.

[0077] It should be understood that the first target attack technique implementation can refer to the attack technique entity corresponding to the user's core attack requirement. It is the "end target" of the attack technique chain, stored in the attack technique knowledge graph, and contains a clear implementation process and preconditions, such as "injecting the explore.exe process of the Jack account on a Windows host." Preconditions can refer to the necessary conditions for a certain attack technique implementation to execute normally. They belong to the "attack condition" entity in the attack technique knowledge graph and are the core threshold for the implementation of the attack technique. For example, the precondition for "injecting other user processes" is "having administrator privileges." Pre-emptive supplementary techniques can refer to the attack technique implementations that need to be supplemented when the initial state does not meet the preconditions of the first target attack technique implementation. Their role is to transform the initial state into conditions that meet the preconditions of the target technique. For example, "ordinary user privileges" cannot meet the "administrator privileges" prerequisite for "process injection," so "UAC bypass" needs to be supplemented as a pre-emptive supplementary technique. A conditional gap refers to a situation where the attack conditions generated by the preceding attack technique do not match the prerequisites required by the following technique. For example, the preceding technique generates "normal user privileges," while the following technique requires "administrator privileges." This difference in privileges constitutes a conditional gap. An intermediate supplementary technique refers to an attack technique used to bridge the conditional gap between adjacent attack techniques. Its function is to transform the conditions generated by the preceding technique into prerequisites required by the following technique. For example, if the preceding technique generates "normal user privileges," while the following technique requires "administrator privileges," then "vulnerability privilege escalation" can serve as an intermediate supplementary technique. A pre-defined logical order refers to the execution order of each attack technique in the attack technique chain, following a "condition-technique" dependency logic. That is, the conditions generated by the preceding technique support the execution of the following technique, ensuring that the attack process progresses from the initial state to the target technique step by step. Examples include "preliminary supplementary technique → first target attack technique implementation" and "preliminary technique → intermediate supplementary technique → subsequent technique."

[0078] In practical implementation, scenario 1: the initial state does not meet the prerequisites for the implementation of the first target attack technique: First, identify the "gap": Extract the initial state (e.g., "Windows 10, ordinary user privileges") from the structured description of the attack requirements. Retrieve the preconditions (e.g., "administrator privileges") of the first target attack technique implementation (e.g., "injecting the explore.exe process into the Jack account") from the knowledge graph. Confirm the gap between the initial state and the preconditions ("ordinary user privileges" → "administrator privileges"). Next, retrieve the necessary supplementary techniques: Using the "required preconditions (administrator privileges)" as the core, and based on the "causal relationship" (attack condition → attack technique implementation) of the knowledge graph, reverse the search to find attack techniques that enable the fulfillment of these preconditions. This involves retrieving the reverse logic of all attack techniques "caused by administrator privileges" (actually, it involves retrieving attack techniques "that can generate administrator privileges," since "generation relationship" and "cause relationship" are complementary: A generates B, B causes C, so A can be used as a prerequisite technique for C). For example, if "UAC bypass using Fodhelper.exe" is matched (this technique generates "administrator privileges" through "generation relationship," and "administrator privileges" support "process injection" through "cause relationship"), this technique is identified as a prerequisite technique.

[0079] Scenario 2: A conditional gap exists between two adjacent attack techniques: First, identify the gap: Identify two adjacent techniques (technique A and technique B). Retrieve the "generation conditions" (attack conditions generated after A's execution, e.g., A is "normal user login," and the generation condition is "normal user privileges") and the "preconditions" (conditions B must satisfy, e.g., "administrator privileges") of A from the knowledge graph, confirming the conditional gap between them ("normal user privileges" → "administrator privileges"). Next, search for intermediate supplementary techniques: First, based on the "generation relationship," clarify the output condition (normal user privileges) of technique A; second, based on the "cause relationship," clarify the input condition (administrator privileges) of technique B; third, search for attack techniques that can transform "A's output conditions" into "B's input conditions." That is, search for attack techniques that "generate administrator privileges" and whose "precondition is normal user privileges." For example, matching "privilege escalation using the MS17-010 vulnerability" (this technique's precondition is "normal user privileges," and "administrator privileges" are generated through the "generation relationship"), identifying this technique as an intermediate supplementary technique.

[0080] Finally, the supplementary techniques are linked together: whether the supplementary techniques are pre-existing or intermediate, they are all linked together according to a "pre-defined logical order". Pre-existing supplementary techniques are placed before the first target technique (initial state → pre-existing supplementary technique → first target technique); intermediate supplementary techniques are placed between adjacent techniques in the gap (previous technique → intermediate supplementary technique → next technique), forming a logically coherent sequence of attack techniques.

[0081] Step S203: Generate at least one candidate attack technique chain containing supplementary attack techniques, convert the candidate attack technique chain into a natural language description through the preset large language model and confirm it with the user, and determine the attack technique chain based on the confirmation result.

[0082] Understandably, a candidate attack technology chain can refer to a complete attack flow scheme formed after supplementing missing technologies. A candidate chain contains a coherent logic of "initial state → implementation of preliminary attack technology → implementation of target attack technology," and there may be multiple chains (because the same missing condition can be generated by multiple attack technologies, such as "privilege escalation" which can be achieved through UAC bypass, vulnerability exploitation, etc.). An attack technology chain can refer to the final complete attack flow after user confirmation. It is a closed-loop process formed by multiple attack technology implementations connected according to the "condition-technology" dependency relationship, ensuring that the user's attack target can be ultimately achieved starting from the initial state. It is the direct basis for generating subsequent attack code.

[0083] For ease of understanding, please refer to Figure 4 This explanation is provided, but does not limit the scope of this application. Figure 4 This is a schematic diagram of an attack chain generation module according to an embodiment of the attack code generation method of this application, as shown below. Figure 4 As shown, the workflow of the attack chain generation module is as follows: 1. Based on one or more attack technology implementations and initial states inputted, the system uses reasoning on the attack technology knowledge graph to find missing attack technology implementations.

[0084] Since the initial state input by the user does not meet the conditions for launching the specified attack technique, or multiple attack techniques cannot be reasonably connected through the attack conditions, it is necessary to supplement them with some attack techniques to connect them.

[0085] For example, the user inputs their current status as a regular user, but "injecting a process belonging to another user on a Windows host" requires administrator privileges. This necessitates adding a privilege escalation (raising the user's privileges to administrator) attack machine technique before implementing this attack technique.

[0086] To achieve this functionality, we need to use the two relationships emphasized in the attack knowledge graph introduced earlier: "Cause" Relationship: "Attack Condition" Entity Type - ["Cause"] -> "Attack Technique Implementation" Entity Type.

[0087] "Generation" Relationship: "Attack Technique Implementation" Entity Type - ["Generation"] -> "Attack Condition" Entity Type.

[0088] In addition, a reasoning submodule based on this knowledge graph is added. This submodule navigates and filters through these two relationships between attack implementations and attack conditions to find potentially missing attack implementations. It is possible to find more than one attack implementation chain, because the same attack condition may generate multiple attack implementations. Thus, one or more attack implementation chains are generated.

[0089] 2. The system calls LLM to merge each attack technique chain and expresses it in clear and easy-to-understand language to communicate with the user, allowing the user to select and confirm the attack technique chain.

[0090] 3. Users can choose to confirm an attack technique chain (next step), or if they are not satisfied, they can provide modification information (go to step 2 of the attack technique intent identification module).

[0091] 4. This module outputs a structured and complete attack technique chain.

[0092] In this embodiment, the reasoning capabilities of the knowledge graph are relied upon to ensure the technical feasibility of the attack chain, and through user interaction, the scenario adaptability of the attack chain can be ensured.

[0093] In the second embodiment, step S30 includes: Step S301: Evaluate whether the attack technique chain needs to call the attack technique code examples stored in the attack technique knowledge graph through the preset large language model.

[0094] It should be understood that this embodiment reduces the illusion of a large model through code examples and ensures that the code conforms to the attack chain logic through prompt word fusion. Here, attack technique code examples can refer to referable code snippets / complete code bound to the "attack technique implementation" entity in the attack technique knowledge graph. These can cover script-based (such as PowerShell) or compiled (such as C++) code, for example, a PowerShell script example corresponding to "Fodhelper.exe UAC bypass" or a C++ code example corresponding to "process injection," used to provide syntactic and logical references for generating code for the large model.

[0095] Step S302: If a call is required, retrieve the code examples corresponding to each attack technique implementation from the attack technique knowledge graph, and generate prompt words by combining the attack technique chain description and the code examples.

[0096] Understandably, the prompt text can refer to the standardized input text formed by integrating the logical flow of the attack technique chain with the code examples of each attack technique. It needs to clearly inform the large model of the attack target, technical steps, code type (such as script / binary) and verification requirements. It is the "instruction template" for the large model to generate accurate attack code.

[0097] Step S303: Input the prompt word into the preset large language model, and generate the attack code corresponding to the attack description through the preset large language model.

[0098] For ease of understanding, please refer to Figure 5 This explanation is provided, but does not limit the scope of this application. Figure 5 This is a schematic diagram of the code generation module of one embodiment of the attack code generation method of this application, as shown below. Figure 5 As shown, the workflow of the code generation module is as follows: 1. When this module receives input from the attack chain generation module, the input includes an attack chain description. The system calls LLM to evaluate whether the attack chain can be directly used to generate code, or whether code samples need to be retrieved for inspiration. When this module receives input from the two code review modules described later, the input includes an attack chain description, attack chain code, the reason for review failure, and other information. The system calls LLM to evaluate whether the code can be directly adjusted to fix the error based on the error reason and the code (go to step 5), or whether code samples need to be retrieved for inspiration.

[0099] 2. When the LLM determines that code samples need to be retrieved, it invokes the retrieval function of the attack technique knowledge graph. Based on each attack technique implementation in the attack technique chain, it retrieves code samples existing in the graph. The graph's retrieval function interface is integrated with the LLM, allowing for function interface calls. This can be achieved through various techniques, such as MCP, function calls, etc.

[0100] 3. The system integrates the description of the attack technique chain and code examples of the attack techniques involved to form a prompt. If the input comes from the latter two code review modules, the prompt should also include: the code that failed the review, the reason for the error, and the information of the runtime output (if any).

[0101] 4. LLM generates the code to implement the attack technique chain (including attack code and code to verify success). Module output: description of the attack technique chain, and the corresponding code for the attack technique chain (including attack code and code to verify success).

[0102] 5. Based on the reasons for the audit failure and the original attack technique chain code, LLM regenerates the modified code. Module output: description of the attack technique chain, and the corresponding code for the modified attack technique chain (including the attack code and the code for verifying success).

[0103] This embodiment reduces the illusion of large models through code examples and ensures that the code fits the attack chain logic through cue word fusion.

[0104] Reference Figure 6 , Figure 6 This is a flowchart illustrating the third embodiment of the attack code generation method of this application. Based on the above embodiments, a third embodiment of the attack code generation method of this application is proposed.

[0105] In the third embodiment, after step S30, the method further includes: Step S40: Perform static verification on the attack code, wherein the static verification is used to check for code syntax and logic defects.

[0106] It should be understood that the methods used to generate attack code also suffer from weak correctness. Specifically, the generated code may fail to compile due to syntax errors, or it may compile but encounter errors during execution. This problem is relatively minor with directly executable script-based attack code. Since these languages ​​essentially rely on well-encapsulated libraries for calls and combinations, writing the code is relatively simple. However, this issue becomes severe with programming languages ​​that require compilation into binary payloads. Because these languages ​​are lower-level languages, the attack functionality they implement requires more code and more library calls, leading to more complex program structures. All of these factors significantly increase the probability of errors in the generated code for larger models.

[0107] Therefore, in order to overcome the above-mentioned defects, in this embodiment, the attack code is also subjected to static verification and dynamic verification step by step. After the verification is passed, the attack code is used as the final attack code and the final attack code is output.

[0108] Static verification refers to non-runtime verification performed first after the attack code is generated. Its core objective is to identify syntax and logical flaws in the code. It does not require actual code execution and is primarily achieved through compilation tools (for compiled languages) and a pre-defined large language model (for all types of code). It is a crucial step in filtering out basic errors in advance. Syntax flaws refer to issues where the code does not conform to the syntax rules of the programming language, such as missing brackets or undefined variables in compiled languages ​​(C++), or misspelled commands in scripting languages ​​(Powershell), which can cause the code to fail to compile or directly report errors. Logical flaws refer to issues where the code's syntax is correct but its execution logic does not meet the attack requirements, such as a UAC bypass script failing to verify privilege escalation results, or process injection code failing to check the existence of the target process, resulting in code that "can run but does not achieve the attack effect."

[0109] Furthermore, to improve the static verification effect, step S40 includes: if the attack code is a compiled language, then calling a preset compilation tool to compile the attack code; if a compilation error occurs, then extracting the error information and correcting the code syntax errors through the preset large language model until compilation is successful or a preset number of iterations is reached; if the attack code is a scripting language or compilation is successful, then using the preset large language model in conjunction with the attack technology chain to review the logical integrity and functional compliance of the attack code, and performing static verification on the attack code based on the review results.

[0110] It's understandable that compiled languages ​​refer to languages ​​that require a compiler to convert source code into a binary executable file before they can run, such as C / C++ (the "process injection code" in the example). They cannot compile if syntax errors exist, and syntax issues must be addressed first. Scripting languages ​​refer to languages ​​that do not require compilation and can be executed directly by an interpreter, such as PowerShell and Bash (the "UAC bypass script" in the example). Syntax errors will cause execution errors, but logic auditing can proceed without a compilation step. Pre-configured compilation tools refer to code compilation software pre-configured for compiled languages, such as MSVC (Microsoft Compiler) and GCC (GNU Compiler) for C++. These tools are used to detect syntax errors in compiled code and are the core tools for "syntax correction" in static verification. Compilation errors refer to errors output by the compiler during the compilation process due to non-compliance with programming language syntax rules (such as missing parentheses, unreferenced header files, undefined variables), such as "error C2065: 'CreateRemoteThread': undeclared identifier". Error messages can refer to detailed prompts from the compiler, including the error type and location, such as "Line 15: Missing semicolon" or "Line 8: Windows.h header file not included." These are crucial for the default large language model to locate and correct syntax errors. The default number of iterations refers to the maximum number of corrections (e.g., 3) pre-set to avoid infinite loops in compilation error correction. If the compilation still fails after exhausting the iteration count, it must return to the code generation stage for regeneration, rather than continuing ineffective corrections. Logical completeness refers to whether the execution logic of the attack code completely covers all steps of the attack technique chain, without omissions or skips. For example, whether the entire process of "UAC bypass → process enumeration → process injection" is implemented, not just "process injection." Functional compliance refers to whether the expected function of the attack code is consistent with the attack technique chain description, i.e., whether the code logic can support achieving the attack target. For example, whether the "UAC bypass script" can truly obtain administrator privileges, and whether the "process injection code" can accurately locate explore.exe for the Jack account.

[0111] For ease of understanding, please refer to Figure 7 This explanation is provided, but does not limit the scope of this application. Figure 7 This is a schematic diagram of the static review module for attack code in one embodiment of the attack code generation method of this application, as shown below. Figure 7 As shown, the workflow of the static code review module is as follows: 1. This module inputs a description of the attack technique chain and the corresponding code. If the code is in a compiled language, a compilation tool is invoked to compile the code. The purpose is to identify syntax errors.

[0112] 2. If a compilation error occurs, the system calls LLM to modify the code based on the error information. Then, it goes to step 1.

[0113] 3. If compilation is successful or the language is not compiled, the system calls LLM to review the generated code based on the description of the attack technique chain to find any logical problems, functional implementation problems, etc.

[0114] 4. If the LLM review fails, go to the code generation module (including the reason for failure and the attack technique chain code).

[0115] 5. If the LLM review is approved, output the structured description of the attack technique chain, the code corresponding to the attack technique chain (including the attack code and the code for verifying success), and (if it is a compiled language) the compiled binary executable file.

[0116] Step S50: If the static verification passes, the attack code is dynamically verified, wherein the dynamic verification is used to check whether the attack effect of the code in the actual running environment matches the attack description.

[0117] It should be understood that dynamic verification refers to the verification of code executed in a simulated real-world environment after static verification has passed. The core objective is to verify whether the actual attack effect of the code matches the user's attack description. This requires a virtualization platform and is a crucial step in ensuring the code's "practical usability." The actual running environment refers to a simulated environment adapted to the attack technique chain, typically a pre-defined virtual machine (such as Windows 10 or a Linux virtual machine). The environment configuration (such as operating system version and initial permission state) must be consistent with the platform described in the attack technique chain (e.g., if the attack chain targets Windows 10, then a Windows 10 virtual machine is used) to avoid distortion of verification results due to environmental differences. The attack effect refers to the actual attack result achieved after the code runs, which must completely match the user's attack description (e.g., "injecting into the explore.exe process of another account"). For example, "successfully escalating privileges to administrator privileges" or "detecting injected payloads in the explore.exe process" both constitute expected attack effects.

[0118] Furthermore, to improve the dynamic verification effect, the dynamic verification of the attack code includes: starting an adapted preset virtual machine environment according to the platform attributes corresponding to the attack techniques implemented in the attack technique chain; transmitting the attack code and preset verification code to the virtual machine environment, running the attack code and recording the running information in real time; after the attack code finishes running, executing the preset verification code to verify whether the attack effect has achieved the target described in the attack, and dynamically verifying the attack code based on the verification result.

[0119] Understandably, the platform attribute corresponding to the attack technique implementation in the attack technique chain can refer to the core field stored in the "Attack Technique Implementation" entity of the attack technique knowledge graph. This field clarifies the operating system or environment type that the attack technique can run on (e.g., "Windows 10" or "Linux CentOS 7"), and is a key basis for matching the virtual machine environment (e.g., in the previous example, the platform attribute of "injecting the explore.exe process into the Jack account" is "Windows 10"). The preset virtual machine environment can refer to a simulated running environment created in advance based on virtualization technology (e.g., VMware, QEMU) and adapted to various platform attributes. It includes operating system images (e.g., Windows 10 images, Linux images), initial configurations (e.g., ordinary user permissions, disabling interfering security software), and virtual machine management tools (for startup, file transfer, and remote execution). It serves as a "real-world simulation field" for dynamic verification. The attack code can refer to the initial attack code that has passed static verification. It contains core attack logic (e.g., in the previous example, "the PowerShell script that bypasses the UAC of Fodhelper.exe" and "the C++ code that injects the explore.exe process into the Jack account"). It needs to be actually run in a virtual machine to verify its effectiveness. Pre-defined verification code refers to pre-developed, dedicated code used to verify the effectiveness of an attack. It must match the target described in the attack description and falls into two categories: first, permission / environment verification code (such as the PowerShell script `whoami` to verify whether privileges have been escalated to administrator level); second, attack target verification code (such as a C++ program to detect whether `explore.exe` has been injected with a payload). Its core function is to objectively determine whether the attack has achieved its goal. Runtime information refers to real-time data generated when the attack code runs in a virtual machine, including console output (such as "UAC bypass successful" or "injection failed"), system logs (such as process startup logs and registry modification logs), and error messages (such as "insufficient permissions"). This is crucial for troubleshooting attack failures. The target described in the attack description can be the user's final attack requirement expressed in natural language (such as "injecting into the `explore.exe` process of another account"), which serves as the "judgment standard" for dynamic verification. Whether this requirement has been achieved must be confirmed through the results of the pre-defined verification code.

[0120] For ease of understanding, please refer to Figure 8 This explanation is provided, but does not limit the scope of this application. Figure 8 This is a schematic diagram of the attack code dynamic review module of one embodiment of the attack code generation method of this application, as shown below. Figure 8 As shown, the workflow of the attack code dynamic review module is as follows: 1. Based on the key fields in the attack technique chain description, select and start the virtual machine environment. Each attack technique implementation in the attack technique chain contains fields indicating the platform on which the attack runs. For example, the attack technique "injecting a process belonging to another user onto a Windows host" has a "Platform" field with the value "Windows". The system will start a Windows virtual machine based on this field. Multiple virtual machine images for implementing the attack can be pre-created using popular system virtualization technologies (such as VMware, QEMU, etc.), and managed using a virtual machine management system. These virtualization platforms provide APIs for developers to control virtual machines through code. Examples include: starting a virtual machine; transferring files; executing programs within the virtual machine, etc.

[0121] 2. The system transfers the code or binary executable file corresponding to the attack technique chain to the virtual machine and runs the attack code or binary file. During execution, it records the output information (e.g., runtime logs, console output, etc.).

[0122] 3. After execution, the verification code determines whether the attack chain code achieved its intended purpose. For example, if the user's initial input is "inject into the explore.exe process of another account," the verification code checks whether a payload has been injected into the explore.exe process. If any discrepancies are found, it will output which points were not met. If successful: the code corresponding to the attack chain is output. If unsuccessful: the output information during execution, the error message from the verification code, the attack chain information, and the code corresponding to the attack chain are passed to the next step.

[0123] 4. The system calls the LLM to determine the reason for the failure based on the information from the previous step. It then packages all information about the user-generated code (output information during runtime, error messages from the verified code output, a structured description of the attack technique chain, the code corresponding to the attack technique chain, and the reason for the failure), and then proceeds to the code generation module.

[0124] Step S60: If the dynamic verification passes, the attack code is used as the final attack code and the final attack code is output.

[0125] Understandably, the final attack code can refer to attack code that has passed both static and dynamic verification, possessing the characteristics of "grammatically correct, logically complete, and effectively executed in practice." It can be directly used for enterprise offensive security verification and is the final output of the entire process.

[0126] In this embodiment, the attack code is also subjected to static and dynamic verification step by step. After the verification is passed, the attack code is used as the final attack code and the final attack code is output, thereby solving the code correctness problem and finally generating attack code that meets the requirements and satisfying the offensive security verification requirements.

[0127] For ease of understanding, please refer to Figure 9 This explanation is provided, but does not limit the scope of this application. Figure 9 This is a schematic diagram of module interaction in one embodiment of the attack code generation method of this application, as shown below. Figure 9 As shown, the workflow is as follows: 1. User inputs attack description: Users submit a description of the attack in natural language to the system (such as "injecting the explore.exe process of another account").

[0128] 2. Identification of attack intent: Input: A description of the attack submitted by the user; Processing: The attack description is parsed by the attack intent identification module, key information is extracted and structured; Output: The result, which includes the "initial state" and "a structured description of one or more attack techniques", is passed to the attack chain generation module.

[0129] 3. Generating attack technology chain: Input: Structured information output by the attack intent identification module; Processing: The attack chain generation module uses the attack technology knowledge graph to reason and supplement the missing attack technology implementations, forming a complete process; Output: A structured description of the attack technique chain, passed to the code generation module.

[0130] 4. Generate attack code: Input: A structured description of the attack technique chain; Processing: The code generation module combines code examples from an attack technique knowledge graph to generate corresponding attack code; Output: The code corresponding to the attack technique chain is passed to the attack code static review module.

[0131] 5. Static analysis of attack code: Input: The code corresponding to the attack technique chain; Solution: The static code analysis module will check for syntax and logic defects in the attack code. If the review is successful: Output "Structured Description of Attack Technique Chain", "Code Corresponding to Attack Technique Chain" and "Compiled Binary Executable File" and send them to the Attack Code Dynamic Review Module; If the process fails and exceeds the maximum number of iterations: the process terminates and the result is "failure"; If the attack fails but the iteration count has not exceeded: return the "structural description of the attack technique chain", "code corresponding to the attack technique chain", and "reason for failure" to the code generation module to regenerate the code.

[0132] 6. Dynamic review of attack code; Input: The code and related files that have passed static review; Processing: The attack code dynamic review module runs the code in an adapted virtual machine environment to verify the attack effect; If approved: Output the final attack code, and the process is complete; If the process fails and exceeds the maximum number of iterations: the process terminates and the result is "failure"; If the test fails but the iteration count has not been exceeded: return the "running output information", "error information", "failure reason" and other information to the code generation module to regenerate the code.

[0133] It should be noted that the data collection, tag management, rule setting, and push decision-making processes involved in this application are designed to work with other technical features to solve technical problems. They do not involve or support any illegal activities. Any data processing that may violate laws and regulations (such as unauthorized collection of privacy data, generation of discriminatory tags, setting unfair rules, or pushing illegal information) is not within the scope of protection of this application's technical solution. Of course, the user data in this application will be encrypted, anonymized, or de-identified before storage to ensure user data security.

[0134] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the attack code generation method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0135] This application also provides an attack code generation device, please refer to... Figure 10 The attack code generation device includes: The intent recognition module 10 is used to respond to the input attack description by performing intent recognition on the attack description through a preset large language model to obtain a structured description of the attack requirements. The attack chain generation module 20 is used to supplement the missing attack technology implementation through reasoning based on the structured description of the attack requirements and the attack technology knowledge graph, and generate an attack technology chain based on the supplemented attack technology implementation, wherein the attack technology knowledge graph is used to store attack technology-related knowledge. The code generation module 30 is used to generate attack code corresponding to the attack description based on the attack technique chain and the preset large language model.

[0136] The attack code generation apparatus provided in this application, employing the attack code generation method described in the above embodiments, can solve the technical problem that related attack code generation methods tend to generate only the main attack techniques while neglecting the prerequisite of acquiring other attack techniques, resulting in insufficient code accuracy and difficulty in meeting the requirements of offensive security verification. Compared with the prior art, the beneficial effects of the attack code generation apparatus provided in this application are the same as those of the attack code generation method provided in the above embodiments, and other technical features in the attack code generation apparatus are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0137] This application provides an attack code generation device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the attack code generation method in Embodiment 1 above.

[0138] The following is for reference. Figure 11 The diagram illustrates a structural schematic of an attack code generation device suitable for implementing embodiments of this application. The attack code generation device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 11 The attack code generation device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0139] like Figure 11As shown, the attack code generation device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the attack code generation device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, LCDs (Liquid Crystal Displays), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the attack code generation device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows attack code generation devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0140] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0141] The attack code generation device provided in this application, employing the attack code generation method described in the above embodiments, can solve the technical problem that related attack code generation methods tend to generate only the main attack techniques while ignoring the prerequisite of acquiring other attack techniques, resulting in insufficient code accuracy and difficulty in meeting the requirements of offensive security verification. Compared with the prior art, the beneficial effects of the attack code generation device provided in this application are the same as those of the attack code generation method provided in the above embodiments, and other technical features in this attack code generation device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0142] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0143] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0144] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the attack code generation method in the above embodiments.

[0145] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described attack code generation method. This addresses the technical problem that related attack code generation methods often only generate the main attack techniques while neglecting the prerequisite of acquiring other attack techniques, resulting in insufficient code accuracy and difficulty in meeting the requirements of offensive security verification. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the attack code generation method provided in the above embodiments, and will not be repeated here.

[0146] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the attack code generation method described above.

[0147] The computer program product provided in this application solves the technical problem that related attack code generation methods tend to generate only the main attack techniques while ignoring the prerequisite of acquiring other attack techniques, resulting in insufficient code accuracy and difficulty in meeting the requirements of offensive security verification. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the attack code generation method provided in the above embodiments, and will not be repeated here.

[0148] The above description is only a part of the embodiments of this application and does not limit the scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included within the protection scope of this application.

[0149] This application discloses A1, an attack code generation method, the attack code generation method comprising: In response to the input attack description, the intent of the attack description is identified by a preset large language model to obtain a structured description of the attack requirements; Based on the structured description of attack requirements and the attack technology knowledge graph, missing attack technologies are supplemented through reasoning, and an attack technology chain is generated based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. Based on the attack technique chain, the attack code corresponding to the attack description is generated using the preset large language model.

[0150] A2. The attack code generation method as described in A1, wherein the attack technology knowledge graph includes entities and relationships, the entities include attack technology implementation and attack conditions, the relationships include causal relationships and generating relationships, the causal relationships are used to describe the relationship that the attack conditions make the attack technology implementation possible, and the generating relationships are used to describe the attack technology implementation generating new attack conditions.

[0151] A3. The attack code generation method as described in A2, wherein in response to the input attack description, intent recognition is performed on the attack description using a preset large language model to obtain a structured description of the attack requirements, including: In response to the input attack description, key attack technology information in the attack description is extracted through the preset large language model; Based on the key information of the attack technique, the system retrieves matching entities implementing the attack technique from a preset vector database, wherein the preset vector database stores vectorized encoding results of entity descriptions in the attack technique knowledge graph. According to the attack technique, the entity generates a structured description of the attack requirements through the preset large language model.

[0152] A4. The attack code generation method as described in A3, wherein the step of retrieving a matching attack technology implementation entity from a preset vector database based on the key information of the attack technology includes: The extracted key information of the attack technique is converted into a retrieval vector using a vectorization encoding algorithm consistent with the preset vector database; The similarity between the retrieval vector and the entity vectors in the preset vector database is calculated using a preset similarity algorithm. Entities implementing attack techniques with a similarity score not lower than a preset similarity threshold are selected as candidate entities; If there are multiple candidate entities, the candidate entities are ranked according to their suitability by combining the preset large language model with the semantics of the attack description, and at least one entity is selected as the matching attack technology implementation entity based on the ranking result.

[0153] A5. The attack code generation method as described in A3, wherein the step of generating a structured description of attack requirements based on the attack technology implementation entity through the preset large language model includes: Obtain detailed information about the entities implementing the attack techniques from the attack technique knowledge graph; Based on the detailed information, the initial state before the attack was launched and the parameters required for the attack technique to achieve the entity were confirmed through the preset large language model. A structured description of attack requirements is generated based on the initial state and the required parameters.

[0154] A6. The attack code generation method as described in A2, wherein the missing attack techniques are supplemented through reasoning based on the structured description of attack requirements and the attack technology knowledge graph, and an attack technology chain is generated based on the supplemented attack techniques, including: Analyze the matching degree between the initial state in the structured description of the attack requirements and the preconditions for the implementation of each attack technique; Based on the pre-defined entities and relationships in the attack technique knowledge graph, missing attack techniques are supplemented through reasoning and retrieval. Generate at least one candidate attack technique chain that includes the implementation of the supplementary attack technique. Transform the candidate attack technique chain into a natural language description through the preset large language model and confirm it with the user. Determine the attack technique chain based on the confirmation result.

[0155] A7. The attack code generation method as described in A6, wherein the missing attack techniques are supplemented through reasoning retrieval based on the preset entity types and relationships in the attack technique knowledge graph, includes: If the initial state does not meet the preconditions for the implementation of the first target attack technique, then the attack technique implementation that enables the relationship retrieval to meet the preconditions is used as a preliminary supplementary technique. If there is a conditional gap between two adjacent attack technology implementations, then based on the attack conditions that can be generated by the previous technology implementation for generating relationship retrieval, and based on the attack technology implementation that enables the relationship retrieval to connect the condition with the premise of the next technology implementation as an intermediate supplementary technology, the supplementary attack technology implementations are connected in a preset logical order.

[0156] A8. The attack code generation method as described in any one of A1 to A7, wherein generating the attack code corresponding to the attack description based on the attack technology chain and the preset large language model includes: The preset large language model is used to evaluate whether the attack technique chain needs to call the attack technique code examples stored in the attack technique knowledge graph; If a call is required, code examples corresponding to the implementation of each attack technique are retrieved from the attack technique knowledge graph, and prompt words are generated by combining the attack technique chain description with the code examples; The prompt word is input into the preset large language model, and the attack code corresponding to the attack description is generated through the preset large language model.

[0157] A9. The attack code generation method as described in any one of A1 to A7, after generating the attack code corresponding to the attack description based on the attack technology chain and the preset large language model, further includes: Static verification is performed on the attack code, wherein the static verification is used to identify code syntax and logic defects; If the static verification passes, the attack code is then dynamically verified, wherein the dynamic verification is used to check whether the attack effect of the code in the actual running environment matches the attack description. If the dynamic verification passes, the attack code is used as the final attack code and the final attack code is output.

[0158] A10. The attack code generation method as described in A9, wherein the static verification of the attack code includes: If the attack code is a compiled language, a preset compilation tool is called to compile the attack code; if a compilation error occurs, the error information is extracted, and the code syntax error is corrected through the preset large language model until the compilation is successful or the preset number of iterations is reached; If the attack code is in a scripting language or compiles successfully, the logical integrity and functional compliance of the attack code are reviewed by combining the preset large language model with the attack technology chain, and static verification is performed on the attack code based on the review results.

[0159] A11. The attack code generation method as described in A9, wherein the dynamic verification of the attack code includes: Based on the platform attributes corresponding to the attack techniques in the attack technique chain, start the corresponding preset virtual machine environment; The attack code and the preset verification code are transmitted to the virtual machine environment, the attack code is run, and the running information is recorded in real time. After the attack code finishes running, the preset verification code is executed to check whether the attack effect has achieved the goal described in the attack description, and the attack code is dynamically verified based on the verification result.

[0160] This application also discloses B12, an attack code generation apparatus, the attack code generation apparatus comprising: The intent recognition module is used to respond to the input attack description by performing intent recognition on the attack description through a preset large language model to obtain a structured description of the attack requirements. The attack chain generation module is used to supplement missing attack technologies based on the structured description of attack requirements and the attack technology knowledge graph through reasoning, and to generate an attack technology chain based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. The code generation module is used to generate attack code corresponding to the attack description based on the attack technique chain and the preset large language model.

[0161] B13. The attack code generation apparatus as described in B12, wherein the attack technology knowledge graph includes entities and relationships, the entities include attack technology implementations and attack conditions, the relationships include causal relationships and generating relationships, the causal relationships are used to describe the relationship that the attack conditions make the attack technology implementation possible, and the generating relationships are used to describe the attack technology implementation generating new attack conditions.

[0162] B14. In the attack code generation apparatus described in B13, the intent recognition module is further configured to, in response to an input attack description, extract key attack technology information from the attack description using the preset large language model; retrieve matching attack technology implementation entities from a preset vector database based on the key attack technology information, wherein the preset vector database stores vectorized encoding results of entity descriptions in the attack technology knowledge graph; and generate a structured description of attack requirements based on the attack technology implementation entities using the preset large language model.

[0163] B15. In the attack code generation apparatus described in B14, the intent recognition module is further configured to convert the extracted key information of the attack technique into a retrieval vector using a vectorization encoding algorithm consistent with the preset vector database; calculate the similarity between the retrieval vector and entity vectors in the preset vector database using a preset similarity algorithm; filter out attack technique implementation entities with a similarity not lower than a preset similarity threshold as candidate entities; if there are multiple candidate entities, then perform adaptive sorting of the candidate entities by combining the semantics of the attack description with the preset large language model, and select at least one entity as a matching attack technique implementation entity according to the sorting result.

[0164] B16. In the attack code generation apparatus described in B14, the intent recognition module is further configured to obtain detailed information of the attack technology implementation entity from the attack technology knowledge graph; based on the detailed information, confirm the initial state before the attack is launched and the required parameters of the attack technology implementation entity through the preset large language model; and generate a structured description of the attack requirements according to the initial state and the required parameters.

[0165] B17. The attack code generation device as described in B13, wherein the attack chain generation module is further configured to analyze the matching degree between the initial state in the structured description of the attack requirements and the preconditions for the implementation of each attack technique; based on the preset entities and relationships in the attack technique knowledge graph, supplement the missing attack technique implementations through reasoning retrieval; generate at least one candidate attack technique chain containing the supplemented attack technique implementations; convert the candidate attack technique chain into a natural language description through the preset large language model and interact with the user for confirmation; and determine the attack technique chain based on the confirmation result.

[0166] This application also discloses C18, an attack code generation device, the attack code generation device comprising: a memory, a processor, and an attack code generation program stored in the memory and executable on the processor, wherein the attack code generation program, when executed by the processor, implements the attack code generation method as described above.

[0167] This application also discloses D19, a storage medium storing an attack code generation program, which, when executed by a processor, implements the attack code generation method described above.

[0168] This application also discloses E20, a computer program product including an attack code generation program, which, when executed by a processor, implements the attack code generation method described above.

Claims

1. A method for generating attack code, characterized in that, The attack code generation method includes: In response to the input attack description, the intent of the attack description is identified by a preset large language model to obtain a structured description of the attack requirements; Based on the structured description of attack requirements and the attack technology knowledge graph, missing attack technologies are supplemented through reasoning, and an attack technology chain is generated based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. Based on the attack technique chain, the attack code corresponding to the attack description is generated using the preset large language model.

2. The attack code generation method as described in claim 1, characterized in that, The attack technique knowledge graph includes entities and relationships. The entities include attack technique implementations and attack conditions. The relationships include causal relationships and generating relationships. The causal relationship describes how the attack conditions make the attack technique implementation possible. The generating relationship describes how the attack technique implementation generates new attack conditions.

3. The attack code generation method as described in claim 2, characterized in that, The attack description, in response to input, undergoes intent recognition using a pre-defined large language model to obtain a structured description of the attack requirements, including: In response to the input attack description, key attack technology information in the attack description is extracted through the preset large language model; Based on the key information of the attack technique, the system retrieves matching entities implementing the attack technique from a preset vector database, wherein the preset vector database stores vectorized encoding results of entity descriptions in the attack technique knowledge graph. According to the attack technique, the entity generates a structured description of the attack requirements through the preset large language model.

4. The attack code generation method as described in claim 3, characterized in that, The step of retrieving matching attack technique implementation entities from a preset vector database based on the key information of the attack technique includes: The extracted key information of the attack technique is converted into a retrieval vector using a vectorization encoding algorithm consistent with the preset vector database; The similarity between the retrieval vector and the entity vectors in the preset vector database is calculated using a preset similarity algorithm. Entities implementing attack techniques with a similarity score not lower than a preset similarity threshold are selected as candidate entities; If there are multiple candidate entities, the candidate entities are ranked according to their suitability by combining the preset large language model with the semantics of the attack description, and at least one entity is selected as the matching attack technology implementation entity based on the ranking result.

5. The attack code generation method as described in claim 3, characterized in that, The step of generating a structured description of attack requirements based on the attack technique using the preset large language model includes: Obtain detailed information about the entities implementing the attack techniques from the attack technique knowledge graph; Based on the detailed information, the initial state before the attack was launched and the parameters required for the attack technique to achieve the entity were confirmed through the preset large language model. A structured description of attack requirements is generated based on the initial state and the required parameters.

6. The attack code generation method as described in claim 2, characterized in that, The attack technique knowledge graph, based on the structured description of attack requirements, supplements missing attack techniques through reasoning, and generates an attack technique chain based on the supplemented attack techniques, including: Analyze the matching degree between the initial state in the structured description of the attack requirements and the preconditions for the implementation of each attack technique; Based on the pre-defined entities and relationships in the attack technique knowledge graph, missing attack techniques are supplemented through reasoning and retrieval. Generate at least one candidate attack technique chain that includes the implementation of the supplementary attack technique. Transform the candidate attack technique chain into a natural language description through the preset large language model and confirm it with the user. Determine the attack technique chain based on the confirmation result.

7. An attack code generation device, characterized in that, The attack code generation device includes: The intent recognition module is used to respond to the input attack description by performing intent recognition on the attack description through a preset large language model to obtain a structured description of the attack requirements. The attack chain generation module is used to supplement missing attack technologies based on the structured description of attack requirements and the attack technology knowledge graph through reasoning, and to generate an attack technology chain based on the supplemented attack technologies. The attack technology knowledge graph is used to store knowledge related to attack technologies. The code generation module is used to generate attack code corresponding to the attack description based on the attack technique chain and the preset large language model.

8. An attack code generation device, characterized in that, The attack code generation device includes: a memory, a processor, and an attack code generation program stored in the memory and executable on the processor. When the attack code generation program is executed by the processor, it implements the attack code generation method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium stores an attack code generation program, which, when executed by a processor, implements the attack code generation method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes an attack code generation program, which, when executed by a processor, implements the attack code generation method as described in any one of claims 1 to 6.

Images