Cybersecurity vulnerability intelligence based industrial control software test case selection method and related devices

Abstract

The application discloses a vulnerability information-based industrial control software test case screening method and related equipment, and the method comprises the following steps: constructing a vulnerability information knowledge base according to industrial control software vulnerability information; constructing a vulnerability information vector database according to the vulnerability information knowledge base; converting a natural language query into a query vector; performing similarity retrieval on the query vector and the vulnerability information vectors in the vulnerability information vector database respectively, screening out a retrieval recall result, and extracting the most key feature group of each retrieval recall item in the retrieval recall result; rearranging the retrieval recall result, matching a plurality of test cases with the most key feature group of each retrieval recall item respectively, and obtaining a comprehensive score of each test case; and determining a test case screening result according to the comprehensive score of each test case. The application can improve the efficiency and accuracy of test case screening, improve the discovery ability of vulnerability variants, and can be widely applied in the field of network security technology.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method and related equipment for screening test cases for industrial control software based on vulnerability intelligence. Background Technology

[0002] Industrial Control Systems (ICS) are the core technology system for ensuring the stable operation of critical infrastructure such as power, energy, and rail transportation. In recent years, with the integration of Industry 4.0 and Industrial Internet of Things (IIoT) technologies, ICS is undergoing a paradigm shift from closed and isolated to open and interconnected. This shift has been highly effective in optimizing production processes, but it has also significantly increased the system's attack surface, leading to increasingly prominent cybersecurity vulnerabilities. The traditional "security assumption" of physical isolation for ICS no longer holds true, making it an easy target for cyberattacks.

[0003] Fuzz testing, as an efficient software vulnerability discovery technique, has been widely used in the security testing of industrial control systems. However, current security testing problems in industrial control system software mainly include low reuse and automation of vulnerability exploitation knowledge (Proofof Concept, PoC), weak ability to discover potential vulnerabilities, low testing efficiency, and high costs, making it difficult to meet the assurance requirements for efficient and in-depth vulnerability discovery in complex industrial control environments.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The embodiments of this application aim to at least partially address one of the technical problems in the related art. Therefore, the main objective of the embodiments of this application is to propose a method and related equipment for screening test cases for industrial control software based on vulnerability intelligence, which can improve the efficiency and accuracy of test case screening, while also enhancing the ability to discover vulnerability variants.

[0006] To achieve the above objectives, one aspect of this application proposes a method for screening test cases for industrial control software based on vulnerability intelligence. The method includes the following steps: Acquire vulnerability intelligence information of industrial control software, and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information of industrial control software; Semantic vectorization is performed on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and a vulnerability intelligence vector database is constructed based on the several vulnerability intelligence vectors. Transform the current user's natural language query into a query vector; The query vector is compared with several vulnerability intelligence vectors in the vulnerability intelligence vector database to perform similarity retrieval, and a target number of retrieval recall results are selected. The most critical feature group corresponding to each retrieval recall entry in the retrieval recall results is extracted. The retrieval results are rearranged, and several test cases to be evaluated are respectively matched with the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain the comprehensive score corresponding to each test case to be evaluated. The target test case selection results are determined based on the comprehensive score corresponding to each of the test cases to be evaluated.

[0007] To achieve the above objectives, another aspect of this application proposes a test case screening device for industrial control software based on vulnerability intelligence, the device comprising the following modules: The vulnerability intelligence knowledge base construction module is used to acquire vulnerability intelligence information of industrial control software and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information of industrial control software. The vulnerability intelligence vector database construction module is used to perform semantic vectorization processing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and to construct a vulnerability intelligence vector database based on the several vulnerability intelligence vectors. The Natural Language Query Vectorization module is used to convert the current user's natural language query into a query vector. The semantic retrieval and feature extraction module is used to perform similarity retrieval between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filter out a target number of retrieval recall results, and extract the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results. The test case comprehensive score calculation module is used to rearrange the retrieval results and perform feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain the comprehensive score corresponding to each test case to be evaluated. The test case screening result determination module is used to determine the target test case screening result based on the comprehensive score corresponding to each of the test cases to be evaluated.

[0008] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method.

[0009] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0010] To achieve the above objectives, another aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0011] The embodiments of this application include at least the following beneficial effects: This application provides a method and related equipment for screening test cases for industrial control software based on vulnerability intelligence. This solution obtains vulnerability intelligence information for industrial control software and constructs a vulnerability intelligence knowledge base based on this information; it performs semantic vectorization processing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and constructs a vulnerability intelligence vector database based on these vectors; it converts the current user's natural language query into a query vector; it performs similarity retrieval between the query vectors and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filters out a target number of retrieval recall results, and extracts the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results; it reorders the retrieval recall results, and performs feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results to obtain a comprehensive score corresponding to each test case to be evaluated; based on the comprehensive score corresponding to each test case to be evaluated, it determines the target test case screening results. This application embodiment effectively solves the current problems of fragmented vulnerability knowledge and difficulty in automated exploitation by constructing a structured vulnerability intelligence knowledge base and building a vulnerability intelligence vector database based on the vulnerability intelligence knowledge base. Furthermore, by calculating the matching degree between test cases and the pre-built structured vulnerability knowledge vector database, high-potential test cases can be efficiently identified and ranked from massive test data. By reordering the retrieval and recall results and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval and recall entry in the retrieval and recall results, a comprehensive score is obtained for each test case to be evaluated. Then, based on the comprehensive score of each test case to be evaluated, the target test case screening results are determined. This can simultaneously evaluate the macro-logical similarity and micro-feature matching degree of test cases, greatly improving the accuracy of test case screening and the ability to discover vulnerability variants. Moreover, this screening process does not depend on the real-time operation and feedback of the target program, and the calculation speed is much faster than the actual fuzzy testing execution cycle, significantly shortening the vulnerability discovery cycle and reducing testing costs. Attached Figure Description

[0012] Figure 1 This is a flowchart of the steps of the industrial control software test case screening method based on vulnerability intelligence provided in the embodiments of this application; Figure 2 This is a flowchart illustrating the method for screening test cases for industrial control software based on vulnerability intelligence provided in this application embodiment; Figure 3 This is a schematic diagram of the feature extraction and templated process based on vulnerability intelligence provided in an embodiment of this application; Figure 4 This is a schematic diagram of the vulnerability intelligence vector database construction process provided in the embodiments of this application; Figure 5 This is a schematic diagram of the vector database construction algorithm provided in the embodiments of this application; Figure 6 This is a flowchart illustrating the intelligent test case filtering strategy provided in the embodiments of this application; Figure 7 This is a schematic diagram of the test case screening weight algorithm provided in the embodiments of this application; Figure 8 This is a schematic diagram of the structure of the industrial control software test case screening device based on vulnerability intelligence provided in the embodiments of this application; Figure 9 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0014] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0015] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0017] Industrial Control Systems (ICS) are a core technology system ensuring the stable operation of critical infrastructures such as power, energy, and rail transportation. In recent years, with the integration of Industry 4.0 and Industrial Internet of Things (IIoT) technologies, ICS is undergoing a paradigm shift from closed and isolated to open and interconnected. This shift has been highly effective in optimizing production processes, but it has also significantly increased the system's attack surface, leading to increasingly prominent cybersecurity vulnerabilities. The traditional "security assumption" of physical isolation of ICS no longer holds true, making it an easy target for cyberattacks. A successful malicious attack on ICS could have consequences beyond simple economic losses, potentially escalating into regional production stoppages, serious environmental accidents, and even public safety crises, posing a serious threat to social stability.

[0018] Fuzzing, as a highly efficient software vulnerability discovery technique, has been widely used in the security testing of industrial control systems. The key to the success of fuzzing industrial control systems lies not in the quantity of test cases, but in their quality. The importance of test case selection lies precisely in this: by eliminating redundant and inefficient test inputs, the selection mechanism ensures that each executed test case is more targeted. For industrial control environments where interruptions are not easily tolerated and testing windows are extremely limited, this efficiency improvement is crucial, directly impacting the ability to discover, to the greatest extent possible, critical flaws that could threaten production safety and system stability within a limited timeframe. Therefore, comprehensive and efficient security testing of industrial control software, proactively discovering and eliminating vulnerabilities, is an urgent need to ensure the safe operation of industrial systems. In the vulnerability testing process, test case generation (e.g., through fuzzing) and selection are core steps. However, the number of automatically generated test cases is often astronomical, and how to quickly identify "effective" test cases from them is a recognized challenge in the industry.

[0019] Currently, the security testing issues for industrial control system software mainly include the following three aspects: (1) Problems with low reuse and automation of Proof of Concept (PoC): Currently, PoC scripts or exploit instructions are usually in the form of unstructured command lines, code snippets, or natural language descriptions. This form is not conducive to machine parsing and automated processing, resulting in low automation of subsequent work such as vulnerability reproduction, regression testing, and defense rule generation, and making it difficult to accumulate and reuse knowledge efficiently.

[0020] (2) The problem of weak vulnerability discovery capability: Due to the long life cycle of industrial control software, there are a large number of potential security risks based on known vulnerability variants or similar logic. Traditional testing methods usually focus on publicly disclosed vulnerabilities with clear characteristics. They have limited ability to discover unknown "same-source" vulnerabilities caused by code similarity, and cannot effectively warn and discover potential risks.

[0021] (3) Problems of low testing efficiency, high cost, and difficulty in implementation of screening: Current methods for screening test cases for industrial control software, such as those that mainly rely on runtime information feedback or complex reverse engineering, have inherent defects such as high screening process overhead, high technical threshold, and heavy dependence on the testing environment. If relying entirely on manual reverse analysis or indiscriminate fuzzy testing, an extremely large number of test cases will be generated. Verifying and analyzing these massive test cases one by one requires huge amounts of manpower, time, and computing resources, resulting in long testing cycles and high costs. Deploying and applying these screening technologies, especially in "crowdsourcing" scenarios where source code, documentation, and the runtime environment are lacking, is often difficult to implement effectively, resulting in a large number of invalid and inefficient test cases that cannot be accurately filtered, making it difficult to meet the guarantee requirements for efficient and in-depth vulnerability mining in complex industrial control environments.

[0022] In view of this, this application provides a method and related equipment for screening test cases of industrial control software based on vulnerability intelligence. This scheme acquires vulnerability intelligence information of industrial control software and constructs a vulnerability intelligence knowledge base based on this information. Semantic vectorization is performed on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and a vulnerability intelligence vector database is constructed based on these vectors. The current user's natural language query is converted into a query vector. The query vectors are then compared with several vulnerability intelligence vectors in the vulnerability intelligence vector database to perform similarity searches, selecting a target number of retrieval results. The most critical feature group corresponding to each retrieval entry in the retrieval results is extracted. The retrieval results are rearranged, and several test cases to be evaluated are matched with the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain a comprehensive score for each test case to be evaluated. Based on the comprehensive score of each test case to be evaluated, the target test case screening results are determined. This application embodiment effectively solves the current problems of fragmented vulnerability knowledge and difficulty in automated exploitation by constructing a structured vulnerability intelligence knowledge base and building a vulnerability intelligence vector database based on the vulnerability intelligence knowledge base. Furthermore, by calculating the matching degree between test cases and the pre-built structured vulnerability knowledge vector database, high-potential test cases can be efficiently identified and ranked from massive test data. By reordering the retrieval and recall results and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval and recall entry in the retrieval and recall results, a comprehensive score is obtained for each test case to be evaluated. Then, based on the comprehensive score of each test case to be evaluated, the target test case screening results are determined. This can simultaneously evaluate the macro-logical similarity and micro-feature matching degree of test cases, greatly improving the accuracy of test case screening and the ability to discover vulnerability variants. Moreover, this screening process does not depend on the real-time operation and feedback of the target program, and the calculation speed is much faster than the actual fuzzy testing execution cycle, significantly shortening the vulnerability discovery cycle and reducing testing costs.

[0023] The method for screening test cases for industrial control software based on vulnerability intelligence provided in this application relates to the field of network security technology. This method can be applied to terminals, servers, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the method for screening test cases for industrial control software based on vulnerability intelligence, but is not limited to the above forms.

[0024] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0025] Please see Figure 1 , Figure 1 This is an optional flowchart of the test case screening method for industrial control software based on vulnerability intelligence provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0026] Step S101: Obtain industrial control software vulnerability intelligence information and construct a vulnerability intelligence knowledge base based on the industrial control software vulnerability intelligence information; In some embodiments, step S101 may include: acquiring industrial control software vulnerability intelligence information; performing data cleaning and standardization processing on the industrial control software vulnerability intelligence information to obtain standardized vulnerability intelligence data; using a large language model to perform feature extraction and template processing on the standardized vulnerability intelligence data to generate several vulnerability knowledge entries; and constructing a vulnerability intelligence knowledge base based on the several vulnerability knowledge entries.

[0027] In step S101, firstly, security intelligence related to industrial control equipment (i.e., collecting industrial control software vulnerability intelligence information) is systematically collected from public channels, including but not limited to Common Vulnerabilities and Exposures (CVEs) and their reproducible exploits, official vulnerability announcements, and security patch notices. Then, the collected unstructured or semi-structured data is cleaned and standardized to extract core information. Subsequently, the standardized core vulnerability data is deeply analyzed using a Large Language Model (LLM) to form structured vulnerability knowledge entries. Finally, a high-quality, structured industrial control (IC) vulnerability intelligence knowledge base is formed based on the structured vulnerability knowledge entries.

[0028] To construct an efficient, accurate, and indexable vector database, all original documents must adhere to a unified standardization process. In this embodiment, the process for cleaning and standardizing industrial control software vulnerability intelligence information is as follows: First, all documents must undergo rigorous cleaning and format standardization, removing irrelevant noise and converting them all to a clearly structured Markdown format. Based on the Markdown text, a structure-aware chunking strategy must be adopted, using the document's heading level (e.g., ##) as the primary segmentation criterion to ensure the semantic and logical integrity of each knowledge chunk and avoid disrupting the context. Each independent document should be forcibly added with rich metadata tags containing dimensions such as vulnerability type, involved tools, and document type through Markdown Front Matter, enabling precise filtering and routing during retrieval. Before being vectorized, each final generated knowledge chunk is preceded by a core question or a concise summary, making it more closely aligned with the user's query intent in the vector space.

[0029] In the specific implementation, the process of feature extraction and template processing of standardized vulnerability intelligence data using a large language model is as follows: First, all standardized vulnerability data are automatically classified according to their attack type (such as stack overflow, command injection, directory traversal, denial of service, etc.); Second, for each vulnerability type, the model further extracts the most critical feature group that triggers the vulnerability. These most critical features may be a specific parameter in the protocol, a unique payload slice, or a specific operation sequence; Finally, all vulnerability information after vulnerability classification (including CVE number, description, classification, affected devices, etc.) and their corresponding most critical features are integrated into a standardized template to form structured vulnerability knowledge entries, ultimately forming a high-quality, structured industrial control (IC) vulnerability intelligence knowledge base.

[0030] Step S102: Semantic vectorization processing is performed on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and a vulnerability intelligence vector database is constructed based on the several vulnerability intelligence vectors. In some embodiments, step S102 may include: performing semantic slicing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several text blocks; using a text encoder to vectorize the several text blocks to obtain several vulnerability intelligence vectors, and constructing an approximate nearest neighbor index for each vulnerability intelligence vector; and constructing a vulnerability intelligence vector database based on the several vulnerability intelligence vectors.

[0031] In the specific implementation, firstly, each structured vulnerability knowledge entry in the vulnerability intelligence knowledge base is chunked to obtain multiple semantically independent and appropriately sized small segments. Next, a text encoder is used to convert the text chunks obtained after text chunking into high-dimensional vectors, and an efficient vector index is constructed. Finally, a high-quality, structured industrial control (IC) vulnerability vector knowledge base is formed. Through vectorization technology, it can be efficiently retrieved, providing accurate knowledge support for subsequent test case selection.

[0032] The quality of segmentation directly impacts subsequent retrieval and generation. To better handle diverse vulnerability intelligence documents, semantic segmentation can be used to first convert the document into vectors by sentence or paragraph. By calculating the cosine similarity of consecutive vector segments, segmentation occurs where similarity drops sharply, ensuring that each chunk maintains a consistent theme. Structural segmentation can utilize tags such as titles, lists, and tables in the document to group sections, tables, or code snippets into individual chunks. For technical documents, code blocks and diagram descriptions can be structurally segmented into separate chunks for easier retrieval and utilization. LLM intelligent segmentation can be employed, allowing large language models to learn from the document and determine appropriate segmentation positions to ensure semantic integrity. For example, GPT-4 can be used to segment complex vulnerability reproduction documents, providing the most reasonable segmentation scheme based on the paper's logical structure and semantic relationships.

[0033] Step S103: Convert the current user's natural language query into a query vector; In the specific implementation, users need to provide three dimensions of filtering indicators: target device (such as specific manufacturer and model), vulnerability type (such as the result of attack type classification in step S101), and optional related target requirements (such as specifying protocols, ports, or services). The system combines these indicators into a natural language query and transforms the natural language query into a query vector using the same text encoder as in step S102.

[0034] Step S104: Perform similarity retrieval between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filter out the target number of retrieval recall results, and extract the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results. In some embodiments, step S104 may include: selecting several candidate vulnerability intelligence vectors similar to the query vector from the vulnerability intelligence vector database according to the index matching rules; calculating the semantic distance between the query vector and each candidate vulnerability intelligence vector to select a target number of retrieval recall results; and extracting the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results.

[0035] In the specific implementation, the query vector generated in step S103 is sent to the constructed vulnerability intelligence vector database for similarity retrieval. Specifically, firstly, the indexing system (such as graph-based or clustering-based systems) quickly identifies a batch of candidate vulnerability intelligence vectors; then, by calculating the semantic distance (such as cosine similarity) between the query vector and the candidate vulnerability intelligence vectors, the top-k vulnerability knowledge entries that are closest to the query intent are selected as the retrieval recall results. At the same time, the "most critical feature group" corresponding to these k vulnerability knowledge entries is extracted.

[0036] Step S105: The retrieval and recall results are rearranged, and several test cases to be evaluated are matched with the most critical feature group corresponding to each retrieval and recall entry in the retrieval and recall results to obtain the comprehensive score corresponding to each test case to be evaluated. In some embodiments, step S105 may include: reordering each retrieved entry in the retrieval recall results using a reordering model to obtain a reordered matching score corresponding to each retrieved entry; calculating a relevance score based on the reordered matching score corresponding to each retrieved entry; wherein the relevance score is used to characterize the degree of matching between the retrieval recall results and the natural language query; performing string matching between the payload content of several test cases to be evaluated and the most critical feature group corresponding to each retrieved entry in the retrieval recall results to obtain a feature score corresponding to each test case to be evaluated; and calculating a comprehensive score corresponding to each test case to be evaluated based on the relevance score and the feature score corresponding to each test case to be evaluated.

[0037] To further improve the screening accuracy, the k recalled results are rearranged, and each test case is comprehensively scored by combining feature matching. The final comprehensive score of the test case is the sum of the related score and the feature score: score = related + mark.

[0038] (1) Calculation of related score: The k vulnerability knowledge items retrieved in step S104 are re-ranked using a re-ranking model (e.g., Rerank). The re-ranking model uses a deep cross-attention mechanism to accurately calculate the semantic matching degree between the user's natural language query and these k vulnerability knowledge items, outputting a score between 0 and 1 each time (corresponding to the re-ranking matching score mentioned above). The related score is the sum of the k scores. This related score represents the degree of matching between the recalled vulnerability knowledge items and the user's query.

[0039] (2) Feature score (mark) calculation: Each feature in the "most critical feature group" recalled in step S104 is matched against the payload content of the test case to be evaluated (such as a pcap packet). For each successful match, the feature score (mark) is incremented by 1, with no upper limit. The system repeats the feature score (mark) calculation process for all test cases to be screened, and finally calculates the comprehensive score for each test case.

[0040] Step S106: Determine the target test case screening results based on the comprehensive score corresponding to each of the test cases to be evaluated.

[0041] In some embodiments, step S106 may include: sorting the comprehensive scores corresponding to each test case to be evaluated in descending order to obtain a comprehensive score ranking result; and determining the target test case screening result based on the comprehensive score ranking result.

[0042] In the specific implementation, the test cases are sorted in descending order based on the comprehensive score calculated for each test case. The higher the score, the stronger the correlation between the test case and the user-defined target device and vulnerability type, and the more relevant key vulnerability features it hits. Therefore, it is more likely to trigger the target vulnerability. Finally, this sorted list is output as the filtering result.

[0043] Steps S101 to S106 as shown in this embodiment involve: acquiring industrial control software vulnerability intelligence information and constructing a vulnerability intelligence knowledge base based on this information; performing semantic vectorization on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and constructing a vulnerability intelligence vector database based on these vectors; converting the current user's natural language query into a query vector; performing similarity retrieval between the query vectors and several vulnerability intelligence vectors in the vulnerability intelligence vector database to select a target number of retrieval recall results, and extracting the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results; reordering the retrieval recall results, and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results to obtain a comprehensive score for each test case to be evaluated; and determining the target test case selection results based on the comprehensive score corresponding to each test case to be evaluated. This application embodiment effectively solves the current problems of fragmented vulnerability knowledge and difficulty in automated exploitation by constructing a structured vulnerability intelligence knowledge base and building a vulnerability intelligence vector database based on the vulnerability intelligence knowledge base. Furthermore, by calculating the matching degree between test cases and the pre-built structured vulnerability knowledge vector database, high-potential test cases can be efficiently identified and ranked from massive test data. By reordering the retrieval and recall results and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval and recall entry in the retrieval and recall results, a comprehensive score is obtained for each test case to be evaluated. Then, based on the comprehensive score of each test case to be evaluated, the target test case screening results are determined. This can simultaneously evaluate the macro-logical similarity and micro-feature matching degree of test cases, greatly improving the accuracy of test case screening and the ability to discover vulnerability variants. Moreover, this screening process does not depend on the real-time operation and feedback of the target program, and the calculation speed is much faster than the actual fuzzy testing execution cycle, significantly shortening the vulnerability discovery cycle and reducing testing costs.

[0044] To explain in detail the principles of the technical solution of this application, the overall process of this application will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principles of this application and should not be regarded as a limitation of this application.

[0045] The system and corresponding methods provided in this application aim to effectively solve the problems existing in related technologies, such as low effectiveness of generated test cases, low testing efficiency due to massive test cases, insufficient testing accuracy, and weak ability to discover potential homogeneous vulnerabilities. This application combines semantic distance filtering of vectors with syntactic-level deep filtering strategies for test cases, and performs structured processing of vulnerability exploitation knowledge (PoC), automatically selecting high-probability test cases that trigger vulnerabilities from massive fuzzy testing data, thereby discovering potential vulnerabilities and risks and ensuring the security of industrial control systems. Specifically, in the face of a threat model where attackers may exploit known vulnerability variants or similar logic to launch attacks, this application aims to discover "homogeneous" and "variant" vulnerabilities in different systems, series of devices, and manufacturers before attackers, preventing catastrophic attacks such as monitoring software crashes and remote code execution caused by unknown or variant vulnerabilities, maintaining the stable operation of industrial control systems, protecting the security of critical infrastructure, and reducing economic losses and social impact caused by cyberattacks.

[0046] The basic system for implementing the industrial control software test case screening method based on vulnerability intelligence in this application embodiment mainly includes three modules: a vulnerability knowledge and vulnerability intelligence module, a vector database construction module, and an intelligent test case screening and sorting module. (1) Vulnerability Knowledge and Intelligence Module: This module adopts systematic vulnerability intelligence collection and standardized processing technology, which is the cornerstone for ensuring the quality of all subsequent processing. This module first cleans the original intelligence such as CVEs and security bulletins, unifies them into a structured Markdown format, and forcibly adds metadata tags. For extremely complex knowledge systems, a hierarchical index of abstracts and original texts can be established. Through a two-stage model of "first locate the document, then retrieve the details", an expert-level knowledge search path is simulated, and finally a context-complete, accurate, and hierarchical intelligent knowledge system is formed. That is, a high-quality, structured industrial control (IC) vulnerability intelligence knowledge base is constructed, which provides underlying knowledge support for the subsequent construction of a high-quality vector database.

[0047] (2) Vector Database Construction Module: This module adopts key feature extraction and multi-strategy intelligent sharding technology. Through various strategies such as structure awareness and semantic segmentation, the original knowledge is processed into knowledge chunks with complete context and distinct levels. Combined with metadata, a vector index is constructed. Using data-driven strategy adjustment and resource reuse mechanisms, a high-quality, structured industrial control (IC) vulnerability vector knowledge base is constructed. Through vectorization technology, it can be efficiently retrieved, providing accurate knowledge support for subsequent test case selection.

[0048] (3) Intelligent Test Case Screening and Ranking Module: This module uses an intelligent screening and scoring mechanism combining "vector retrieval - re-ranking and selection - feature matching" to screen target strategies. It includes the following core functions: performing vector semantic retrieval based on user queries to recall highly relevant candidate vulnerability knowledge; using the re-ranking model to perform secondary selection of the candidate set and calculate accurate relevance scores; and matching test case payloads with key vulnerability features extracted from the vulnerability intelligence vector knowledge base to calculate feature hit scores. The entire process forms a screening pipeline of "defining targets - retrieving knowledge - accurate scoring - optimizing ranking". By deeply associating external vulnerability knowledge with internal test case content, it intelligently evaluates the potential value of each test case.

[0049] Please see Figure 2 , Figure 2 This is a flowchart illustrating the industrial control software test case selection method based on vulnerability intelligence provided in this application embodiment, as follows: Figure 2 As shown, Figure 2 The specific implementation process of the industrial control software test case screening method based on vulnerability intelligence may include, but is not limited to, steps S201 to S203: Step S201, Feature extraction and template based on vulnerability intelligence: Obtain vulnerability intelligence of industrial control system vulnerabilities, clean and standardize the vulnerability intelligence to obtain the most critical feature group of multi-source vulnerabilities.

[0050] Understandably, this step aims to build an efficient and accurate framework for extracting and integrating key features of vulnerability intelligence, and to establish a high-quality, structured industrial control (ICS) vulnerability intelligence knowledge base. This will provide underlying knowledge support for the subsequent construction of a high-quality vector database. Please refer to [link / reference]. Figure 3 , Figure 3 This is a schematic diagram of the feature extraction and templated process based on vulnerability intelligence provided in an embodiment of this application, such as... Figure 3 As shown, the specific implementation process of step S201 may include, but is not limited to, steps S2011 to S2012: Step S2011, Vulnerability Intelligence Collection and Standardization Processing: First, systematically collect security intelligence related to industrial control equipment from public channels, including but not limited to common vulnerability disclosures (CVEs) and their reproducible verification code (Exploit), official vulnerability announcements and security patch notices; then, clean and standardize the collected unstructured or semi-structured data, extract core information, and prepare for subsequent vectorization processing.

[0051] Specifically, in this embodiment, to construct an efficient, accurate, and indexable vector database, all original documents must follow a unified standardization process. First, all documents must undergo rigorous cleaning and format standardization, removing irrelevant noise and converting them all to a clearly structured Markdown format. Based on the Markdown text, a structure-aware chunking strategy must be adopted, using document heading levels (such as ##) as the primary segmentation criterion to ensure the semantic and logical integrity of each knowledge chunk and avoid disrupting the context. Each independent document should be forcibly tagged with rich metadata tags containing dimensions such as vulnerability type, involved tools, and document type through Markdown FrontMatter to enable precise filtering and routing during retrieval. Before being vectorized, each final generated knowledge chunk is preceded by a core question or a concise summary, making it more closely aligned with the user's query intent in the vector space.

[0052] Step S2012, Vulnerability Key Feature Extraction and Templated: A deep analysis of the normalized vulnerability data from Step S2011 is performed using a Large Language Model (LLM). Specifically, firstly, all normalized vulnerability data is categorized by their attack type (e.g., ...). Figure 3 The system automatically categorizes vulnerabilities (such as stack overflows, command injections, directory traversals, and denial-of-service attacks). Secondly, for each vulnerability type, the model further extracts the most critical feature set that triggers the vulnerability. These most critical features may be a specific parameter in the protocol, a unique payload slice, or a specific sequence of operations. Finally, all vulnerability information after classification (including CVE number, description, classification, affected devices, etc.) and their corresponding most critical features are integrated into the standardized template mentioned in step S2011 to form structured vulnerability knowledge entries, thus creating a high-quality, structured industrial control (IC) vulnerability intelligence knowledge base.

[0053] Step S202: Construct a vector database based on semantically similar vulnerability intelligence: intelligently segment the normalized text, then vectorize the segments to construct a high-quality, structured industrial control vulnerability vector knowledge base.

[0054] In this step, the vulnerability intelligence data in the vulnerability intelligence knowledge base after template processing in step S201 is vectorized to construct a high-quality, structured industrial control (ICS) vulnerability vector knowledge base. This process includes: first, chunking each structured vulnerability knowledge entry; then, using an advanced text encoder to convert the text chunks into high-dimensional vectors and constructing an efficient vector index. This step aims to build a high-quality, structured industrial control (ICS) vulnerability vector knowledge base, enabling efficient retrieval through vectorization technology, and providing accurate knowledge support for subsequent test case selection. Please refer to [link to relevant documentation]. Figure 4 and Figure 5 , Figure 4 This is a schematic diagram illustrating the vulnerability intelligence vector database construction process provided in this application embodiment. Figure 5 This is a schematic diagram of the vector database construction algorithm provided in the embodiments of this application, such as... Figure 4 and Figure 5 As shown, the specific implementation process of step S202 may include, but is not limited to, steps S2021 to S2022: Step S2021, semantic similarity slicing: semantic segmentation is performed on all data in the vulnerability intelligence knowledge base after the template processing in step S201.

[0055] In the specific implementation, firstly, each structured vulnerability knowledge entry in the vulnerability intelligence knowledge base is chunked: long documents are divided into multiple semantically independent and appropriately sized small segments (chunks). The quality of the chunking directly affects the subsequent recall and generation quality. To better handle diverse vulnerability intelligence documents, this application embodiment provides multiple chunking methods in this step, as detailed below: (1) Semantic segmentation: First, the document is converted into vectors by sentences or paragraphs. Then, the cosine similarity of consecutive vector segments is calculated, and segmentation is performed where the similarity drops sharply, ensuring that each chunk has a consistent theme. The formula for calculating cosine similarity is: ; in, Represents the cosine similarity value. and This represents the vector after feature transformation. Representing vectors and dot product, and Representing vectors and The module length. When processing vulnerability announcements, semantic segmentation can accurately divide the content of different research sections, avoiding putting unrelated content in the same small chunk.

[0056] (2) Structural segmentation: Using tags such as titles, lists, and tables in the document, a "section", "table", or "code snippet" can be treated as a small chunk. For technical documents, code blocks, diagrams, and other elements can be segmented into separate chunks for easier retrieval and use later.

[0057] (3) LLM Intelligent Segmentation: The large language model learns the document and determines the appropriate segmentation position to ensure semantic integrity. For example, GPT-4 is used to segment complex vulnerability reproduction documents and gives the most reasonable segmentation scheme based on the logical structure and semantic relationship of the paper.

[0058] Step S2022, Vulnerability Intelligence Vectorization and Index Construction: Using an advanced text encoder, the text blocks obtained after text segmentation are converted into high-dimensional vectors, and an efficient vector index is constructed. That is, step S2022 mainly includes two sub-steps: vector transformation and index construction.

[0059] The specific implementation of vector transformation is as follows: each text block is fed into a vectorized embedding model. A text block containing N words, after processing by the embedding model, has each word mapped to a high-dimensional vector. The entire text block can be represented as a set of vectors. Vectors can represent the semantics of text in a high-dimensional space; the closer the distance between vectors, the closer the semantics of the original text.

[0060] The specific implementation of index construction involves writing "text block-vector" pairs into a vector database. Internally, the vector database builds an approximate nearest neighbor index, organizing high-dimensional vectors into a graph or cluster structure so that subsequent queries can return the k text blocks closest to the query vector within milliseconds. By constructing a hierarchical graph structure, long connections are used at higher levels to quickly narrow the search scope, while short connections are used at lower levels to ensure search accuracy, thus achieving fast vector retrieval. Specifically, the vector database can quickly find the text block vector closest to the query vector through the index, and then return the corresponding text block content. Therefore, all vectors and their metadata are stored in a dedicated vector database to facilitate fast and accurate semantic similarity retrieval later.

[0061] Step S203, Intelligent screening strategy for test cases based on feature matching weight rules: Intelligent screening of test cases is performed based on the rearrangement and comprehensive score calculation of feature matching weight rules.

[0062] The core of this step is to intelligently identify and prioritize test cases most likely to trigger specific vulnerabilities from a massive pool of test cases using user-defined filtering criteria. Please refer to [link / reference]. Figure 6 and Figure 7 , Figure 6 This is a flowchart illustrating the intelligent test case filtering strategy provided in this application embodiment. Figure 7 This is a schematic diagram of the test case selection weighting algorithm provided in the embodiments of this application, as shown below. Figure 6 and Figure 7 As shown, the specific implementation process of step S203 may include, but is not limited to, steps S2031 to S2034: Step S2031, Filtering Task Definition and Query Vectorization: The user needs to provide three dimensions of filtering indicators: target device (such as specific manufacturer and model), vulnerability type (such as the classification result in step S2012), and optional related target requirements (such as specifying protocols, ports, or services). The system combines these indicators into a natural language query and transforms the natural language query into a query vector using the same encoder as in step S2022.

[0063] Step S2032, Vector Retrieval and Candidate Set Recall: The query vector generated in step S2031 is sent to the constructed vulnerability intelligence vector database for similarity retrieval. Specifically, firstly, the indexing system (e.g., graph-based or clustering-based) quickly identifies a batch of candidate vectors; then, by calculating the semantic distance (e.g., cosine similarity) between the query vector and the candidate vectors, the top-k vulnerability knowledge entries that are closest to the query intent are selected as the recall results. At the same time, the "most critical feature group" corresponding to these k vulnerability knowledge entries is extracted.

[0064] Step S2033, Rearrangement and Comprehensive Score Calculation: To further improve the screening accuracy, the k recalled results are rearranged, and a comprehensive score is calculated for each test case based on feature matching. The final comprehensive score of the test case is the sum of the related score and the feature score: score = related + mark.

[0065] (1) Calculation of related score: The k vulnerability knowledge items retrieved in step S2032 are re-ranked using a re-ranking model (e.g., Rerank). The re-ranking model uses a deep cross-attention mechanism to accurately calculate the semantic matching degree between the user's natural language query and these k vulnerability knowledge items, outputting a score between 0 and 1 each time. The related score is the sum of the k scores. This related score represents the degree of matching between the recalled vulnerability knowledge items and the user query. The deep cross-attention mechanism of the re-ranking model can be understood as feeding the joint text into a Transformer model trained with cross-attention. Inside the model, each word in the natural language query and each word in the paragraph are bidirectionally monitored to capture fine-grained matching signals, such as entity alignment, synonym rewriting, and hierarchical relationships. From a mathematical perspective, the expression for the attention mechanism can be represented as: ; in, Represents the query vector. Represents the key vector. Represents a value vector. This represents the dimension of the key vector. Features representing attention output express and The dot product. Through this attention calculation, the semantic connections between texts can be captured more effectively.

[0066] (2) Feature score (mark) calculation: Each feature in the "most critical feature group" recalled in step S2032 is matched with the payload content of the test case to be evaluated (such as a pcap package). For each successful match, the feature score (mark) is incremented by 1, and there is no upper limit to the score.

[0067] Finally, the final comprehensive score of the test case is obtained by summing the related score and the feature score: score = related + mark.

[0068] Step S2034, Test Case Sorting and Output: First, the system repeats the scoring process of step S2033 for all test cases to be screened. Then, it sorts the test cases in descending order based on the total score calculated for each test case. The higher the score of a test case, the stronger its content is related to the user-defined target device and vulnerability type, and the more relevant key vulnerability features it hits. Therefore, it is more likely to trigger the target vulnerability. Finally, this sorted list is output as the screening result.

[0069] It should be noted that this embodiment is only a brief illustrative description of the overall process of the industrial control software test case screening method based on vulnerability intelligence. The detailed description of each step can be referred to the relevant content in the foregoing embodiment, and will not be repeated here. It is understood that this application does not impose any limitations on this.

[0070] The key point of the industrial control software test case screening method based on vulnerability intelligence provided in this application embodiment is: (1) Construction and Templating of External Vulnerability Intelligence Knowledge Base: Based on Large Language Model (LLM) and structured data processing technology, unstructured and publicly available vulnerability intelligence (such as CVEs, security bulletins, and exploit code) can be systematically transformed into a machine-readable and structured vulnerability intelligence knowledge base. This process not only includes the automatic classification of vulnerabilities, but also extracts and labels the "most critical technical feature groups" that trigger vulnerabilities, effectively solving the current problem of fragmented vulnerability knowledge and difficulty in automated exploitation.

[0071] This method involves building and utilizing a pre-processed, structured vulnerability intelligence knowledge base to efficiently identify and rank high-potential use cases from massive amounts of test data. Compared to traditional filtering methods that rely on runtime feedback, this approach is more efficient and universal, enabling precise targeting of specific types of vulnerabilities without requiring testers to perform complex environment configurations or reverse engineering. (2) Knowledge-driven test case pre-screening method: Test cases are screened through static analysis, that is, without actually executing the target program, the value of the test case is evaluated by calculating the similarity between the test case payload and the pre-built vulnerability intelligence knowledge base. This method completely decouples the screening process from the specific testing environment, greatly reduces the screening overhead, and fundamentally solves the implementation problem faced by traditional dynamic analysis methods in black-box testing or complex environments.

[0072] (3) Hybrid scoring mechanism combining semantics and syntax: A hybrid scoring algorithm is adopted. The related score captures the deep semantic similarity between test cases and vulnerability attack logic through an advanced reranking model; the mark score identifies explicit attack syntax by performing precise string matching on key features. This mechanism can simultaneously evaluate the macro-logical similarity and micro-feature matching degree of test cases, which greatly improves the accuracy of screening and the ability to discover vulnerability variants.

[0073] The beneficial effects of the industrial control software test case screening method based on vulnerability intelligence provided in this application are as follows: (1) Using techniques such as large language models, unstructured vulnerability intelligence is systematically processed into standardized and structured knowledge entries containing information such as vulnerability classification and key technical feature groups. This process transforms the originally scattered knowledge into queryable, computable, and automatically usable data. This not only provides a high-quality data foundation for subsequent screening algorithms, but also enables the automated reuse of knowledge for subsequent vulnerability reproduction, regression testing, and defense rule generation, solving the problem of low knowledge reuse in current technologies.

[0074] (2) Traditional methods, such as those based on data flow tracing or complex reverse engineering, have high technical barriers and are heavily dependent on the testing environment (e.g., requiring instrumentation, source code, or debugging interfaces). In black-box or gray-box scenarios such as "crowdsourcing testing" where source code, documentation, and the runtime environment are lacking, these methods are difficult to implement effectively, resulting in insufficient screening accuracy. The embodiments of this application decouple the screening logic from the target testing environment. Its core technical means is to build an external vulnerability intelligence knowledge base and perform dual evaluation through semantic similarity and key feature matching. It has universality and can be applied to complex black-box testing scenarios, effectively screening out accurate test cases and solving the problem of difficult implementation of traditional methods.

[0075] (3) Current testing methods typically focus on discovering seeds that can trigger new code paths. Their ability to discover test cases that exploit variants or similar logic of known vulnerabilities (i.e., "same-source" vulnerabilities) is limited. This application addresses this issue through vectorized semantic retrieval technology. Since vector embedding models can capture the deep semantics of text, even if the description of a new vulnerability variant or its payload is not entirely identical to a known vulnerability in the vulnerability intelligence knowledge base, as long as their attack principles, target components, or logic are similar, the distance between their vectors in space will be very close. The test case screening method in this application can identify this "similarity" by calculating semantic distance (related score), thereby effectively providing early warning and discovering unknown "same-source" or "variant" vulnerabilities, greatly expanding the breadth and depth of vulnerability discovery.

[0076] (4) Compared with related technologies, most of the related technologies rely on runtime feedback (such as code coverage and program crashes) to evaluate and schedule seeds. They require the continuous execution of test cases during the testing process, which is very costly, especially when the corpus is large, the computational and time costs will increase significantly. The embodiments of this application calculate the matching degree between test cases (pcap) and a pre-built structured vulnerability knowledge vector database. Before the actual test is executed, a round of efficient priority ranking of massive test cases is performed. This screening process does not rely on the real-time operation and feedback of the target program. The calculation speed is much faster than the actual fuzz test execution cycle. By prioritizing the test cases with the highest scores, high-value test areas can be reached at a lower cost and in a shorter time, which significantly shortens the vulnerability discovery cycle and reduces the testing cost. This solves the problem of low efficiency and high cost caused by the verification of massive invalid test cases. At the same time, it can also provide more powerful decision support for the security assessment of industrial control systems and greatly improve the security and reliability of critical infrastructure.

[0077] Therefore, the vulnerability intelligence knowledge base construction, intelligent filtering, and hybrid scoring strategies adopted in this application embodiment can dynamically evaluate diverse test data before testing begins. This technology can identify and rank test cases targeting various known vulnerability patterns and their variants, including but not limited to data format errors, protocol logic defects, and command injection. Furthermore, the vulnerability intelligence knowledge base in this application embodiment can be flexibly updated based on the latest threat intelligence to meet the evolving security testing needs of different industrial control systems. The vulnerability intelligence-based industrial control software test case filtering method provided in this application embodiment can be widely applied in fields such as automated security testing, threat intelligence analysis, and vulnerability management, and has broad application prospects.

[0078] Please see Figure 8 This application embodiment also provides an industrial control software test case screening device 800 based on vulnerability intelligence, which can implement the above method. The device includes the following modules: The vulnerability intelligence knowledge base construction module 801 is used to acquire vulnerability intelligence information of industrial control software and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information of industrial control software. The vulnerability intelligence vector database construction module 802 is used to perform semantic vectorization processing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and to construct a vulnerability intelligence vector database based on the several vulnerability intelligence vectors. Natural language query vectorization module 803 is used to convert the current user's natural language query into a query vector; The semantic retrieval and feature extraction module 804 is used to perform similarity retrieval between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filter out a target number of retrieval recall results, and extract the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results. The test case comprehensive score calculation module 805 is used to rearrange the retrieval recall results and perform feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results to obtain the comprehensive score corresponding to each test case to be evaluated. The test case screening result determination module 806 is used to determine the target test case screening result based on the comprehensive score corresponding to each of the test cases to be evaluated.

[0079] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0080] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0081] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0082] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the methods described in the embodiments of this application. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0083] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0084] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0085] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0086] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0087] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0088] The method and related equipment for screening test cases for industrial control software based on vulnerability intelligence provided in this application embodiment acquire industrial control software vulnerability intelligence information and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information; perform semantic vectorization processing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and construct a vulnerability intelligence vector database based on several vulnerability intelligence vectors; convert the current user's natural language query into a query vector; perform similarity retrieval between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, screen out a target number of retrieval recall results, and extract the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results; perform reordering processing on the retrieval recall results, and perform feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results to obtain a comprehensive score corresponding to each test case to be evaluated; determine the target test case screening results based on the comprehensive score corresponding to each test case to be evaluated. This application embodiment effectively solves the current problems of fragmented vulnerability knowledge and difficulty in automated exploitation by constructing a structured vulnerability intelligence knowledge base and building a vulnerability intelligence vector database based on the vulnerability intelligence knowledge base. Furthermore, by calculating the matching degree between test cases and the pre-built structured vulnerability knowledge vector database, high-potential test cases can be efficiently identified and ranked from massive test data. By reordering the retrieval and recall results and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval and recall entry in the retrieval and recall results, a comprehensive score is obtained for each test case to be evaluated. Then, based on the comprehensive score of each test case to be evaluated, the target test case screening results are determined. This can simultaneously evaluate the macro-logical similarity and micro-feature matching degree of test cases, greatly improving the accuracy of test case screening and the ability to discover vulnerability variants. Moreover, this screening process does not depend on the real-time operation and feedback of the target program, and the calculation speed is much faster than the actual fuzzy testing execution cycle, significantly shortening the vulnerability discovery cycle and reducing testing costs.

[0089] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0090] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0091] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0092] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0093] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0094] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0096] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0098] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0099] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for selecting test cases for industrial control software based on vulnerability intelligence, characterized in that, The method includes the following steps: Acquire vulnerability intelligence information of industrial control software, and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information of industrial control software; Semantic vectorization is performed on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and a vulnerability intelligence vector database is constructed based on the several vulnerability intelligence vectors. Transform the current user's natural language query into a query vector; The query vector is compared with several vulnerability intelligence vectors in the vulnerability intelligence vector database to perform similarity retrieval, and a target number of retrieval recall results are selected. The most critical feature group corresponding to each retrieval recall entry in the retrieval recall results is extracted. The retrieval results are rearranged, and several test cases to be evaluated are respectively matched with the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain the comprehensive score corresponding to each test case to be evaluated. The target test case selection results are determined based on the comprehensive score corresponding to each of the test cases to be evaluated.

2. The method according to claim 1, characterized in that, The process of acquiring industrial control software vulnerability intelligence information and constructing a vulnerability intelligence knowledge base based on the industrial control software vulnerability intelligence information includes: Obtain vulnerability intelligence information of the industrial control software; The vulnerability intelligence information of the industrial control software is cleaned and standardized to obtain standardized vulnerability intelligence data; The standardized vulnerability intelligence data is subjected to feature extraction and template processing using a large language model to generate several vulnerability knowledge entries. The vulnerability intelligence knowledge base is constructed based on several vulnerability knowledge entries.

3. The method according to claim 1, characterized in that, The step of semantically vectorizing several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and constructing a vulnerability intelligence vector database based on the several vulnerability intelligence vectors, includes: Semantic slicing is performed on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several text blocks; A text encoder is used to vectorize several text blocks to obtain several vulnerability intelligence vectors, and an approximate nearest neighbor index is constructed for each vulnerability intelligence vector. The vulnerability intelligence vector database is constructed based on several of the aforementioned vulnerability intelligence vectors.

4. The method according to claim 1, characterized in that, The process involves performing similarity searches between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filtering out a target number of retrieval results, and extracting the most critical feature group corresponding to each retrieval entry in the retrieval results, including: Based on the index matching rules, several candidate vulnerability intelligence vectors similar to the query vector are selected from the vulnerability intelligence vector database. The semantic distance between the query vector and each candidate vulnerability intelligence vector is calculated to filter out the target number of retrieval results; Extract the most critical feature group corresponding to each of the retrieved entries in the retrieval results.

5. The method according to claim 1, characterized in that, The process involves rearranging the retrieval results and performing feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain a comprehensive score for each test case to be evaluated, including: A rearrangement model is used to rearrange each of the search recall entries in the search recall results to obtain a rearranged matching score corresponding to each of the search recall entries; A relevance score is calculated based on the rearranged matching score corresponding to each of the retrieved entries; wherein the relevance score is used to characterize the degree of matching between the retrieved results and the natural language query; The payload content of several test cases to be evaluated is matched with the most critical feature group corresponding to each of the search and recall entries in the search and recall results to obtain the feature score corresponding to each test case to be evaluated. The comprehensive score for each test case to be evaluated is calculated based on the relevance score and the feature score corresponding to each test case to be evaluated.

6. The method according to claim 1, characterized in that, The step of determining the target test case selection result based on the comprehensive score corresponding to each of the test cases to be evaluated includes: The comprehensive scores corresponding to each of the test cases to be evaluated are sorted in descending order to obtain the comprehensive score ranking results; The target test cases are selected based on the overall score ranking results.

7. A test case screening device for industrial control software based on vulnerability intelligence, characterized in that, The device includes the following modules: The vulnerability intelligence knowledge base construction module is used to acquire vulnerability intelligence information of industrial control software and construct a vulnerability intelligence knowledge base based on the vulnerability intelligence information of industrial control software. The vulnerability intelligence vector database construction module is used to perform semantic vectorization processing on several vulnerability knowledge entries in the vulnerability intelligence knowledge base to obtain several vulnerability intelligence vectors, and to construct a vulnerability intelligence vector database based on the several vulnerability intelligence vectors. The Natural Language Query Vectorization module is used to convert the current user's natural language query into a query vector. The semantic retrieval and feature extraction module is used to perform similarity retrieval between the query vector and several vulnerability intelligence vectors in the vulnerability intelligence vector database, filter out a target number of retrieval recall results, and extract the most critical feature group corresponding to each retrieval recall entry in the retrieval recall results. The test case comprehensive score calculation module is used to rearrange the retrieval results and perform feature matching between several test cases to be evaluated and the most critical feature group corresponding to each retrieval entry in the retrieval results to obtain the comprehensive score corresponding to each test case to be evaluated. The test case screening result determination module is used to determine the target test case screening result based on the comprehensive score corresponding to each of the test cases to be evaluated.

8. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images