A method and system for constraint-driven exploit code generation

Abstract

The application belongs to the technical field of network security, and discloses a constraint-driven vulnerability exploitation code generation method and system, which is applied to a power office network and comprises the following steps: a constraint representation model containing an environment constraint dimension is constructed, and a software technology stack constraint is formalized into a structured parameter; the constraint representation model is dynamically coupled with a vulnerability knowledge graph to generate a structured constraint set containing executable parameters; a search enhancement prompt template is generated based on the structured constraint set, and the search enhancement prompt template embeds the structured constraint set as a conditional constraint; the search enhancement prompt template is input into a generation model to generate a vulnerability exploitation code matched with a target environment technology stack, and the effectiveness of the vulnerability exploitation code is verified in a simulation environment. Through explicit modeling of environment constraints and reasoning and completion by using a knowledge graph, the application realizes accurate matching of the vulnerability exploitation code and the target environment technology stack, and improves the success rate, adaptability and execution success rate of code generation.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a constraint-driven vulnerability exploitation code generation method and system. Background Technology

[0002] With the rapid development of information technology, the software architecture of various business systems is becoming increasingly complex, often involving combinations of multiple databases, middleware, and authentication methods. In network security testing and vulnerability discovery, the automated generation of exploit code is a crucial step in assessing system security. Current technologies typically use general-purpose language models to directly generate exploit code. However, due to a lack of in-depth understanding and adaptation to the target environment's software technology stack (such as specific database types, middleware versions, authentication protocols, etc.), the generated code is often incompatible with the target environment, leading to execution failures or inaccurate vulnerability triggering. Furthermore, while knowledge graph-based vulnerability assessment methods exist, they primarily focus on device constraints at the industrial control protocol level, lacking explicit modeling and reasoning mechanisms for application-layer software technology stack constraints, making accurate code generation difficult. Therefore, a method is urgently needed that can explicitly model environmental constraints and generate adaptive exploit code based on these constraints. Summary of the Invention

[0003] To address the issues of mismatch and poor adaptability between generated exploit code and target environment technology stack in existing technologies, this invention provides a constraint-driven exploit code generation method and system. By constructing a constraint representation model that includes environmental constraint dimensions and using knowledge graphs for dynamic coupling and reasoning, the invention achieves accurate matching between exploit code and target environment technology stack.

[0004] This invention provides the following technical solution: The primary objective of this invention is to provide a constraint-driven vulnerability exploit code generation method, which is applied to a power office network and includes: Construct a constraint representation model that includes vulnerability characteristics, attack patterns, and environmental constraints, whereby the constraints of the software technology stack are formalized into structured parameters. The constraint representation model is dynamically coupled with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters; A search enhancement suggestion template is generated based on the structured constraint set, wherein the search enhancement suggestion template embeds the structured constraint set as a condition constraint; The enhanced search prompt template is input into the generation model to generate exploit code that matches the target environment's technology stack, and the effectiveness of the exploit code is verified in a simulation environment.

[0005] Specifically, the constraint representation model adopts a "vulnerability feature - attack mode - environmental constraint" triple structure. The vulnerability feature dimension includes CWE classification and a Data Flow Graph (DFG) to identify the vulnerability type and taint propagation path, defining the macro-level vulnerability type. The attack mode dimension includes attack strategies specific to the target scenario, mainly attack paths and methods. Environmental constraints refer to the specific vulnerability's dependent environment, runtime libraries, and other characteristics. The environmental constraint dimension uses explicit modeling, formalizing software technology stack constraints into executable structured parameters. These three dimensions are interconnected and together constitute the preconditions for constraint-driven code generation.

[0006] By formalizing software technology stack constraints into structured parameters and dynamically coupling them using knowledge graphs, the generated exploit code can meet the specific constraints of the target environment, thus significantly improving code adaptability and execution success rate. During code generation, structured constraints are embedded as conditions by retrieving enhanced hint templates, guiding the generation model to produce code that meets the constraints, thus realizing the implementation of constraint-driven code generation.

[0007] As a further improvement of the present invention, the structured parameters include constraint variables, value range, dependencies, and verification rules.

[0008] As a further improvement of the present invention, the constraint variables include business system type, software architecture, database type, middleware type, authentication method, and data interaction specifications.

[0009] As a further improvement of the present invention, the dynamic coupling includes: performing entity linking and attribute completion on the environmental constraint dimension in the constraint representation model; A consistency check is performed on the environmental constraint dimensions after attribute completion to generate the structured constraint set.

[0010] The problem of missing environmental information was solved by entity linking and attribute completion, and the logical compatibility between constraint parameters was ensured by consistency checks, thus guaranteeing the effectiveness of the structured constraint set.

[0011] As a further improvement of the present invention, the attribute completion includes: When constraint information in the environmental constraint dimension is missing, the missing constraint parameters are derived and filled in based on the known constraints and variable dependencies in the vulnerability knowledge graph. When multiple candidate constraint parameters exist, the optimal parameter combination is selected by sorting them based on the utilization success rate and constraint compatibility score in historical data.

[0012] As a further improvement of the present invention, in the process of inputting the search enhancement prompt template into the generation model to obtain the vulnerability exploitation code, the compatibility between the generated content and the structured constraint set is verified in real time through a constraint propagation mechanism.

[0013] As a further improvement of the present invention, verifying the effectiveness of the exploit code in a simulation environment includes: The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploitation success rate and the validity verification records of constraint parameters; When verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

[0014] Simulation verification ensured the practical usability of the generated code, and a feedback mechanism enabled dynamic updating of the knowledge graph and closed-loop optimization of constraint parameters, further improving the system's adaptability and code generation success rate.

[0015] A second objective of this invention is to provide a constraint-driven exploit code generation system for the aforementioned method, comprising: The constraint modeling module is used to construct a constraint representation model that includes environmental constraint dimensions, wherein the environmental constraint dimensions formalize the software technology stack constraints into structured parameters, and the structured parameters include constraint variables, value ranges, dependencies, and verification rules. The constraint coupling module is used to dynamically couple the constraint representation model with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters. The code generation module is used to generate a search enhancement prompt template based on the structured constraint set, input the search enhancement prompt template into the generation model, and generate vulnerability exploitation code that matches the technology stack of the target environment; wherein the search enhancement prompt template embeds the structured constraint set as a condition constraint. The simulation verification module is used to verify the effectiveness of the exploit code in a simulation environment.

[0016] As a further improvement of the present invention, the simulation verification module is configured as follows: The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploitation success rate and the validity verification records of constraint parameters; When verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: By explicitly modeling environment constraints and using knowledge graphs for reasoning completion, precise matching between vulnerability exploit code and the target environment's technology stack was achieved, improving the success rate, adaptability, and execution success rate of code generation.

[0018] By constructing a constraint representation model that includes environmental constraints, the constraints of the software technology stack are transformed into structured parameters, solving the problem that the implicit expression of environmental parameters in existing technologies is difficult for machines to understand and reason about.

[0019] By dynamically coupling the constraint representation model with the vulnerability knowledge graph, and leveraging the entity linking and attribute completion capabilities of the knowledge graph, the missing environmental constraint information is automatically derived and completed, thus solving the problem of code generation failure caused by incomplete target environment information.

[0020] The template for enhanced search prompts is generated based on a structured constraint set, and real-time verification is performed through a constraint propagation mechanism. This ensures that the generated exploit code strictly matches the target environment's technology stack in terms of programming language, framework version, and database type, significantly improving the success rate and usability of automated exploit code generation. Attached Figure Description

[0021] Figure 1 A flowchart of a constraint-driven vulnerability exploitation code generation method provided by the present invention; Figure 2 This is a schematic diagram of the structure of the constraint representation model; Figure 3 A flowchart for constructing a vulnerability knowledge graph; Figure 4 A schematic diagram illustrating the dynamic coupling process between the constraint representation model and the vulnerability knowledge graph; Figure 5 Generate a flowchart for the prompt template. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] The present invention will now be described in further detail with reference to the accompanying drawings: like Figure 1As shown, this embodiment provides a constraint-driven method for generating exploit code. This method aims to address the problem of poor adaptability in existing exploit code generation due to a lack of in-depth understanding of the target environment's software technology stack. By constructing a constraint representation model that includes environmental constraint dimensions and using a knowledge graph for dynamic coupling, precise matching between the exploit code and the target environment's technology stack is achieved.

[0024] Specifically, the following steps are included: S1, Construct a constraint representation model that includes environmental constraint dimensions, where the environmental constraint dimensions formalize the software technology stack constraints into structured parameters.

[0025] In traditional exploit code generation, environmental constraints are typically presented as unstructured text descriptions or implicit configuration files, making them difficult for machines to directly understand and use to generate code. This embodiment constructs a constraint representation model, transforming implicit software technology stack constraints into explicit, machine-understandable structured parameters. These structured parameters define the logical relationships between environmental components, laying the data foundation for subsequent automated reasoning and code generation. The structured parameters can define the database type used by the target system, middleware versions, and their compatibility dependencies, enabling the generation model to explicitly know that the generated SQL injection code needs to adapt to specific database syntax.

[0026] The following details the construction process of the constraint representation model for power office business systems. Power office business systems include marketing systems, dispatch management systems, and power trading platforms or production management systems. These systems adopt mainstream Web technology architectures such as Java EE and Spring Boot, and use databases such as Oracle, MySQL, DM, and Kingbase, facing Web application layer security threats such as SQL injection, unauthorized access, and parameter tampering. Figure 2 As shown, for power systems, the explicit representation model of power constraints adopts a triplet structure of "vulnerability features - attack mode - environmental constraints".

[0027] The vulnerability signature dimension includes CWE classification and DFG (Data Flow Graph). CWE classification identifies the type of vulnerability, providing a standardized descriptive framework for vulnerability signatures. DFG records the taint propagation path from taint sources (such as HTTP request parameters, form inputs, and API interface parameters) to dangerous operation points (SQL execution functions, command execution functions, and file operation functions), and marks the variable version sequence, function call stack, and path constraints along the path. The variable version sequence refers to the sequence of version numbers generated after the same variable is reassigned at different program points. Ctain sources include HTTP request parameters, form inputs, and API interface parameters; dangerous operation points include SQL execution functions, command execution functions, and file operation functions. The attack pattern dimension includes attack strategies targeting power office business scenarios, such as tampering with electricity billing parameters, exceeding user privileges, bypassing business processes, and unauthorized batch data export.

[0028] The environmental constraint dimension employs an explicit modeling approach, formalizing software technology stack constraints into executable, structured parameters. Specifically, these structured parameters include constraint variables, value ranges, dependencies, and validation rules. These four elements together constitute a formal logical framework, enabling the originally vague and unstructured description of the software technology stack environment to be transformed into a computer-readable and reasonable data structure.

[0029] Constraint variables are the basic units of environmental constraint modeling, used to characterize key environmental elements in the software technology stack. In this embodiment, constraint variables include business system type, software architecture, database type, middleware type, authentication method, and data interaction specification. In practical applications, constraint variables can be extended according to the characteristics of the target system. The business system type variable defines the business attributes of the target system; different business types often correspond to specific business logic vulnerability patterns. The software architecture variable describes the technical skeleton of the system, such as B / S architecture, C / S architecture, or microservice architecture, which determines the trigger entry form of the exploit code. The database type and middleware type are directly related to the syntax structure of the exploit code; for example, different databases have significantly different SQL dialects. The authentication method variable defines the authentication mechanism required to access the target system, such as form-based authentication, token-based authentication, or integration of a third-party unified identity authentication. The data interaction specification variable limits the data format of the API interface, such as XML, JSON, or Protobuf.

[0030] The value range defines the set of allowed values ​​for each constraint variable, providing boundary conditions for constraint inference. For example, for the constraint variable "database type," its value range can be defined as {Oracle, MySQL, PostgreSQL, DM, Kingbase, Shenzhou General}, etc. By defining the value range, the system can exclude invalid parameter values ​​during subsequent inference, narrowing the search space. The value range setting supports not only enumerated types but also numerical ranges or string formats matched by regular expressions, to accommodate different types of constraint variables.

[0031] Dependencies are used to describe the logical relationships between different constraint variables. In real-world software systems, environmental parameters are often not isolated but rather strongly coupled. For example, authentication methods often depend on middleware versions; if the middleware version is an older version of WebLogic, it may only support older SSL protocol versions and not newer TLS protocols. Similarly, the format of database connection strings depends on the database type; the JDBC connection string formats for DM database and Oracle database are completely different. This embodiment explicitly defines these dependencies, enabling the system to automatically deduce the possible values ​​of other related variables after obtaining partial constraint information, thereby solving the problem of code generation failure caused by missing environmental information.

[0032] Validation rules define the logic for verifying the validity of constraint parameters, ensuring that input or derived parameters conform to technical specifications. Validation rules can include format validation, version number compatibility validation, port range validation, etc. For example, for database connection string variables, validation rules can be defined as regular expressions to verify whether the string contains valid IP addresses, port numbers, and instance names; for middleware version variables, validation rules can verify whether their version number is within the range of affected versions known to have vulnerabilities. By using validation rules, logically erroneous parameter combinations can be filtered out before code generation, improving the effectiveness of the generated structured constraint set. This modeling approach, which decomposes environmental constraints into variables, value ranges, dependencies, and validation rules, constructs a rigorous formal description system, providing a solid logical foundation for subsequent dynamic coupling and reasoning based on knowledge graphs.

[0033] S2, dynamically couple the constraint representation model with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters.

[0034] In practical applications, the constraint information of the target environment is often fragmented, potentially containing missing or inconsistent information. Generating code directly based on incomplete constraints can easily lead to execution failure. This embodiment introduces a vulnerability knowledge graph, utilizing the entity relationships and historical knowledge stored within it to dynamically couple the constraint representation model. Dynamic coupling can identify missing key parameters in the constraint representation model and deduce them based on known constraints and logical relationships in the knowledge graph. Simultaneously, it can perform consistency checks and corrections for conflicting constraint information. The final generated structured constraint set contains complete executable parameters, ensuring the accuracy of the input required for subsequent code generation.

[0035] For power office business systems, the following details the construction of vulnerability knowledge graphs and the specific process of dynamically coupling constraint representation models with vulnerability knowledge graphs.

[0036] like Figure 3 As shown, the vulnerability knowledge graph construction includes: the knowledge graph uses entities in the constraint representation model as nodes and semantic relationships between entities as edges, linking and storing software component information, historical vulnerability remediation records, and technical stack parameters in the business logic constraints and environmental constraints dimensions of the power office business system. Entities are extracted from power industry security reports, public vulnerability databases (such as CNVD and CNNVD), and internal security event records of power companies; entities include vulnerability entities, software component entities, business function entities, attack mode entities, and environmental constraint entities. Mapping relationships are established between entities, including the association between vulnerabilities and software components, vulnerabilities and business functions, attack modes and API interfaces, and the binding relationship between environmental constraints and technical stack parameters. The knowledge graph stores mapping indexes between historical vulnerability exploit code and technical stack parameters in the environmental constraint dimension, as well as validity verification records of constraint parameters.

[0037] like Figure 4 As shown, dynamic coupling includes: entity linking and attribute completion of the environmental constraint dimension in the constraint representation model; consistency verification of the attribute-completed environmental constraint dimension; and generation of the structured constraint set. Entity linking refers to establishing a mapping relationship between abstract constraint variables (such as "database type") in the constraint representation model and specific entity nodes (such as "DM database entity" and "Oracle database entity") in the knowledge graph. Through entity linking, the model can obtain detailed attributes associated with the entity from the knowledge graph, such as specific SQL syntax features, default ports, connection string formats, etc., thereby transforming the originally isolated variables into entity objects with rich semantic information. Attribute completion, based on entity linking, is the process of reasoning and filling in the missing or ambiguous parts of the constraint representation model using knowledge from the knowledge graph. Consistency verification is used to detect whether there are logical conflicts between the completed parameters, such as checking whether the middleware version supports the selected database connection method, ensuring that the final generated structured constraint set is logically self-consistent and executable.

[0038] Furthermore, attribute completion includes: when constraint information is missing in the environmental constraint dimension, deriving and completing the missing constraint parameters based on known constraints and variable dependencies in the vulnerability knowledge graph; when multiple candidate constraint parameters exist, ranking them based on exploit success rate and constraint compatibility score in historical data, and selecting the optimal parameter combination. These two scenarios cover the two most common challenges in practical applications: incomplete information and difficulty in selection.

[0039] When constraint information is missing in the environmental constraint dimension, this embodiment employs a dependency-based derivation logic. In a software technology stack, strong dependencies often exist between components; for example, a specific middleware version often integrates a certain authentication protocol by default. When the constraint representation model only identifies the middleware type but lacks the authentication method, the system traverses the edges associated with that middleware entity in the knowledge graph to find its default supported authentication protocol. For example, if the target system is known to use the Unified Identity Authentication System v3.0, the system can deduce its authentication protocol as OAuth 2.0 and support for the national cryptographic SM2 signature algorithm based on the "version-protocol" relationship stored in the knowledge graph. This derivation mechanism allows the system to automatically complete key environmental parameters without manual intervention, significantly improving the level of automation.

[0040] When multiple candidate constraint parameters exist, this embodiment employs an optimization logic based on historical data. When multiple paths exist in the knowledge graph to complete missing parameters—for example, a business system might support either MySQL or Oracle databases—the system does not select randomly but retrieves historical vulnerability exploitation records. The system calculates the exploit success rate and constraint compatibility score for each candidate parameter combination in historical attacks. The exploit success rate reflects the probability of successfully triggering a vulnerability in a real-world environment, while the compatibility score reflects the degree of matching between the parameter combination and known environmental constraints. The system ranks the candidate parameter combinations by weighting these two metrics and selects the combination with the highest score as the completion result.

[0041] Through a dynamic coupling process, the static constraint model is transformed into a dynamic, self-healing structured constraint set, providing precise input parameters for the subsequent generation of highly adaptable exploit code.

[0042] S3. Based on the structured constraint set, generate exploit code that matches the target environment's technology stack.

[0043] During code generation, targeted generation is performed based on explicit constraints. The generated exploit code strictly adheres to the parameter definitions in the structured constraint set in terms of programming language selection, function call methods, and database syntax. For example, if the structured constraint set specifies that the target database is a specific type of domestic database, the generated code will automatically adapt to the SQL syntax specific to that database, rather than the general standard SQL. This generation method based on pre-constraint processing significantly improves the code's environmental adaptability and execution success rate.

[0044] For power office business systems, the following details the specific mechanism for generating exploit code based on structured constraint sets. The core of this mechanism lies in how to transform the structured constraint set generated in previous steps into instructions that the generation model can understand and strictly execute, thereby ensuring accurate adaptation of the output results.

[0045] Specifically, this includes: generating a search enhancement prompt template based on the structured constraint set, wherein the search enhancement prompt template embeds the structured constraint set as conditional constraints; and inputting the search enhancement prompt template into a generation model to obtain the vulnerability exploit code.

[0046] like Figure 5 As shown, the method for generating enhanced prompt templates includes: retrieving matching historical vulnerability exploitation code snippets, technology stack configuration examples, and business logic constraint documents from the power industry knowledge base based on executable parameters in the structured constraint set; and integrating the retrieval results with the constraint representation model to form a composite prompt template containing vulnerability semantic descriptions, technology stack constraints, and historical reference code.

[0047] Retrieval enhancement prompt templates serve as a bridge between structured constraint sets and generative models. Since general generative models (such as large language models) are typically trained on large-scale general corpora, they lack a deep understanding of constraints specific to particular industries or system environments. If a simple vulnerability description is directly input, the model often generates code that is general but poorly targeted. This embodiment constructs retrieval enhancement prompt templates, explicitly embedding key parameters from the structured constraint set (such as database type, middleware version, authentication protocol, etc.) into the prompt instructions in the form of natural language or pseudocode. For example, the template not only includes the instruction to "generate an SQL injection exploit code," but also embeds constraints such as "the target database is DM database, DM-specific system table query syntax must be used, and it is limited by the session timeout of the unified identity authentication system." This embedding method is equivalent to setting strict boundary conditions for the generative model, forcing the model to always search within the solution space defined by the constraints during the generation process, thereby significantly improving the usability of the generated code.

[0048] Furthermore, during the process of inputting the enhanced retrieval prompt template into the generation model to obtain the vulnerability exploitation code, the compatibility between the generated content and the structured constraint set is verified in real time through a constraint propagation mechanism.

[0049] Constraint propagation is a key technical means to ensure the controllability of the generation process. During code generation, the generative model does not output the complete code all at once, but rather token by token or line by line. This embodiment introduces a constraint propagation mechanism, which compares each intermediate code snippet generated by the model with the verification rules in the structured constraint set in real time. Specifically, this mechanism maintains the solution state of a constraint satisfaction problem (CSP). Whenever a new code snippet is generated, the system checks whether the snippet violates the defined environment constraints. For example, if the structured constraint set specifies the database type as MySQL, and the generative model attempts to output a code snippet containing Oracle-specific functions (such as NVL), the constraint propagation mechanism will immediately detect that the snippet is incompatible with the constraint "database type = MySQL" and trigger a rollback or correction mechanism, rejecting the generation of the snippet or guiding the model to generate an alternative snippet that conforms to MySQL syntax (such as using IF NULL). This real-time verification mechanism avoids the inefficient generation-verification-discarding loop, ensuring the syntactic compatibility and logical correctness of the code during the generation process, significantly improving the success rate of code generation.

[0050] The generated exploit code's programming language, framework version, and database type all match the software technology stack constraints in the environment constraints dimension. For example, if the target system uses Spring Boot + DM Database, the generated exploit code will use Java, the DM Database's JDBC driver, and SQL syntax.

[0051] The aforementioned generative model can be a pre-trained large language model or a specialized model fine-tuned with domain-specific data. For example, when the method provided in this embodiment is applied to a power office business system, low-rank adaptation LoRA technology or Adapter technology is used to inject domain knowledge of the power office business system into a general large language model for fine-tuning, thereby obtaining a model adapted to power business. Domain knowledge of the power office business system includes power business specifications, power industry data security compliance requirements, domestic database adaptation rules, and power office software vulnerability patterns. Power office software vulnerability patterns include: business logic vulnerabilities specific to the power marketing system (such as tampering with electricity bill settlement parameters), data permission vulnerabilities in the power trading platform (such as unauthorized querying of user electricity consumption data), and interface authentication vulnerabilities in the dispatch management system (such as API key leakage).

[0052] S4, Simulation Verification.

[0053] The effectiveness of the exploit code is verified in a simulation environment, which simulates the software technology stack constraints in the environmental constraint dimension. The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploit success rate and the validity verification records of constraint parameters. When the verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

[0054] Through the above steps, this embodiment establishes a core logic chain of constraint modeling, dynamic coupling, code generation, and simulation verification, transforming environmental constraints from implicit background information into explicit driving parameters, effectively solving the problem of poor adaptability of general generation methods in specific technology stack environments.

[0055] This embodiment provides a constraint-driven vulnerability exploit code generation system, including a constraint modeling module, a constraint coupling module, and a code generation module. The system aims to transform the constraint modeling, dynamic coupling, and code generation methods described in the preceding embodiments into an executable hardware-software collaborative workflow through a modular architecture design, thereby achieving precise adaptation to the target environment's technology stack and automated generation of vulnerability exploit code.

[0056] Specifically, the constraint modeling module is used to construct a constraint representation model that includes environmental constraint dimensions, where the environmental constraint dimensions formalize software technology stack constraints into structured parameters. As the system's input, this module undertakes the core task of transforming unstructured, implicit environmental information into machine-readable logical expressions. In actual deployment, the constraint modeling module can receive manually input asset detection results through a user interface, or it can automatically connect to asset scanning tools via API to obtain information such as the target system's software architecture and database type, and then transform it according to predefined formal rules.

[0057] The constraint coupling module dynamically couples the constraint representation model with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters. This module integrates an inference engine and a graph query interface. It receives structured parameters from the constraint modeling module and performs entity linking and path retrieval within the vulnerability knowledge graph. When missing or conflicting input parameters are detected, the module automatically triggers inference logic, using dependencies stored in the graph to complete or correct the constraints, ultimately outputting a logically consistent and parameter-complete structured constraint set. This solves the problem that fragmented environmental information cannot directly drive code generation.

[0058] The code generation module generates exploit code that matches the target environment's technology stack based on the structured constraint set. This module incorporates a code generation model, such as a domain-adjusted large language model. The module reads the structured constraint set, converts it into a search-enhanced hint template, and guides the generation model to produce code that conforms to the constraints. This module also performs preliminary syntax checking on the generated code to ensure the executability of the output.

[0059] Furthermore, the system also includes a simulation verification module, which is configured as follows: The effectiveness of the exploit code is verified in a simulation environment, which simulates the software technology stack constraints in the environmental constraint dimension. The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploit success rate and the validity verification records of constraint parameters. When the verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

[0060] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A constraint-driven vulnerability exploit code generation method, characterized in that, The method is applied to a power office network and includes: Construct a constraint representation model that includes vulnerability characteristics, attack methods, and environmental constraints, wherein the environmental constraints formalize the software technology stack constraints into structured parameters; The constraint representation model is dynamically coupled with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters; A search enhancement suggestion template is generated based on the structured constraint set, wherein the search enhancement suggestion template embeds the structured constraint set as a condition constraint; The enhanced search suggestion template is input into the generation model to generate exploit code that matches the technology stack of the target environment; The effectiveness of the exploit code is verified in a simulation environment. If the verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

2. The method according to claim 1, characterized in that, The structured parameters include constraint variables, value range, dependencies, and validation rules.

3. The method according to claim 2, characterized in that, The constraint variables include business system type, software architecture, database type, middleware type, authentication method, and data interaction specifications.

4. The method according to claim 1, characterized in that, The dynamic coupling includes: Entity linking and attribute completion are performed on the environmental constraint dimension in the constraint representation model. A consistency check is performed on the constraints after attribute completion to generate the structured constraint set.

5. The method according to claim 4, characterized in that, The attribute completion includes: When constraint information in the environmental constraint dimension is missing, the missing constraint parameters are derived and filled in based on the known constraints and variable dependencies in the vulnerability knowledge graph. When multiple candidate constraint parameters exist, the optimal parameter combination is selected by ranking them based on the utilization success rate and constraint compatibility score in historical data.

6. The method according to claim 1, characterized in that, During the process of inputting the enhanced retrieval prompt template into the generation model to obtain the vulnerability exploitation code, the compatibility between the generated content and the structured constraint set is verified in real time through a constraint propagation mechanism.

7. The method according to claim 1, characterized in that, The verification of the effectiveness of the exploit code in a simulation environment also includes: The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploitation success rate and the validity verification records of constraint parameters; When verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

8. A constraint-driven exploit code generation system for implementing the method as described in any one of claims 1 to 7, characterized in that, include: The constraint modeling module is used to construct a constraint representation model that includes environmental constraint dimensions, wherein the environmental constraint dimensions formalize the software technology stack constraints into structured parameters, and the structured parameters include constraint variables, value ranges, dependencies, and verification rules. The constraint coupling module is used to dynamically couple the constraint representation model with the vulnerability knowledge graph to generate a structured constraint set containing executable parameters. The code generation module is used to generate a search enhancement prompt template based on the structured constraint set, input the search enhancement prompt template into the generation model, and generate vulnerability exploitation code that matches the technology stack of the target environment; The search enhancement prompt template embeds the structured constraint set as a condition constraint. The simulation verification module is used to verify the effectiveness of the exploit code in a simulation environment.

9. The system according to claim 8, characterized in that, The simulation verification module is configured as follows: The verification results are fed back to the vulnerability knowledge graph to update the historical vulnerability exploitation success rate and the validity verification records of constraint parameters; When verification fails, the constraint parameters in the structured constraint set are adjusted based on the reason for the failure, and the code generation process is re-executed.

Images