Artificial Intelligence-Based Vulnerability Verification Code Generation and Network Protection Methods

Abstract

This application discloses an artificial intelligence-based vulnerability verification code generation method and network protection method. The vulnerability verification code generation method includes: parsing acquired historical vulnerability data using deep learning algorithms and natural language processing techniques to extract key policy information and code structure information; inputting the key policy information and code structure information into a pre-trained code generation model and generating initial vulnerability verification code by combining it with a pre-constructed environmental feature knowledge graph; optimizing the initial vulnerability verification code using a sequence-to-sequence model and a large language model combined with the vulnerability knowledge graph; and verifying the optimized initial vulnerability verification code using sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. The vulnerability verification code generated using the method provided in this application has high accuracy, high efficiency, does not rely on manual verification, and has good versatility.

Description

Technical Field

[0001] This application relates to the field of network technology, specifically to an artificial intelligence-based vulnerability verification code generation method and network protection method. Background Technology

[0002] With the deepening of the State Grid New Energy Group's "Digital and Intelligent New Energy" plan, the power industry is undergoing a comprehensive transformation towards digitalization and intelligence, encompassing the widespread application of new technologies such as cloud platforms and business middleware. While the integration of these technologies has improved business efficiency and reliability, it has also brought complex cyberattack risks. Especially in the context of frequent Advanced Persistent Threat (APT) attacks, traditional protection strategies often struggle to achieve efficient protection and intelligent response to the system.

[0003] With the development of new technologies and businesses, cyberattack techniques and methods are also evolving rapidly. The automation and speed of cyberattacks are constantly improving, and the targeting, persistence, and stealth of cybersecurity attacks are significantly enhanced, greatly increasing the difficulty of cybersecurity protection. Existing vulnerability detection technologies are mostly based on static feature matching and known rule bases. Typical methods include open-source tools (such as Nessus, OpenVAS, and commercial vulnerability scanning systems). Open-source tools primarily use signature features from vulnerability databases such as CVE and CNVD for pattern matching to identify known vulnerabilities. In addition, some methods introduce machine learning methods (such as SVM, Random Forest, and LSTM) to detect anomalies in network traffic or system behavior to identify potential unknown threats. However, traditional security vulnerability scanning techniques are time-consuming, and vulnerability confirmation largely depends on the professional skills of vulnerability verifiers, resulting in low efficiency in vulnerability discovery and remediation.

[0004] Therefore, building vulnerability detection technologies based on vulnerability verification has become an important means of vulnerability discovery. Proof-of-Concept (PoC) code is a specially written set of code, scripts, or instructions whose core purpose is to securely prove, in a controlled environment, that a security vulnerability in a software, system, or network service is real and can be triggered. However, existing methods for generating proof-of-concept code have the following drawbacks:

[0005] 1. Traditional vulnerability verification code generation relies heavily on manual or single-technical methods for data parsing. This often involves only simple keyword extraction from vulnerability description documents or feature analysis of code snippets, making it difficult to achieve deep correlation and complete analysis of vulnerability information. For example, for complex vulnerabilities, natural language processing alone cannot link their dependencies to system components, and code analysis alone cannot accurately assess the severity of the vulnerability by combining historical exploitation cases. This results in incomplete feature extraction, affecting the accuracy of subsequent PoC generation.

[0006] 2. Traditional WAF (Web Application Firewall) protection rules often rely on manual configuration or static matching based on traffic characteristics, resulting in delayed updates and a lack of effective countermeasures against bypass techniques. When attackers use bypass techniques such as parameter obfuscation, encoding distortion, and request order dependencies, traditional WAFs often fail to intercept them in a timely manner. This leads to high rule base redundancy, increased false positive rates, and long rule optimization cycles, typically taking hours or even days from discovering a bypass to correcting the rule, making it difficult to meet the real-time protection needs of critical business systems.

[0007] 3. Traditional PoC code is mostly written manually or generated from simple templates, lacking the ability to adapt to environmental differences (such as operating system and database version), resulting in poor code compatibility, low portability, and frequent need for repeated debugging.

[0008] In summary, existing vulnerability verification code mainly relies on static rule bases and manual verification. The vulnerability verification cycle is long and highly dependent on expert experience, resulting in low efficiency, high false positive rate (often exceeding 10%), unavoidable false negatives, and poor code universality. Summary of the Invention

[0009] To address these issues, this application provides an artificial intelligence-based vulnerability verification code generation method and network protection method to solve the problems of low accuracy, low efficiency, reliance on manual verification, and poor versatility of vulnerability verification codes generated by existing technologies.

[0010] To achieve the above objectives, this application provides the following technical solution:

[0011] Firstly, an artificial intelligence-based vulnerability verification code generation method includes:

[0012] Step 1: Obtain historical vulnerability data; the historical vulnerability data includes vulnerability verification code and vulnerability description documents;

[0013] Step 2: Perform multi-dimensional classification processing on historical vulnerability data according to pre-established classification criteria to obtain a classified vulnerability dataset;

[0014] Step 3: Use deep learning algorithms and natural language processing techniques to analyze the vulnerability features in the classified vulnerability dataset and extract key policy information and code structure information;

[0015] Step 4: Utilize graph neural networks to construct a vulnerability knowledge graph by combining key strategy information and code structure information;

[0016] Step 5: Input key strategy information and code structure information into the pre-trained code generation model, and combine it with the pre-built environment feature knowledge graph to generate initial vulnerability verification code;

[0017] Step 6: The initial vulnerability verification code is optimized by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph. The optimized initial vulnerability verification code is then verified by combining sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. Reinforcement learning algorithms are used for continuous optimization during the optimization and verification processes.

[0018] Preferably, the code generation model employs a training method combining supervised learning and reinforcement learning during training. Specifically, in the supervised learning phase, the vulnerability direction is used to train the model based on known vulnerability information and corresponding vulnerability verification code, enabling the model to learn the mapping relationship between vulnerability features and code generation. In the reinforcement learning phase, the generated vulnerability verification code is executed and tested in a simulated environment, and the model is given feedback rewards based on the execution results of the vulnerability verification code in the simulated environment, prompting the model to continuously optimize the code generation strategy.

[0019] Preferably, the code generation model continuously adjusts the algorithm parameters and model structure during training, and uses cross-validation to evaluate the model's performance.

[0020] Preferably, the code generation model adopts a sequence-to-sequence model based on the Transformer architecture.

[0021] Preferably, the deep learning algorithm employs a convolutional neural network or a long short-term memory network.

[0022] Secondly, an artificial intelligence-based vulnerability verification code generation device includes:

[0023] The vulnerability data collection module is used to acquire historical vulnerability data; the historical vulnerability data includes vulnerability verification code and vulnerability description documents.

[0024] The vulnerability data classification module is used to perform multi-dimensional classification processing on historical vulnerability data according to pre-established classification criteria to obtain a classified vulnerability dataset.

[0025] The vulnerability feature parsing module is used to analyze the vulnerability features in the classified vulnerability dataset using deep learning algorithms and natural language processing technology, and to extract key policy information and code structure information.

[0026] The vulnerability knowledge graph construction module is used to construct a vulnerability knowledge graph by utilizing graph neural networks and combining key policy information and code structure information.

[0027] The vulnerability verification code generation module is used to input key policy information and code structure information into a pre-trained code generation model, and combine it with a pre-built environmental feature knowledge graph to generate initial vulnerability verification code;

[0028] The vulnerability verification code optimization module is used to optimize the initial vulnerability verification code by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph, and to verify the optimized initial vulnerability verification code by combining sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code; reinforcement learning algorithms are used for continuous optimization during the optimization and verification processes.

[0029] Thirdly, an artificial intelligence-based cybersecurity protection method includes:

[0030] Step 1: Verify vulnerabilities in the network environment using vulnerability verification code and generate a vulnerability scanning report; the vulnerability verification code is generated according to the AI-based vulnerability verification code generation method described above.

[0031] Step 2: Input the vulnerability scanning report into the pre-trained risk assessment model to generate an adaptive risk assessment report; the adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability;

[0032] Step 3: Optimize the firewall policy based on the adaptive risk assessment report, and update the optimized firewall policy to the firewall configuration;

[0033] Step 4: Optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of each business system.

[0034] Preferably, the risk assessment model adopts a three-dimensional dynamic assessment model that includes severity, difficulty of exploitation, and business impact.

[0035] Preferably, the WAF strategy template is generated by using deep learning algorithms to conduct in-depth analysis of the collected Web traffic feature data, extracting representative traffic feature vectors, and generating the template by clustering and classifying the traffic feature vectors, combined with the characteristics and security requirements of different business systems.

[0036] Fourthly, an artificial intelligence-based network security protection device includes:

[0037] The vulnerability verification module is used to verify vulnerabilities in the network environment using vulnerability verification code and generate a vulnerability scanning report; the vulnerability verification code is generated according to the aforementioned AI-based vulnerability verification code generation method.

[0038] The risk assessment module is used to input the vulnerability scanning report into a pre-trained risk assessment model to generate an adaptive risk assessment report. The adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability.

[0039] The firewall policy optimization module is used to optimize the firewall policy based on the adaptive risk assessment report and update the optimized firewall policy to the firewall configuration.

[0040] The WAF policy template optimization module is used to optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of various business systems.

[0041] Compared with the prior art, this application has at least the following beneficial effects:

[0042] 1. This application provides an AI-based vulnerability verification code generation method. It parses acquired historical vulnerability data using deep learning algorithms and natural language processing techniques to extract key strategy information and code structure information. This information is then input into a pre-trained code generation model, and combined with a pre-built environmental feature knowledge graph, initial vulnerability verification code is generated. The initial vulnerability verification code is optimized using a sequence-to-sequence model and a large language model combined with the vulnerability knowledge graph. Finally, the optimized initial vulnerability verification code is verified using sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. The vulnerability verification code generated using the method provided in this application has high accuracy, high efficiency, does not rely on manual verification, and has good versatility.

[0043] 2. This application provides an artificial intelligence-based network security protection method. It utilizes vulnerability verification code to verify vulnerabilities in the network environment and generates a vulnerability scanning report. The vulnerability scanning report is input into a pre-trained risk assessment model to generate an adaptive risk assessment report. Based on the adaptive risk assessment report, firewall policies are optimized, and the optimized firewall policies are updated to the firewall configuration. Finally, based on the adaptive risk assessment report, a pre-built WAF policy template is selected, and the optimized WAF policy template is applied to the WAF devices or protection modules of various business systems. The network security protection method provided by this application achieves intelligent verification of network security vulnerabilities and dynamic optimization and improvement of protection strategies, effectively enhancing network security. Attached Figure Description

[0044] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are able to easily make conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0045] Figure 1 A flowchart of a vulnerability verification code generation method based on artificial intelligence provided in Embodiment 1 of this application;

[0046] Figure 2 A schematic diagram of the structure of an artificial intelligence-based vulnerability verification code generation method provided in Embodiment 1 of this application;

[0047] Figure 3 This is a flowchart of a network security protection method based on artificial intelligence, provided in Embodiment 3 of this application. Detailed Implementation

[0048] The present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] In the description of this application: unless otherwise stated, "a plurality of" means two or more. The terms "first," "second," "third," etc., in this application are intended to distinguish the objects referred to and do not have any special meaning in terms of technical connotation (e.g., they should not be construed as an emphasis on importance or order). Expressions such as "including," "comprising," and "having" also mean "not limited to" (certain units, components, materials, steps, etc.).

[0050] The terms used in this application, such as "upper," "lower," "left," "right," and "middle," are generally used to indicate the general relative positional relationship for the purpose of intuitive understanding by referring to the accompanying drawings, and are not absolute limitations on the positional relationship in the actual product.

[0051] Example 1

[0052] Please see Figure 1 and Figure 2 This embodiment provides an artificial intelligence-based vulnerability verification code generation method, including:

[0053] S1: Obtain historical vulnerability data; historical vulnerability data includes vulnerability verification code and vulnerability description documents;

[0054] Specifically, the historical vulnerability data acquired in this embodiment covers existing firewall rules, policy data of common WAF functional devices, various authoritative vulnerability databases (such as NVD, CVE, etc.), open source security communities (such as security project repositories on GitHub), internal company historical vulnerability data, operating system vulnerabilities (such as vulnerabilities in different versions of common systems such as Windows and Linux), application vulnerabilities (including vulnerabilities in various office software and business system software), and network protocol vulnerabilities (such as vulnerabilities related to the TCP / IP protocol suite). At the same time, corresponding PoC code examples and detailed vulnerability description documents are also obtained.

[0055] S2: Based on pre-established classification criteria, historical vulnerability data is classified in multiple dimensions to obtain a classified vulnerability dataset;

[0056] Specifically, this embodiment uses data mining tools (such as Weka and the data mining module in Python's Scikit-learn) to analyze the data, establish data classification standards, and classify and organize the data in multiple dimensions according to the fields required by the code generation model, so as to facilitate subsequent processing and analysis.

[0057] S3: Utilize deep learning algorithms and natural language processing techniques to analyze the vulnerability features in the classified vulnerability dataset and extract key policy information and code structure information;

[0058] Specifically, this embodiment uses deep learning algorithms and natural language processing (NLP) toolkits (such as NLTK, spaCy, etc.) to parse and process the vulnerability features in the classified vulnerability data, and extract key strategy information and code structure information, such as the logical relationship of code blocks and the order of function calls. Among them, vulnerability features include textual descriptions of vulnerability triggering conditions and the possible consequences of the vulnerability. Function call relationships are used to clarify the interaction between different functions in the vulnerability exploitation process.

[0059] More specifically, deep learning algorithms can use convolutional neural networks (CNNs) or long short-term memory networks (LSTMs). This embodiment employs a deep learning algorithm to perform in-depth analysis of the collected vulnerability feature data: the deep learning algorithm automatically extracts key policy information from the vulnerability features through a multi-layer neural network model, including but not limited to vulnerability type, triggering conditions, and scope of impact. The deep learning algorithm unit can process large-scale, high-dimensional vulnerability data, discovering complex feature relationships that are difficult to capture using traditional methods, providing accurate feature input for subsequent PoC code generation.

[0060] Natural Language Processing (NLP) technology focuses on processing vulnerability description text, using techniques such as word segmentation, part-of-speech tagging, and named entity recognition to extract key information from unstructured vulnerability reports and security bulletins. Through pre-trained language models such as BERT, NLP units can deeply understand the semantic content of vulnerability descriptions, identifying core key information such as the cause of the vulnerability, its exploitation method, and the system it affects. This key information is then transformed into structured data for automatic generation of Proof-of-Concept (PoC) code.

[0061] S4: Utilize graph neural networks to construct a vulnerability knowledge graph by combining key strategy information and code structure information;

[0062] Specifically, this embodiment constructs a vulnerability knowledge graph based on the extracted key strategy information and code structure information, and uses a graph database (such as Neo4j) for storage and management. Nodes in the vulnerability knowledge graph include vulnerability types, code snippets, and functions, and the edges of the vulnerability knowledge graph represent the relationships between them, such as the correspondence between a certain vulnerability type and a specific code snippet, or the function call relationships within a code snippet.

[0063] The vulnerability knowledge graph constructed in this embodiment has many important applications, such as associating multimodal data and achieving cross-modal feature fusion. In security detection, it can quickly and accurately generate Proof-of-Concept (POC) models that meet code logic requirements based on the association between vulnerability types and code features in the vulnerability knowledge graph, greatly improving the efficiency and accuracy of security detection. For security researchers, the vulnerability knowledge graph allows for intuitive analysis of the connections and differences between different vulnerability types, enabling in-depth exploration of the root causes and propagation mechanisms of vulnerabilities, thus providing a strong basis for developing more effective defense strategies. The vulnerability knowledge graph can also be used for security training, presenting the vulnerability knowledge system in an intuitive graphical way, helping cybersecurity personnel better understand complex vulnerability principles and prevention points, and accelerating the dissemination and learning process of security knowledge.

[0064] S5: Input key strategy information and code structure information into the pre-trained code generation model, and combine it with the pre-built environment feature knowledge graph to generate initial vulnerability verification code;

[0065] Specifically, this embodiment relies on Large Language Model (LLM) technology to develop a specialized code generation model (e.g., a sequence-to-sequence model based on the Transformer architecture). The training data for the code generation model includes organized vulnerability data and a large number of high-quality code examples obtained from open-source code repositories, in order to learn common code writing patterns and logical structures in different programming languages ​​(such as Python, C++, Java, etc.).

[0066] Before training the code generation model, a suitable computing environment for AI algorithm development and operation needs to be set up. This includes configuring high-performance servers or cloud computing resources, installing deep learning frameworks such as TensorFlow and PyTorch, and related data processing and analysis tools such as Python libraries like Pandas and NumPy. A testing environment is also required for firewall policy optimization and WAF policy development to allow for policy testing and verification in a controlled environment.

[0067] The code generation model employs a combination of supervised learning and reinforcement learning during training. Specifically, in the supervised learning phase, the model is trained based on known vulnerability information and corresponding vulnerability verification code, enabling the model to learn the mapping relationship between vulnerability features and code generation. In the reinforcement learning phase, the generated vulnerability verification code is executed and tested in a simulated environment. The model is rewarded based on the execution results of the vulnerability verification code in the simulated environment (e.g., whether the vulnerability is successfully triggered and the code execution efficiency), prompting the model to continuously optimize the code generation strategy.

[0068] During training, code generation models require continuous adjustment of AI algorithm parameters and model structure. Cross-validation and other techniques are used to evaluate model performance, ensuring the model accurately predicts the optimization direction of firewall and WAF rules, improving rule accuracy and reducing redundant rules. For example, k-fold cross-validation divides the dataset into k subsets. Each time, k-1 subsets are used as the training set, and the remaining subset as the validation set. Through multiple training and validation iterations, average performance metrics such as accuracy, recall, and F1 score are obtained. Hyperparameters, such as learning rate, regularization coefficient, and number of hidden layer nodes, are adjusted based on these metrics to improve the accuracy and coverage of vulnerability verification and reduce false positives.

[0069] More specifically, this embodiment uses a code generation model to automatically generate PoC code targeting specific vulnerabilities, based on vulnerability features analyzed by deep learning algorithm units and key information extracted by natural language processing units. This step can generate code snippets that conform to syntax rules and can effectively trigger vulnerabilities, depending on different programming languages ​​and vulnerability types. Simultaneously, by introducing an environmental feature knowledge graph, the universality and executability of the generated code can be improved, ensuring that the generated PoC code can successfully run and verify the vulnerability in the target environment. This replaces the traditional manual code writing process. The environmental feature knowledge graph is constructed by integrating adaptation rules from different systems, servers, and databases to support cross-environment compatible PoC code generation.

[0070] S6: The initial vulnerability verification code is optimized by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph. The optimized initial vulnerability verification code is then verified by combining sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. Reinforcement learning algorithms are used for continuous optimization during the optimization and verification processes.

[0071] Specifically, this embodiment requires establishing a simulated interactive environment and using virtualization technology (such as VMware, VirtualBox, etc.) to build multiple target system environments (covering different operating system versions and different application runtime environments) to perform preliminary verification of the generated PoC code. If problems are found in the generated code, such as failure to run properly or triggering vulnerabilities in certain target environments, the model automatically backtracks and analyzes. By analyzing log information during the code generation process and comparing it with standard code patterns in the vulnerability knowledge graph, potential problem points are identified, the code generation strategy is adjusted, and iterative optimization is performed until PoC code that meets the requirements is generated.

[0072] This embodiment employs a sequence-to-sequence (Seq2Seq) model and a large language model (LLM) to fine-tune the generated PoC code for specific tasks. The Seq2Seq model, through an encoder-decoder structure, performs sequence-to-sequence conversion and optimization of the PoC code to improve its conciseness and efficiency. The LLM, leveraging its powerful language understanding and generation capabilities, performs syntax checking, logic optimization, and performance enhancements. Through task-specific fine-tuning, the model is made more adaptable to vulnerability verification scenarios, generating more accurate and efficient PoC code.

[0073] This embodiment also combines sandbox dynamic execution and symbolic execution techniques to perform comprehensive and automated verification of the optimized PoC code. The sandbox environment provides an isolated and controllable execution space, ensuring that the PoC code does not affect the actual system during verification. Symbolic execution technology analyzes the code's execution path and conditions to predict its behavior under different inputs, thereby discovering potential vulnerability trigger points and side effects. The automated verification unit can quickly and accurately evaluate the effectiveness and security of the PoC code, providing a reliable basis for subsequent vulnerability remediation.

[0074] Furthermore, reinforcement learning algorithms are employed for continuous optimization during the optimization and verification process. The reinforcement learning unit is responsible for optimizing the objective of "successfully triggering vulnerabilities while minimizing side effects," forming a closed-loop optimization system. This process continuously optimizes the generation and verification of PoC code by defining a reward function and state space and utilizing reinforcement learning algorithms such as Q-learning and DQN. After each verification, the model is given corresponding rewards or penalties based on the verification results, guiding the model to gradually learn the optimal code generation and verification strategy. Through continuous iteration and optimization, the reinforcement learning unit can significantly improve the success rate and security of PoC code, and reduce side effects and risks during the verification process.

[0075] This embodiment provides an AI-based vulnerability verification code generation method that realizes a closed-loop process of "vulnerability code generation - vulnerability code optimization - vulnerability code verification".

[0076] The vulnerability verification code generation method based on artificial intelligence provided in this embodiment has the following advantages:

[0077] 1. Deep integration of Natural Language Processing (NLP) and Graph Neural Networks: NLP techniques are used to perform structured parsing of unstructured descriptive documents such as CVE numbers and vulnerability causes, accurately extracting basic features such as trigger conditions and attack vectors. Then, a vulnerability knowledge graph is constructed using graph neural networks, linking the extracted features with metadata such as system components, attack surfaces, and historical exploitation cases. Taking SQL injection vulnerabilities as an example, it can not only identify basic features such as injection point type and database type, but also associate the exploitation differences of the vulnerability on different web servers (such as Apache / Nginx) through the knowledge graph, achieving a leap from "single feature" to "context-aware feature system," providing more comprehensive support for PoC generation. This cross-modal fusion framework significantly improves the completeness of vulnerability feature extraction compared to traditional methods, and by optimizing the training method of the code generation model, it enhances the adaptability and defense bypass capabilities of PoC code in complex environments, overcoming the compatibility and robustness bottlenecks of traditional code generation.

[0078] 2. This embodiment proposes a PoC-driven bypass sample library and WAF policy generation mechanism: using verified vulnerability PoCs as trigger sources, attack paths are extracted in a sandbox environment, generating multiple types of bypass samples to construct a bypass sample library covering common attack variants. Based on this sample library, WAF protection rules are automatically generated using semantic analysis and template technology, and batch verification is performed on an offline simulation platform to ensure that the interception rate and performance indicators meet the standards. More importantly, a proof chain of "PoC—Bypass Sample—Rule—Verification Log" is established for each rule to achieve traceability and auditability of policy generation, avoiding manual debugging and opaque configuration. This mechanism reduces the WAF policy update efficiency from the traditional several hours to several minutes, increases the interception coverage by more than 30%, reduces the false positive rate by more than 25%, and reduces rule redundancy by 40% through semantic pruning. In practical simulations of power dispatching and data centers, this method significantly improves the WAF's protection capability against complex bypass attacks, realizing a transformation from "passive patching protection" to "PoC-driven, sampled, and traceable intelligent protection".

[0079] In summary, the vulnerability verification code generation method based on artificial intelligence provided in this embodiment automates the entire process of vulnerability verification code generation, reducing the PoC generation time from several hours to minutes, lowering the false positive rate by more than 30%, the false negative rate to less than 4%, and improving the accuracy to 99%, significantly reducing reliance on manual security experts. In addition, the PoC code generated in this embodiment has cross-platform (such as Windows / Linux) and cross-middleware (such as Apache / Nginx) compatibility, with a one-time generation success rate of over 95%, solving the problem of poor code universality.

[0080] Example 2

[0081] This embodiment provides an artificial intelligence-based vulnerability verification code generation device, including:

[0082] The vulnerability data collection module is used to acquire historical vulnerability data; the historical vulnerability data includes vulnerability verification code and vulnerability description documents.

[0083] The vulnerability data classification module is used to perform multi-dimensional classification processing on historical vulnerability data according to pre-established classification criteria to obtain a classified vulnerability dataset.

[0084] The vulnerability feature parsing module is used to analyze the vulnerability features in the classified vulnerability dataset using deep learning algorithms and natural language processing technology, and to extract key policy information and code structure information.

[0085] The vulnerability knowledge graph construction module is used to construct a vulnerability knowledge graph by utilizing graph neural networks and combining key policy information and code structure information.

[0086] The vulnerability verification code generation module is used to input key policy information and code structure information into a pre-trained code generation model, and combine it with a pre-built environmental feature knowledge graph to generate initial vulnerability verification code;

[0087] The vulnerability verification code optimization module is used to optimize the initial vulnerability verification code by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph, and to verify the optimized initial vulnerability verification code by combining sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code; reinforcement learning algorithms are used for continuous optimization during the optimization and verification processes.

[0088] For details on the specific implementation of each module in an AI-based vulnerability verification code generation device, please refer to the above description of the limitations of an AI-based vulnerability verification code generation method; further details will not be repeated here.

[0089] Example 3

[0090] Please see Figure 3 This embodiment provides an artificial intelligence-based network security protection method, applicable to network security protection in the power industry and other critical infrastructure sectors, including:

[0091] S1: Verify vulnerabilities in the network environment using vulnerability verification code and generate a vulnerability scanning report; the vulnerability verification code is generated according to the AI-based vulnerability verification code generation method provided in Example 1;

[0092] Specifically, this embodiment will use multi-threaded, distributed scanning technology to build a distributed scanning cluster, and distribute the scanning tasks to multiple nodes for parallel execution, with each node responsible for scanning a portion of the assets.

[0093] By combining multiple vulnerability scanning technologies, such as port scanning (using Nmap to scan open ports for vulnerabilities) and vulnerability database matching (comparing against a collected vulnerability database), a comprehensive vulnerability identification of assets is performed. Based on the AI-based vulnerability verification code generation method provided in Example 1, a PoC for categorized vulnerability verification is generated. Combined with the OPS workflow, the agent module is used for vulnerability verification to ensure the accuracy of the scan results. After scanning, a detailed vulnerability scan and verification report is generated, along with security hardening guidance and suggestions to guide security operations personnel in eliminating cybersecurity risks.

[0094] S2: Input the vulnerability scanning report into the pre-trained risk assessment model to generate an adaptive risk assessment report; the adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability;

[0095] Specifically, the risk assessment model employs a three-dimensional dynamic assessment model that includes severity, exploitation difficulty, and business impact. The model uses the Analytic Hierarchy Process (AHP) to determine weights and incorporates a reinforcement learning model to dynamically adjust vulnerability priorities based on real-time attack data. Simultaneously, it links vulnerabilities to business assets through a vulnerability knowledge graph, achieving business context-aware priority ranking and thus improving the scientific nature of resource allocation. In this embodiment, the risk assessment model integrates with the company's business logic, such as by interfacing with the company's Business Process Management (BPM) system to obtain information on business process dependencies, data flow, and compliance requirements, dynamically generating an adaptive risk assessment report based on vulnerability scan results.

[0096] The adaptive risk assessment report includes a detailed risk score and risk level (high, medium, low) for each vulnerability, personalized security strategy recommendations for different industry scenarios (e.g., for the financial industry, recommendations to strengthen fund transaction monitoring and add multi-factor authentication for vulnerabilities that may lead to financial risks), and a priority ranking of vulnerability remediation. The priority ranking is closely linked to business impact, improving the efficiency of handling high-risk vulnerabilities by 40%, enabling more scientific resource allocation, and effectively ensuring the continuity of core business systems.

[0097] S3: Optimize firewall policies based on the adaptive risk assessment report and update the optimized firewall policies to the firewall configuration;

[0098] Specifically, this embodiment applies the optimized firewall policy to the actual firewall device and updates the firewall configuration according to the optimized rule set output by the firewall policy. During deployment, a detailed deployment plan and rollback scheme are developed to ensure a smooth transition during the policy update process and avoid network interruptions or security vulnerabilities caused by policy adjustments. For example, policy updates are performed during off-peak business periods, with pre-deployment first on some test devices, and then gradually rolled out to the entire network environment after verification.

[0099] This embodiment also establishes a monitoring mechanism to monitor key indicators such as the firewall's operating status, traffic blocking, and rule matching count. By comparing these indicators with those before optimization, the actual effect of the optimized firewall policy is evaluated, and potential problems are identified and resolved promptly, such as increased false alarms or blocked legitimate traffic. After optimization using the method provided in this embodiment, the firewall rule redundancy rate is reduced to below 5%, and CPU utilization decreases by 40%.

[0100] S4: Optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of each business system.

[0101] Specifically, WAF policy templates utilize deep learning algorithms to conduct in-depth analysis of collected Web traffic feature data, extract representative traffic feature vectors, and generate them by clustering and classifying these traffic feature vectors, combined with the characteristics and security requirements of different business systems.

[0102] More specifically, this embodiment utilizes deep learning algorithms to conduct in-depth analysis of collected Web traffic feature data, extracting representative traffic feature vectors, such as the structural characteristics of request URLs, the types and distribution of request parameters, and specific field values ​​of HTTP header information. Through clustering and classification analysis of these traffic feature vectors, and combined with the characteristics and security requirements of different business systems, WAF policy templates suitable for various business scenarios are generated. Furthermore, in the process of generating WAF policy templates, the risk tolerance and security protection priorities of different business systems must be fully considered.

[0103] This embodiment applies the generated WAF policy template to the WAF devices or protection modules of various business systems for actual traffic monitoring and attack interception testing. By simulating various real-world web attack scenarios and continuously observing normal business traffic, the effectiveness and accuracy of the policy template are verified, and key indicators such as false positive rate and false negative rate are statistically analyzed. For example, professional vulnerability scanning tools and attack simulation platforms are used to conduct comprehensive security testing on application systems, checking whether the WAF can accurately identify and intercept various attacks, thereby dynamically adapting to new attack methods, improving the interception efficiency of WAF devices, and reducing resource waste caused by redundant policies.

[0104] This embodiment dynamically adjusts and optimizes the WAF policy template based on the results of WAF policy verification. For rules with a high number of false positives, the feature matching conditions are further refined or the thresholds are adjusted; for attack types that are missed, corresponding protection rules are added or the feature detection algorithm is strengthened. Simultaneously, based on dynamic changes in business traffic, such as peak business periods or the launch of new services, the parameters and rule sets in the policy template are adjusted in a timely manner to ensure that the WAF policy can always adapt to the constantly changing business environment and security threats. For example, during peak business periods, rules for allowing legitimate traffic are added to avoid performance degradation due to over-protection; when new attack methods are discovered, the feature library and protection rules are updated promptly to improve the WAF's defense capabilities. Specifically, the WAF rule interception rate is increased to 99%, the false positive rate is reduced by 25%, and the policy generation time is shortened from several hours to minutes.

[0105] During the implementation phase, this embodiment regularly conducts a comprehensive evaluation of its effectiveness. An evaluation indicator system is established across multiple dimensions, including improved network security protection capabilities, enhanced business system stability, and reduced security management costs. These indicators include the percentage reduction in security incident incidence, the reduction in business downtime due to false alarms, and the degree of optimization in firewall and WAF device resource utilization. Furthermore, this embodiment employs a combination of quantitative and qualitative evaluation methods. It analyzes and statistically processes relevant security incident data, while also collecting user feedback and opinions from security operations personnel to comprehensively assess the project's impact on the company's overall network security posture and its support for business operations.

[0106] This embodiment provides an AI-based network security protection method that utilizes artificial intelligence (AI) technologies such as deep learning, reinforcement learning, and natural language processing (NLP) to achieve intelligent verification of network security vulnerabilities and optimize dynamic protection strategies. This method aims to build a comprehensive AI-driven network security protection system through automated vulnerability identification and verification, firewall policy tuning, and other means, thereby achieving protection and intelligent response for business systems.

[0107] Example 4

[0108] This embodiment provides an artificial intelligence-based network security protection device, including:

[0109] The vulnerability verification module is used to verify vulnerabilities in the network environment using vulnerability verification code and generate a vulnerability scanning report; the vulnerability verification code is generated according to the aforementioned AI-based vulnerability verification code generation method.

[0110] The risk assessment module is used to input the vulnerability scanning report into a pre-trained risk assessment model to generate an adaptive risk assessment report. The adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability.

[0111] The firewall policy optimization module is used to optimize the firewall policy based on the adaptive risk assessment report and update the optimized firewall policy to the firewall configuration.

[0112] The WAF policy template optimization module is used to optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of various business systems.

[0113] For details on the specific implementation of each module in an AI-based network security protection device, please refer to the above description of the limitations of an AI-based network security protection method; these details will not be repeated here.

[0114] The technical features of the above embodiments can be combined in any way (as long as there is no contradiction in the combination of these technical features). For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described; these embodiments not explicitly written should also be considered to be within the scope of this specification.

Claims

1. A vulnerability verification code generation method based on artificial intelligence, characterized in that, include: Step 1: Obtain historical vulnerability data; the historical vulnerability data includes vulnerability verification code and vulnerability description documents; Step 2: Perform multi-dimensional classification processing on historical vulnerability data according to pre-established classification criteria to obtain a classified vulnerability dataset; Step 3: Use deep learning algorithms and natural language processing techniques to analyze the vulnerability features in the classified vulnerability dataset and extract key policy information and code structure information; Step 4: Utilize graph neural networks to construct a vulnerability knowledge graph by combining key strategy information and code structure information; Step 5: Input key strategy information and code structure information into the pre-trained code generation model, and combine it with the pre-built environment feature knowledge graph to generate initial vulnerability verification code; Step 6: The initial vulnerability verification code is optimized by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph. The optimized initial vulnerability verification code is then verified by combining sandbox dynamic execution and symbolic execution techniques to obtain the final vulnerability verification code. The optimization and verification processes employ reinforcement learning algorithms for continuous optimization.

2. The vulnerability verification code generation method based on artificial intelligence according to claim 1, characterized in that, The code generation model employs a training method that combines supervised learning and reinforcement learning during the training process. Specifically, in the supervised learning phase, the vulnerability direction trains the model based on known vulnerability information and corresponding vulnerability verification code, enabling the model to learn the mapping relationship between vulnerability features and code generation. During the reinforcement learning phase, the generated vulnerability verification code is executed and tested in a simulated environment. The model is given feedback rewards based on the execution results of the vulnerability verification code in the simulated environment, which prompts the model to continuously optimize the code generation strategy.

3. The vulnerability verification code generation method based on artificial intelligence according to claim 1, characterized in that, The code generation model continuously adjusts its algorithm parameters and model structure during training, and uses cross-validation to evaluate the model's performance.

4. The vulnerability verification code generation method based on artificial intelligence according to claim 1, characterized in that, The code generation model adopts a sequence-to-sequence model based on the Transformer architecture.

5. The vulnerability verification code generation method based on artificial intelligence according to claim 1, characterized in that, The deep learning algorithm employs convolutional neural networks or long short-term memory networks.

6. A vulnerability verification code generation device based on artificial intelligence, characterized in that, include: The vulnerability data collection module is used to acquire historical vulnerability data; the historical vulnerability data includes vulnerability verification code and vulnerability description documents. The vulnerability data classification module is used to perform multi-dimensional classification processing on historical vulnerability data according to pre-established classification criteria to obtain a classified vulnerability dataset. The vulnerability feature parsing module is used to analyze the vulnerability features in the classified vulnerability dataset using deep learning algorithms and natural language processing technology, and to extract key policy information and code structure information. The vulnerability knowledge graph construction module is used to construct a vulnerability knowledge graph by utilizing graph neural networks and combining key policy information and code structure information. The vulnerability verification code generation module is used to input key policy information and code structure information into a pre-trained code generation model, and combine it with a pre-built environmental feature knowledge graph to generate initial vulnerability verification code; The vulnerability verification code optimization module is used to optimize the initial vulnerability verification code by combining a sequence-to-sequence model and a large language model with the vulnerability knowledge graph, and to verify the optimized initial vulnerability verification code by combining sandbox dynamic execution and symbolic execution technology to obtain the final vulnerability verification code. The optimization and verification processes employ reinforcement learning algorithms for continuous optimization.

7. A network security protection method based on artificial intelligence, characterized in that, include: Step 1: Verify vulnerabilities in the network environment using vulnerability verification code and generate a vulnerability scanning report; the vulnerability verification code is generated by the artificial intelligence-based vulnerability verification code generation method according to any one of claims 1-5; Step 2: Input the vulnerability scanning report into the pre-trained risk assessment model to generate an adaptive risk assessment report; the adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability; Step 3: Optimize the firewall policy based on the adaptive risk assessment report, and update the optimized firewall policy to the firewall configuration; Step 4: Optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of each business system.

8. The artificial intelligence-based network security protection method according to claim 7, characterized in that, The risk assessment model adopts a three-dimensional dynamic assessment model that includes severity, difficulty of exploitation, and business impact.

9. The artificial intelligence-based network security protection method according to claim 7, characterized in that, The WAF strategy template is generated by using deep learning algorithms to deeply analyze the collected Web traffic feature data, extracting representative traffic feature vectors, and then performing clustering and classification analysis on the traffic feature vectors, combined with the characteristics and security requirements of different business systems.

10. A network security protection device based on artificial intelligence, characterized in that, include: The vulnerability verification module is used to verify vulnerabilities in the network environment using vulnerability verification code and generate vulnerability scanning reports; The vulnerability verification code is generated by the artificial intelligence-based vulnerability verification code generation method according to any one of claims 1-5; The risk assessment module is used to input the vulnerability scanning report into a pre-trained risk assessment model to generate an adaptive risk assessment report. The adaptive risk assessment report includes a detailed risk score, risk level, personalized security strategy recommendations for different industry scenarios, and priority ranking of vulnerability remediation for each vulnerability. The firewall policy optimization module is used to optimize the firewall policy based on the adaptive risk assessment report and update the optimized firewall policy to the firewall configuration. The WAF policy template optimization module is used to optimize the pre-built WAF policy template based on the adaptive risk assessment report, and apply the optimized WAF policy template to the WAF devices or protection modules of various business systems.

Images