Instruction generation method, apparatus, and related device

Abstract

The application provides an instruction generation method and device and related equipment, relates to the technical field of network security and cloud computing, and the instruction generation method comprises the following steps: acquiring prompt information; inputting the prompt information into a code generation model to obtain target code output by the code generation model; generating a syntax tree and a directed acyclic graph according to the target code; traversing the syntax tree to obtain a first semantic checking result, whether a first unreachable node and a first conflict path exist in the syntax tree, traversing the directed acyclic graph to obtain a second semantic checking result, whether a second unreachable node and a second conflict path exist in the directed acyclic graph, and performing language writing rule checking on the target code to obtain a syntax checking result; and in the case that the first semantic checking result, the second semantic checking result and the syntax checking result are all checked, performing compilation processing on the target code to obtain target instructions. In this way, the accuracy of the target instructions obtained finally can be improved.

Description

Technical Field

[0001] This application relates to the fields of network security and cloud computing technology, and in particular to an instruction generation method, apparatus and related equipment. Background Technology

[0002] With the continuous development of artificial intelligence technology, its application in people's lives is becoming increasingly widespread. Currently, large language models can be used to directly generate operation commands. However, large language models are prone to errors such as port errors and fabricated identifier (IP) addresses when generating operation commands, resulting in low accuracy of the generated operation commands. Summary of the Invention

[0003] This application provides an instruction generation method, apparatus, and related equipment to solve the problem of low accuracy in generated operation instructions.

[0004] To solve the above problems, this application is implemented as follows:

[0005] In a first aspect, embodiments of this application provide an instruction generation method, including:

[0006] Get the prompt information;

[0007] The prompt information is input into the code generation model to obtain the target code output by the code generation model;

[0008] Generate a syntax tree and a directed acyclic graph based on the target code;

[0009] The syntax tree is traversed to check for a first unreachable node and a first conflicting path to obtain a first semantic verification result. The directed acyclic graph is traversed to check for a second unreachable node and a second conflicting path to obtain a second semantic verification result. The target code is then subjected to language writing rule verification to obtain a syntax verification result.

[0010] If the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification, the target code is compiled to obtain the target instruction.

[0011] Secondly, embodiments of this application provide an instruction generation apparatus, comprising:

[0012] The information acquisition module is used to acquire prompt information;

[0013] The code output module is used to input the prompt information into the code generation model and obtain the target code output by the code generation model.

[0014] The generation module is used to generate a syntax tree and a directed acyclic graph based on the target code;

[0015] The verification module is used to traverse the syntax tree to check for the existence of a first unreachable node and a first conflicting path, and obtain a first semantic verification result; to traverse the directed acyclic graph to check for the existence of a second unreachable node and a second conflicting path, and obtain a second semantic verification result; and to perform language writing rule verification on the target code to obtain a syntax verification result.

[0016] The compilation processing module is used to compile the target code to obtain target instructions when the first semantic verification result, the second semantic verification result, and the syntax verification result are all verified to be passed.

[0017] Thirdly, embodiments of this application also provide an electronic device, including: a memory, a processor, and a program stored in the memory and executable on the processor; the processor is configured to read the program in the memory to implement the steps in the method described in the first aspect above.

[0018] Fourthly, embodiments of this application also provide a readable storage medium for storing a program, which, when executed by a processor, implements the steps of the method described in the first aspect above.

[0019] Fifthly, embodiments of this application also provide a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the method described in the first aspect above.

[0020] In this embodiment, a syntax tree and a directed acyclic graph (DAG) can be generated based on the target code output by the code generation model. Then, unreachable nodes and conflicting paths are traversed in the syntax tree and DAG respectively to obtain the first semantic verification result and the second semantic verification result. In addition, the target code can be verified by language writing rules to obtain the syntax verification result. Only when the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification can the target code be compiled to obtain the target instruction. In this way, only when the code generation model does not have port errors, fabricated IP addresses, or other such phenomena can the generated code ensure that the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification. This can ensure that the target code output by the code generation model has high accuracy, and thus the final target instruction also has high accuracy. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is one of the flowcharts illustrating the instruction generation method provided in the embodiments of this application;

[0023] Figure 2 This is one of the structural schematic diagrams of the electronic device provided in the embodiments of this application;

[0024] Figure 3 This is a second flowchart illustrating the instruction generation method provided in the embodiments of this application;

[0025] Figure 4 This is the third flowchart illustrating the instruction generation method provided in the embodiments of this application;

[0026] Figure 5 This is a schematic diagram of the structure of the instruction generation apparatus provided in the embodiments of this application;

[0027] Figure 6 This is the second schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0028] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] The terms "first," "second," etc., used in the embodiments of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this application indicates at least one of the connected objects, such as A and / or B and / or C, representing seven possibilities: including A alone, B alone, C alone, and the presence of both A and B, both B and C, both A and C, and the presence of A, B, and C.

[0030] Please see Figure 1 , Figure 1 This is a flowchart illustrating the instruction generation method provided in an embodiment of this application, as shown below. Figure 1 As shown, the instruction generation method may include the following steps:

[0031] Step 101: Obtain the prompt information.

[0032] The prompt message can be information entered by the user, and the prompt message can be used to achieve the target function. The specific type of the target function is not limited here. Optionally, the target function can be to achieve the external audit function. In this case, the prompt message can include the following: Allow the external audit team to access the financial statement service of Company A, only under Agreement B, valid for 24 hours.

[0033] It should be noted that the specific content of Company A and Agreement B is not limited here. Optionally, Company A can be Amazon Web Services (AWS), and Agreement B can be Hypertext Transfer Protocol Secure (HTTPS).

[0034] Step 102: Input the prompt information into the code generation model to obtain the target code output by the code generation model.

[0035] The code generation model mentioned above can be understood as a pre-trained model used to generate code. The training process of the code generation model can be described as follows: obtain prompt sample information from the sample pool, input the prompt sample information into the code generation model to be trained, and iteratively train the code generation model to be trained to obtain the predicted code output by the code generation model after iterative training. The number of rounds of iterative training can be multiple, and the prompt sample information obtained in each round can be different. When the matching degree between the predicted code output by the code generation model after the Nth round of iterative training and the actual code corresponding to the prompt sample information input into the code generation model during the Nth round of iterative training is greater than the preset matching degree, the code generation model after the Nth round of iterative training can be determined as the code generation model that has been trained. N is an integer greater than 1. Optionally, the code generation model can be a Large Language Model (LLM), and LLM has powerful semantic understanding capabilities, thus enabling the generated target code to have high accuracy.

[0036] Step 103: Generate a syntax tree and a directed acyclic graph based on the target code.

[0037] The generation of a syntax tree from the target code can be seen in the following description:

[0038] First, the target code is segmented and parsed. Then, it is split into multiple expressions according to grammatical rules. Next, the operators in the multiple expressions are used as internal nodes, and the operands in the multiple expressions are used as leaf nodes. A tree structure is built layer by layer according to the hierarchy, priority, and assumption order of the multiple expressions in the target code to generate a syntax tree. The syntax tree can be understood as a structured tree representation of the target code. The operators mentioned above can be understood as symbols or keywords used to perform operations and manipulate data in the multiple expressions corresponding to the target code, and the operands mentioned above can be understood as objects in the target code that are processed, calculated, or manipulated by the operators.

[0039] The generation of a directed acyclic graph from the target code can be seen in the following description:

[0040] A syntax tree can be generated from the target code. Then, at least one of the following operations can be performed on the syntax tree: merging common subexpressions and shared duplicate nodes, preserving code dependencies and operational logic, and eliminating redundant nodes. This will ultimately generate a directed acyclic graph. A common subexpression can be understood as an expression that appears repeatedly and is exactly the same.

[0041] Step 104: Traverse the syntax tree to check for a first unreachable node and a first conflicting path to obtain a first semantic verification result; traverse the directed acyclic graph to check for a second unreachable node and a second conflicting path to obtain a second semantic verification result; and perform language writing rule verification on the target code to obtain a syntax verification result.

[0042] As an optional implementation, both the first unreachable node and the second unreachable node are used to indicate the presence of redundant code in the target code, and both the first conflict path and the second conflict path are used to indicate the presence of code in the target code that matches both completely opposite rules. Thus, by traversing whether the aforementioned first unreachable node, first conflict path, second unreachable node, and second conflict path exist, it is possible to accurately determine whether there is redundant code and code that matches both completely opposite rules in the target code.

[0043] The existence of the first unreachable node and the first conflicting path in the traversal of the syntax tree can be described as follows: Starting from the root node of the syntax tree, the entire syntax tree is traversed using either Depth First Search (DFS) or Breadth First Search (BFS), recording all reachable nodes. The untraversed nodes are the first unreachable nodes. In addition, the access status of each node can be marked during the traversal. If a previously visited node on a traversed path is visited again, the access path corresponding to that previously visited node is the first conflicting path.

[0044] The determination of whether a second unreachable node and a second conflicting path exist in a directed acyclic graph can be described as follows: Select the starting point of the directed acyclic graph, and then use DFS or BFS to traverse the entire directed acyclic graph, recording all reachable nodes. The nodes that have not been traversed are the second unreachable nodes. In addition, during the traversal of the nodes of the entire directed acyclic graph, the access status of each node can be marked. If a previously visited node on a traversed path is visited again, then the access path corresponding to the previously visited node is the second conflicting path.

[0045] The first semantic verification result can be used to indicate whether there is a first unreachable node and a first conflicting path in the syntax tree, and the second semantic verification result can be used to indicate whether there is a second unreachable node and a second conflicting path in the directed acyclic graph. For example, the first semantic verification result can be used to indicate that there is no first unreachable node and a first conflicting path in the syntax tree, and the second semantic verification result can be used to indicate that there is no second unreachable node and a second conflicting path in the directed acyclic graph.

[0046] The process of validating the target code according to language writing rules, resulting in a syntax check, can be understood as follows: The format, keywords, symbols, and structure of the target code are checked against preset language writing rules to determine whether the target code conforms to these rules. If all aspects of the target code conform to the preset rules, the syntax check result indicates that the target code has passed syntax validation. If at least one aspect of the target code does not conform to the preset rules, the syntax check result indicates that the target code has failed syntax validation. These preset language writing rules are pre-defined rules; for example, if the language is C, then the preset language writing rules are those for the C language.

[0047] Optionally, the syntax tree can be called an abstract syntax tree (AST).

[0048] Among them, the two completely opposite rules can be understood as: the Allow rule and the Deny rule.

[0049] The following is a specific example to illustrate this. For example, two completely opposite rules can include a rule that allows address deletion and a rule that denies address deletion. Starting from the root node in the syntax tree, the entire syntax tree is traversed. During the traversal, the access status of each node can be marked. If a previously visited node on a traversed path is visited again, the access path corresponding to that previously visited node is the first conflict path. When it is determined that the first conflict path exists in the syntax tree, it means that there is code in the target code that matches both the rule that allows address deletion and the rule that denies address deletion. Obviously, the code has a logical problem, so the first semantic verification result of the target code can be determined as verification failure.

[0050] Step 105: If the first semantic verification result, the second semantic verification result, and the syntax verification result are all verified as passed, the target code is compiled to obtain the target instructions.

[0051] Specifically, when the first semantic verification result indicates that there is no first unreachable node and no first conflicting path in the syntax tree, and the second semantic verification result indicates that there is no second unreachable node and no second conflicting path in the directed acyclic graph, and the format, keywords, symbols, structure, etc. of the target code all conform to the requirements of the preset language writing rules, then the first semantic verification result, the first semantic verification result, and the syntax verification result are all considered to have passed the verification; when the first semantic verification result indicates that there is at least one of the first unreachable node and the first conflicting path in the syntax tree, then the first semantic verification result is considered to have failed the verification; when the second semantic verification result indicates that there is at least one of the second unreachable node and the second conflicting path in the directed acyclic graph, then the second semantic verification result is considered to have failed the verification; when at least one of the format, keywords, symbols, structure, etc. of the target code does not conform to the requirements of the preset language writing rules, then the syntax verification result is considered to have failed the verification.

[0052] The specific method of compiling the target code to obtain the target instructions is not limited here. Optionally, a compiler can be used to compile the target code to obtain the target instructions. For example, the compiler can process the target code through stages such as lexical analysis, syntax analysis, semantic analysis, intermediate code generation, intermediate code optimization, final code generation, and compilation and conversion of the final code into target instructions, thereby finally generating directly executable target instructions.

[0053] It should be noted that the target instruction can correspond to the prompt information. For example, the prompt information can be information used to achieve the target function, while the target instruction can be understood as an instruction used to achieve the target function. The specific content of the target function is not limited here. Optionally, the target function can be to achieve the external audit function, or alternatively, the target function can be to automatically generate financial statements.

[0054] It should be noted that, optionally, if the code verification result is that the verification fails, an alarm message indicating that the target code has been generated incorrectly can be output, and further compilation of the erroneous code can be prevented.

[0055] In this embodiment, through steps 101 to 105, a syntax tree and a directed acyclic graph (DAG) can be generated based on the target code output by the code generation model. Then, unreachable nodes and conflicting paths are traversed in the syntax tree and the DAG respectively to obtain the first semantic verification result and the second semantic verification result. In addition, the target code can be verified by language writing rules to obtain the syntax verification result. Only when the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification is the target code compiled to obtain the target instruction. In this way, only when the code generation model does not have port errors, fabricated IP addresses, or other such phenomena can the generated code ensure that the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification. This ensures that the target code output by the code generation model has high accuracy, and thus the final target instruction also has high accuracy.

[0056] Since different languages ​​can be used on first electronic devices with different architectures, when generating multiple operation instructions for first electronic devices with different architectures in related technologies, operators usually need to master the syntax of different languages, which places high demands on operators. To solve the above problems, the following implementation method is proposed:

[0057] As an optional implementation, the target instructions are used to deploy on a first electronic device. Step 105, if the first semantic verification result, the second semantic verification result, and the syntax verification result are all passed, compile the target code to obtain the target instructions, including:

[0058] Obtain language parameter information of the first electronic device, wherein the language parameter information is used to represent the language type set on the first electronic device;

[0059] If the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification, the target code is compiled according to the language parameter information to obtain the target instruction, and the language type corresponding to the target instruction matches the language type represented by the language parameter information.

[0060] The process of compiling the target code based on the language parameter information to obtain the target instruction can be understood as follows: the target code can be processed through stages such as lexical analysis, syntax analysis, semantic analysis, language type analysis, intermediate code generation, intermediate code optimization, final code generation, and compilation and conversion of the final code into the target instruction, thereby ultimately generating the target instruction. The language type corresponding to the target instruction matches the language type represented by the language parameter information. This matching of the language type corresponding to the target instruction to the language type represented by the language parameter information can be understood as the same language type corresponding to the target instruction as the same language type represented by the language parameter information.

[0061] In this embodiment, the language parameter information of the first electronic device can be directly obtained, and then the target code can be directly compiled according to the language parameter information to obtain the target instruction. The language type corresponding to the target instruction matches the language type represented by the language parameter information. In this way, the matching degree between the language type of the generated target instruction and the language type set on the corresponding first electronic device can be improved, so that when the target instruction is deployed on the first electronic device, there is no need to convert the language again, thereby improving the deployment efficiency of the target instruction on the first electronic device.

[0062] Optionally, the number of the aforementioned target instructions and the number of first electronic devices can both be at least two. Each target instruction can correspond one-to-one with a first electronic device, and the setting languages ​​of any two of the at least two first electronic devices can be different. In this way, the language of the corresponding target instruction can be flexibly determined according to the setting language of the first electronic device to which the target instruction is applied.

[0063] It should be noted that the language of the target code is not limited here. Optionally, the language of the target code can be called a Domain Specific Language (DSL), and the specific language of the target code can be Structured Query Language (SQL), etc. In this way, the above-mentioned DSL can be understood as a unified intermediate language that can shield underlying differences and has logical expression capabilities, thereby covering different primary electronic devices.

[0064] As another optional implementation, step 102, inputting the prompt information into the code generation model to obtain the target code output by the code generation model, includes:

[0065] The target variable symbol corresponding to the prompt information in the preset symbol table is determined, and the phrases included in the prompt information correspond one-to-one with the variable symbols included in the preset symbol table;

[0066] The target variable symbols are arranged according to a preset template to obtain the target input information;

[0067] The target input information is input into the code generation model to obtain the target code output by the code generation model.

[0068] For example, the prompt message can be text. By segmenting the text, multiple word groups can be obtained. A preset symbol table can store multiple variable symbols, each corresponding one-to-one with a word group. It should be noted that the correspondence between variable symbols and word groups can be pre-constructed and stored in the preset symbol table. Thus, once multiple word groups are identified in the text, the variable symbols corresponding to each word group can be determined based on the aforementioned correspondence, thereby obtaining the target variable symbol for the entire prompt message. In other words, the target variable symbol can be understood as the set of the aforementioned multiple variable symbols.

[0069] For example, when the phrase is A, the corresponding variable symbol can be A; when the phrase is B, the corresponding variable symbol can be B.

[0070] Optionally, the preset symbol table can be stored in the Configuration Management Database (CMDB), and the target variable symbol can be understood as a variable that the code generation model can directly reference when generating target code. This can improve the efficiency of the code generation model in generating target code.

[0071] The code generation model can be based on a retrieval-augmented generation (RAG) architecture, which can make the target code generated by the code generation model more accurate.

[0072] The aforementioned preset template can be understood as the template corresponding to the input information of the code generation model. When the target variable is arranged according to the preset template, the target input information is obtained, that is, the target input information is more in line with the requirements of the input information of the code generation model.

[0073] In this embodiment, the target variable symbols are arranged according to a preset template to obtain target input information. Compared with the target variable symbols, the target input information is more in line with the input information requirements of the code generation model. When the target input information is input into the code generation model, the recognition accuracy of the target input information of the code generation model is higher, thereby making the accuracy of the target code output by the code generation model also higher, that is, enhancing the accuracy of the target code generation result.

[0074] It should be noted that, in the embodiments of this application, when the user inputs the above-mentioned prompt information, the prompt information input by the user can be converted into a target variable symbol, and the target input information can be obtained based on the target variable symbol. After the target input information is input into the code generation model, the target code output by the code generation model can be obtained. Finally, the target instruction can be generated based on the target code. In this way, the user only needs to input the prompt information according to their own needs, without having to understand the requirements of the input information of the code generation model and the language requirements of different first electronic devices, and can finally generate the target instruction, which reduces the requirements for the user and improves the user experience.

[0075] It should be noted that, since the configuration information of the first electronic device in related technologies is often based on dispersed underlying rules, it is difficult to detect changes in the configuration information of the first electronic device. To solve this technical problem, the following implementation method is proposed:

[0076] As an optional implementation, the target instructions are used to deploy on a first electronic device, and the target code is also stored in a preset database. The method further includes:

[0077] Obtain target configuration information from the first electronic device, wherein the target configuration information is determined according to the target instruction;

[0078] The target configuration information is decompiled to obtain decompiled code;

[0079] If it is determined that the matching degree between the target code stored in the preset database and the decompiled code is less than the preset matching degree, the target configuration information is marked as abnormal configuration information.

[0080] Optionally, the target configuration information is determined based on the target instruction. This can be understood as: deploying the target instruction to the first electronic device, causing the first electronic device to execute the target instruction, thereby obtaining the target configuration information. That is, the target configuration information is the result information generated by the first electronic device after executing the target instruction, corresponding to the target instruction. For example, when the target instruction is an instruction to implement the external audit function, the target configuration information may include information such as the audit report generated after implementing the external audit function.

[0081] Alternatively, the target configuration information is determined based on the target instructions. This can be understood as: deploying the target instructions onto the first electronic device, and the target instructions may carry the aforementioned target configuration information. That is, the aforementioned target configuration information can be understood as information generated along with the target instructions during the compilation and processing of the target code. For example, the aforementioned target configuration information may be the expected result information corresponding to the execution of the target instructions.

[0082] When the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification, the target code can be stored in the preset database. At the same time, the target code can be compiled to obtain the target instructions, which are then deployed on the first electronic device. After obtaining the target configuration information on the first electronic device, the target configuration information can be decompiled to obtain the decompiled code. If the matching degree between the target code and the decompiled code is less than the preset matching degree, it indicates that the target configuration information has changed, and the target configuration information can be marked as abnormal configuration information.

[0083] In this embodiment, the target configuration information on the first electronic device can be decompiled to obtain decompiled code. Then, the decompiled code is matched with the target code in the preset database. When it is determined that the matching degree between the target code stored in the preset database and the decompiled code is less than the preset matching degree, it indicates that the target configuration information has changed, resulting in an anomaly. Therefore, the target configuration information can be marked as abnormal configuration information, thereby enhancing the accuracy of screening abnormal configuration information.

[0084] In addition, compared with the target configuration information, the decompiled code is more readable, allowing staff to accurately understand the specific status of the configuration information of the entire first electronic device simply by reading the decompiled code, thus enhancing the staff's reading experience. At the same time, by calculating the matching degree between the decompiled code and the target code, when it is determined that the matching degree between the target code and the decompiled code is less than the preset matching degree, the target configuration information is marked as abnormal configuration information. In this way, the accuracy of determining the target configuration information as abnormal configuration information is relatively high.

[0085] It should be noted that the embodiments of this application can be applied to a second electronic device, that is, the execution subject of each step in the embodiments of this application can be a second electronic device, and the second electronic device and the first electronic device mentioned above can be the same device, or the second electronic device and the first electronic device mentioned above can be different devices, and no specific limitation is made here.

[0086] See Figure 2 , Figure 2This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. To enhance differentiation, this electronic device is referred to as a second electronic device in this embodiment of the application. Figure 2 As shown, the second electronic device includes a natural language interaction interface, a context enhancement and symbol parser, an LLM code generator, an H-ACL DSL core engine, a multi-cloud compiler and driver layer, and a policy ingestion and decompiler.

[0087] The natural language interaction interface can be used to receive users' natural language instructions (i.e. prompts) and provide feedback on the execution results or audit reports.

[0088] The context enhancement and symbol parser can be used to connect to the Configuration Management Database (CMDB) and maintain the "symbol table" (i.e., the preset symbol table). The context enhancement and symbol parser can also be used to parse natural language entities (i.e. prompt information) into variables that can be referenced by the DSL (i.e., target variable symbols) and inject them into the LLM prompt (i.e., input the target input information into the code generation model).

[0089] The LLM code generator is based on the Retrieval-augmented Generation (RAG) architecture. The LLM code generator receives a Prompt and outputs code snippets (i.e., target code) that conform to the H-ACL DSL syntax.

[0090] The H-ACL DSL core engine includes:

[0091] A syntax parser can be used to check the correctness of the DSL code format (i.e., to perform syntax verification and obtain the syntax verification result).

[0092] Semantic validators can be used to perform static analysis and check for logical conflicts and the validity of variable references (i.e., perform semantic verification and obtain the first semantic verification result and the second semantic verification result respectively).

[0093] A state repository can be used to store all verified DSL codes.

[0094] The multi-cloud compiler and driver layer include:

[0095] The compiler front-end can be used to convert a DSL into an abstract syntax tree or a directed acyclic graph.

[0096] The compiler backend, including AWS Driver, Kubernetes Driver, Firewall Driver, etc., can be used to traverse the abstract syntax tree or directed acyclic graph and generate application programming interface (API) calls or configuration files for specific platforms.

[0097] It should be noted that the aforementioned Driver can be added or removed according to specific usage scenarios, without changing the overall structure of the H-ACL DSL core engine, thereby further improving the convenience of using the second electronic device.

[0098] Among them, the strategy ingestion and decompiler can be used to pull the actual running configuration (i.e., target configuration information) from the heterogeneous cloud platform (i.e., the first electronic device) and "decompile" it back to H-ACL DSL format (i.e., decompiled code) for comparative analysis.

[0099] As an optional implementation, after marking the target configuration information as abnormal configuration information when the matching degree between the target code stored in the preset database and the decompiled code is less than a preset matching degree, the method further includes:

[0100] A risk assessment was performed on the decompiled code, and the risk assessment results were obtained.

[0101] If the risk assessment result is the preset assessment result, an alarm message is output, which indicates that the target configuration information is at risk.

[0102] The method of outputting alarm information is not limited here. Optionally, the method of outputting alarm information may include at least one of the following: displaying alarm information or sending alarm information to electronic devices used by staff.

[0103] The specific method for obtaining the risk assessment result by performing a risk assessment on the decompiled code is not limited here. Optionally, a risk score can be generated based on the content in the decompiled code that does not match the target code, and the risk score can be determined as the risk assessment result. Correspondingly, the preset assessment result is also a preset risk score. When the risk score generated based on the content in the decompiled code that does not match the target code is the preset risk score, an alarm message can be output.

[0104] In this embodiment of the application, a risk assessment can also be performed on the decompiled code. When the risk assessment result is the preset assessment result, it indicates that the target configuration information corresponding to the decompiled code is at risk, and an alarm message can be output, thereby enhancing the alarm effect of the aforementioned target configuration information that is at risk.

[0105] As an optional implementation, after outputting alarm information when the risk assessment result is a preset assessment result, the method further includes:

[0106] Obtain preset configuration information corresponding to the target code; the preset configuration information poses no risk.

[0107] Replace the target configuration information on the first electronic device with the preset configuration information.

[0108] The aforementioned preset configuration information can be understood as information determined according to the target instruction and without risk. For example, the aforementioned preset configuration information can be the result information generated by the first electronic device after the first electronic device executes the target instruction, corresponding to the target instruction, and the aforementioned preset configuration information does not pose a risk.

[0109] In this embodiment of the application, the target configuration information on the first electronic device can be replaced with preset configuration information. Since the preset configuration information does not pose a risk, it can be ensured that the configuration information on the first electronic device does not pose a risk, thereby enhancing the security of the first electronic device.

[0110] To enhance the illustration of the above embodiments, two specific application scenarios will be used to illustrate the embodiments in detail below.

[0111] See Figure 3 , Figure 3 The application scenario shown is for an external audit team to access "Financial Statement Service (HTTPS)" deployed on AWS overseas, which may include the following steps:

[0112] Step 301: Intent reception and context parsing;

[0113] The prompt message entered by the user may include: "Allow the external audit team to access AWS Financial Reporting Service, HTTPS only, valid for 24 hours."

[0114] Specifically, a symbol resolver (which can be understood as being applied in the second electronic device provided in this application embodiment) retrieves the target variable symbol corresponding to the prompt information from a preset symbol table stored in the CMDB:

[0115] The “external audit team” can be mapped to the variable $audit_firm_ips (CIDR: 203.0.113.0 / 24).

[0116] “Financial Statement Service” can be mapped to the variable $finance_web_aws (Tag: Project=Finance).

[0117] Step 302: LLM generates DSL code;

[0118] Wherein, LLM can be understood as the code generation model in the above embodiments, and DSL code can be understood as the target code in the above embodiments;

[0119] Step 303, DSL static verification;

[0120] Static DSL validation can include semantic validation and syntax validation.

[0121] Syntax verification may include: determining whether the keywords (such as policy, action, source, etc.) of the target code are spelled correctly, and determining whether the structure of the target code conforms to the schema definition.

[0122] The semantic checks may include: verifying whether the variables $audit_firm_ips and $finance_web_aws actually exist in the preset symbol table, and checking whether there is a higher priority DENY policy that would mask this rule (Shadowing Detection) (i.e., checking whether there is code in the target code that matches both completely opposite rules).

[0123] It should be noted that once the target code passes verification, it can be stored in a state repository (Git), which can be understood as the preset database in the above embodiments.

[0124] Step 304, Compilation and Distribution:

[0125] The multi-cloud compiler (which can be understood as being applied in the second electronic device provided in the embodiments of this application) reads the DSL (i.e., the target code) and identifies that the destination of the target code belongs to AWS resources.

[0126] This involves calling the AWS Driver layer to compile the DSL into AWS EC2 Application Programming Interface (API) call parameters (i.e., compiling the target code to obtain the target instructions):

[0127] The AWS EC2 API mentioned above may include at least one of the following parameters:

[0128] SecurityGroupId: (Identifier (ID) parsed from the tag);

[0129] IpPermissions: Protocol=TCP;

[0130] FromPort=443;

[0131] IpRanges=[203.0.113.0 / 24].

[0132] Step 305, Execution Feedback:

[0133] The driver layer calls the AWS API to complete the configuration (i.e., determine the target configuration information according to the target instructions) and returns the operation log.

[0134] See Figure 4 , Figure 4 The application scenario shown is to detect whether there are unauthorized open ports in a cloud environment (i.e., the first electronic device) (for example, someone manually opened the SSH port in the console). Specifically, it may include the following steps:

[0135] Step 401, Full Data Ingestion and Decompilation:

[0136] The ingestion module scans all Access Control Lists (ACLs) on the current network (i.e., obtains the target configuration information on the first electronic device). It discovers a rule in an AWS security group: Ingress: 0.0.0.0 / 0, Port: 22, Action: Allow.

[0137] The decompiler converts the target configuration information into "Actual State" in DSL format based on the rule characteristics (that is, it decompiles the target configuration information to obtain decompiled code).

[0138] Step 402, DSL-based Difference (Diff) Analysis:

[0139] Specifically, the "actual state DSL" (i.e., decompiled code) is compared with the "expected state DSL" (i.e., target code) in the repository (i.e., the preset database). It is found that the policy (i.e., decompiled code) does not exist in the "expected state" (i.e., the matching degree between the target code and the decompiled code is less than the preset matching degree). Therefore, the ACL corresponding to the DSL can be marked as "policy drift (i.e., the target configuration information is marked as abnormal configuration information)".

[0140] Step 403, LLM Intelligent Audit Report:

[0141] Among these measures, the DSL code for the differing portion can be sent to the LLM for risk assessment.

[0142] The LLM outputs a natural language alert (i.e., an alert message): "WARNING: Unauthorized changes detected. Rule detected-rule-id-99 allows access to SSH port (22) of instance X from the entire network (0.0.0.0 / 0). This is a high-risk configuration and it is recommended to roll back immediately."

[0143] Step 404, Closed-loop repair:

[0144] After confirmation by staff, the system performs a "DSL rollback" operation, whereby the compiler re-pushes the correct configuration, overwriting the violation rule (that is, replacing the target configuration information on the first electronic device with the preset configuration information).

[0145] See Figure 5 , Figure 5 This is a structural diagram of the instruction generation apparatus provided in the embodiments of this application, such as... Figure 5 As shown, the instruction generation device 500 includes:

[0146] Information acquisition module 501 is used to acquire prompt information;

[0147] The code output module 502 is used to input the prompt information into the code generation model to obtain the target code output by the code generation model;

[0148] Generation module 503 is used to generate a syntax tree and a directed acyclic graph based on the target code;

[0149] The verification module 504 is used to traverse the syntax tree to check whether there is a first unreachable node and a first conflicting path to obtain a first semantic verification result, traverse the directed acyclic graph to check whether there is a second unreachable node and a second conflicting path to obtain a second semantic verification result, and perform language writing rule verification on the target code to obtain a syntax verification result.

[0150] The compilation processing module 505 is used to compile the target code to obtain target instructions when the first semantic verification result, the second semantic verification result, and the syntax verification result are all verified to be passed.

[0151] As an optional implementation, the target instructions are used to deploy on the first electronic device, and the compilation processing module 505 includes:

[0152] The parameter information acquisition submodule is used to acquire the language parameter information of the first electronic device, wherein the language parameter information is used to represent the language type set on the first electronic device.

[0153] The compilation processing submodule is used to compile the target code according to the language parameter information when the first semantic verification result, the second semantic verification result, and the syntax verification result are all verified as passed, so as to obtain the target instruction. The language type corresponding to the target instruction matches the language type represented by the language parameter information.

[0154] As an optional implementation, the target instruction is used to deploy on the first electronic device, and the target code is also stored in a preset database. The instruction generation device 500 further includes:

[0155] The first acquisition module is used to acquire target configuration information on the first electronic device, wherein the target configuration information is determined according to the target instruction;

[0156] The decompilation processing module is used to decompile the target configuration information to obtain decompiled code;

[0157] The marking module is used to mark the target configuration information as abnormal configuration information when it is determined that the matching degree between the target code stored in the preset database and the decompiled code is less than a preset matching degree.

[0158] As an optional implementation, the instruction generation apparatus 500 further includes:

[0159] The risk assessment module is used to assess the risks of the decompiled code and obtain the risk assessment results.

[0160] The output module is used to output alarm information when the risk assessment result is a preset assessment result, and the alarm information is used to indicate that the target configuration information is at risk.

[0161] As an optional implementation, the instruction generation apparatus 500 further includes:

[0162] The second acquisition module acquires preset configuration information corresponding to the target code, and the preset configuration information is risk-free.

[0163] The replacement module is used to replace the target configuration information on the first electronic device with the preset configuration information.

[0164] As an optional implementation, the code output module 502 includes:

[0165] The variable symbol determination submodule is used to determine the target variable symbol corresponding to the prompt information in a preset symbol table, wherein the phrases included in the prompt information correspond one-to-one with the variable symbols included in the preset symbol table;

[0166] The arrangement submodule is used to arrange the target variable symbols according to a preset template to obtain the target input information;

[0167] The code output submodule is used to input the target input information into the code generation model and obtain the target code output by the code generation model.

[0168] As an optional implementation, both the first unreachable node and the second unreachable node are used to indicate that there is redundant code in the target code, and both the first conflict path and the second conflict path are used to indicate that there is code in the target code that matches both completely opposite rules.

[0169] The instruction generation device 500 can implement the embodiments of this application. Figure 1 The various processes in the method embodiments, and the ways to achieve the same beneficial effects, will not be repeated here to avoid repetition.

[0170] This application also provides an electronic device. Please refer to [link to relevant documentation]. Figure 6 The electronic device may include a processor 601, a memory 602, and a program 6021 stored in the memory 602 and executable on the processor 601. When the electronic device is a second electronic device, the program 6021, when executed by the processor 601, can achieve... Figure 1 Any steps in the corresponding method embodiments and the achievement of the same beneficial effects will not be repeated here.

[0171] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by hardware related to program instructions, and the program can be stored in a readable medium. This application also provides a readable storage medium storing a computer program, which, when executed by a processor, can implement the above-described methods. Figure 1 Any step in the corresponding method embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0172] The storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0173] This application also provides a computer program product, including computer instructions, which, when executed by a processor, can perform the above-described functions. Figure 1 Any step in the corresponding method embodiment can achieve the same technical effect, and will not be repeated here to avoid repetition.

[0174] The above description represents the preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for generating instructions, characterized in that, include: Get the prompt information; The prompt information is input into the code generation model to obtain the target code output by the code generation model; Generate a syntax tree and a directed acyclic graph based on the target code; The syntax tree is traversed to check for a first unreachable node and a first conflicting path to obtain a first semantic verification result. The directed acyclic graph is traversed to check for a second unreachable node and a second conflicting path to obtain a second semantic verification result. The target code is then subjected to language writing rule verification to obtain a syntax verification result. If the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification, the target code is compiled to obtain the target instruction.

2. The method of claim 1, wherein, The target instruction is used to deploy on a first electronic device. When the first semantic verification result, the second semantic verification result, and the syntax verification result are all passed, the target code is compiled to obtain the target instruction, including: Obtain language parameter information of the first electronic device, wherein the language parameter information is used to represent the language type set on the first electronic device; If the first semantic verification result, the second semantic verification result, and the syntax verification result all pass the verification, the target code is compiled according to the language parameter information to obtain the target instruction, and the language type corresponding to the target instruction matches the language type represented by the language parameter information.

3. The method of claim 1, wherein, The target instructions are used to deploy on a first electronic device, and the target code is also stored in a preset database. The method further includes: Obtain target configuration information from the first electronic device, wherein the target configuration information is determined according to the target instruction; The target configuration information is decompiled to obtain decompiled code; If it is determined that the matching degree between the target code stored in the preset database and the decompiled code is less than the preset matching degree, the target configuration information is marked as abnormal configuration information.

4. The method of claim 3, wherein, After marking the target configuration information as abnormal configuration information when the matching degree between the target code stored in the preset database and the decompiled code is less than a preset matching degree, the method further includes: A risk assessment was performed on the decompiled code, and the risk assessment results were obtained. If the risk assessment result is the preset assessment result, an alarm message is output, which indicates that the target configuration information is at risk.

5. The method of claim 4, wherein, After outputting an alarm message when the risk assessment result is a preset assessment result, the method further includes: Obtain preset configuration information corresponding to the target code; the preset configuration information poses no risk. Replace the target configuration information on the first electronic device with the preset configuration information.

6. The method according to any one of claims 1 to 5, characterized in that, The step of inputting the prompt information into the code generation model to obtain the target code output by the code generation model includes: The target variable symbol corresponding to the prompt information in the preset symbol table is determined, and the phrases included in the prompt information correspond one-to-one with the variable symbols included in the preset symbol table; The target variable symbols are arranged according to a preset template to obtain the target input information; The target input information is input into the code generation model to obtain the target code output by the code generation model.

7. The method according to any one of claims 1 to 5, characterized in that, Both the first unreachable node and the second unreachable node are used to indicate that there is redundant code in the target code, and both the first conflict path and the second conflict path are used to indicate that there is code in the target code that matches both completely opposite rules.

8. An instruction generating apparatus characterized by comprising: include: The information acquisition module is used to acquire prompt information; The code output module is used to input the prompt information into the code generation model and obtain the target code output by the code generation model. The generation module is used to generate a syntax tree and a directed acyclic graph based on the target code; The verification module is used to traverse the syntax tree to check for the existence of a first unreachable node and a first conflicting path, and obtain a first semantic verification result; to traverse the directed acyclic graph to check for the existence of a second unreachable node and a second conflicting path, and obtain a second semantic verification result; and to perform language writing rule verification on the target code to obtain a syntax verification result. The compilation processing module is used to compile the target code to obtain target instructions when the first semantic verification result, the second semantic verification result, and the syntax verification result are all verified to be passed.

9. An electronic device comprising: A memory, a processor, and a program stored in the memory and executable on the processor; characterized in that the processor is configured to read the program from the memory to implement the steps of the instruction generation method as described in any one of claims 1 to 7.

10. A readable storage medium for storing a program, characterized in that, When the program is executed by the processor, it implements the steps in the instruction generation method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps in the instruction generation method as described in any one of claims 1 to 7.

Images