A security protocol vulnerability discovery and attack evidence recovery method and system

Abstract

The application discloses a security protocol vulnerability discovery and attack evidence recovery method and system, and relates to the technical field of security protocols. The method can convert the non-formal description of the security protocol into a typed, checkable, compilable and executable CPN analysis model without taking a large language model as a prover or a final determinator, and can recover the attack path evidence aligned with the source-level security target after the monitor is triggered.

Description

Technical Field

[0001] This invention relates to the field of security protocol technology, specifically to a method and system for discovering security protocol vulnerabilities and recovering attack evidence. Background Technology

[0002] Full protocols are widely used in communication networks, cloud services, mobile terminals, industrial internet, and distributed systems. Their security relies on properties such as authentication, key distribution, confidentiality, freshness, and replay resistance. Existing formal verification tools (such as ProVerif, Tamarin, AVISPA, Scyther, and modeling and analysis methods based on CPN Tools) can perform attribute verification and attack searching after obtaining an accurate formal model.

[0003] However, protocols in engineering practice are typically described in natural language, Alice-and-Bob message sequences, semi-structured configurations, or academic papers. Validation tools often require explicit input sets of roles, message types, initial knowledge, freshness declarations, security objectives, attacker capabilities, and execution boundaries. A significant gap exists between informal descriptions and executable formal models, leading to high costs for manual modeling, model quality reliant on expert experience, and susceptibility to problems such as missing objectives, inconsistent types, unclear attacker semantics, and untraceable evidence.

[0004] Large language models have the ability to extract structured information from informal text, but directly outputting secure conclusions, CPN XML, or unconstrained JSON from large language models is unstable. The generated results may suffer from defects such as illusions, role confusion, incorrect message type, ambiguous target semantics, or inability to be executed by verification tools. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for discovering security protocol vulnerabilities and recovering attack evidence. It can convert the informal description of security protocols into a typified, inspectable, compileable and executable CPN analysis model without using a large language model as a prover or final decision maker, and recover attack path evidence aligned with the source-level security target after the monitor is triggered.

[0006] The technical solution of the present invention is as follows: This invention provides a method for discovering security protocol vulnerabilities and recovering attack evidence, which includes the following steps: S1: Input the informal protocol description text; S2: Invoke the large language model to generate candidate κCPN specifications based on the protocol description; S3: Perform multi-level quality gating verification on candidate κCPN specifications to generate a standard ProtocolSpec data structure; S4: Based on the ProtocolSpec standard data structure, compile and generate an executable CPN Tools XML model, and simultaneously generate a bypass file that records the target mapping relationship and compilation metadata; S5: Under the bounded attacker model, execute the CPN Tools XML model or explore the state space to monitor whether the locations representing security target violations are reachable; S6: If the violation database is detected, export the execution trajectory of the CPN and reconstruct the attack path and structured attack evidence report by combining it with the bypass file.

[0007] Furthermore, in some embodiments of the present invention, in step S1 above, the informal protocol description text includes a natural language protocol specification document, an Alice-and-Bob format message interaction sequence, and a semi-structured engineering configuration and protocol specification.

[0008] Furthermore, in some embodiments of the present invention, the aforementioned κCPN is a typed intermediate computation for security protocol modeling.

[0009] Furthermore, in some embodiments of the present invention, in step S2 above, the output of the large language model is constrained to the grammatical range of the κCPN typed intermediate computation, and the large language model only assumes the role of candidate reduction generation.

[0010] Furthermore, in some embodiments of the present invention, in step S3 above, the ProtocolSpec standard data structure is defined as P=(R,K,F,M,G,Bs,Bd); where R is the set of roles, K is the initial knowledge assignment, F is the set of fresh value declarations, M is the ordered message sequence, G is the set of security targets, Bs is the session bound, and Bd is the item depth bound.

[0011] Furthermore, in some embodiments of the present invention, the multi-level quality gating verification in step S3 above includes: The candidate κCPN protocol specification is sequentially subjected to lexical / syntactic parsing, normalization, round-trip parsing check, and static semantic check.

[0012] Furthermore, in some embodiments of the present invention, in step S3 above, multi-level quality gating verification is performed on the candidate κCPN protocol. If the verification fails, the large language model is guided to perform a limited number of repair rounds based on the error code and local constraints. No manual correction content is injected during the repair process. A maximum number of repair rounds is set. If the verification still fails after exceeding the maximum number of rounds, the candidate κCPN protocol protocol is discarded.

[0013] Furthermore, in some embodiments of the present invention, in step S4 above, generating an executable CPN Tools XML model through target-aware compilation and simultaneously generating a bypass file recording target mapping relationships and compilation metadata specifically includes: Each security objective in ProtocolSpec is compiled into a corresponding local monitor library in the CPN model: confidentiality objectives are compiled into Leak_* monitors, authentication objectives into Viol_Auth_* monitors, freshness objectives into Viol_Freshness_* monitors, and anti-replay objectives into Viol_Replay_* monitors. The local monitors are then aggregated into the Violation library.

[0014] Furthermore, in some embodiments of the present invention, in step S5 above, the attacker capabilities supported by the bounded attacker model include: interception, delay, replay, rearrangement, and injection of messages, but cannot destroy the semantics of idealized cryptographic primitives in symbolic message algebra.

[0015] Furthermore, in some embodiments of the present invention, in step S6 above, the attack path is defined as AP=(V,E,λ,β,μ); where V is an ordered set of nodes, E is an edge set, λ records the transfer label and node type corresponding to the node, β records the binding and protocol step context, and μ records the target alignment metadata.

[0016] Furthermore, in some embodiments of the present invention, in step S6 above, the bypass files include a goals.json file for recording target mapping information, a compile.json file for recording compilation metadata, and a trace.json file for recording CPN state space trajectories.

[0017] Furthermore, in some embodiments of the present invention, step S7 is also included: if no reachable violation site is monitored, or if an attack path and structured attack evidence report cannot be obtained, the output is expressed as "no recoverable trajectory / report shown," "attack not shown," or other synonyms, instead of directly outputting "no attack detected," "protocol secure," or other synonyms.

[0018] This invention also provides a security protocol vulnerability discovery and attack evidence recovery system for implementing the above method, comprising: Input acquisition module: used to receive informal protocol description text; Constrained reduction generation module: used to construct κCPN-guided extraction prompts and call the large language model to generate candidate κCPN reductions; The parsing and normalization module is used to parse and normalize candidate κCPN protocol specifications and convert them into ProtocolSpec P. Static semantic inspection module: used to verify the legality of roles, ordering, message items, initial knowledge, freshness values, security goals, and boundaries; The automatic repair module is used to return error codes and local constraints to the large language model when the verification fails, guiding automatic repair in a limited number of rounds. Finite-round repair module: used to guide the automatic repair of large language models based on error codes and local constraints when verification fails; Target-aware CPN compilation module: used to compile the standard ProtocolSpec into an executable CPN ToolsXML model and target bypass file; CPN XML Validation Module: Used to validate the validity of the generated CPN Tools XML model; Bounded CPN Execution / State Space Analysis Module: Used to execute or explore models under a bounded attacker model; Trajectory Normalization Module: Used to perform trajectory normalization on the exported CPN; Attack path recovery module: used to reconstruct the obtained attack path; Structured report generation module: Used to generate structured attack evidence reports aligned with source-level security objectives.

[0019] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects: 1. Reduce front-end modeling costs. The solution of this invention converts natural language, Alice-and-Bob message sequences, or semi-structured protocol specifications into constrained ProtocolSpecs, and then automatically compiles them into CPN models, reducing the workload of manually creating roles, messages, places, transitions, and monitors.

[0020] 2. Improve the inspectability and executability of the generated model. The output of the large language model is not directly used as a verification conclusion, but must pass through multi-level quality gating verification to reduce the risk of illusions, type errors, and unexecutable models entering the backend from the source.

[0021] 3. Improve the target alignment capability of vulnerability evidence. Security targets are explicitly compiled into target-local monitors. After the monitors are triggered, they can be mapped back to the source-level targets through bypass files, avoiding the disconnect between low-level state space trajectories and source-level security requirements.

[0022] 4. Enhanced readability and auditability of evidence. AttackPath reports record transfer nodes, bindings, protocol step context, and target metadata, making vulnerability evidence not only a binary "reachable / unreachable" conclusion, but also a verifiable path description.

[0023] 5. Control the size of the state space. Constructing a bounded backend with finite message domains, session bounds, and item depth bounds limits attacker capabilities to an auditable range, which facilitates state space analysis in CPN Tools.

[0024] 6. Establish clear boundaries for conclusions. The absence of a report is described as the current bounded backend not showing a recoverable trajectory, rather than a proof of protocol security, thus reducing the risk of misusing verification results. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of the overall process of the method provided in the embodiments of the present invention; Figure 2 This is a schematic diagram illustrating the protocol formalization, target-aware CPN construction, and attack evidence recovery process in an embodiment of the present invention. Figure 3 This is an example of a CPN model and a schematic diagram of the target monitor layout in an embodiment of the present invention; Figure 4 This is a comparison chart of end-to-end indicators for groups in the experimental examples of this invention; Figure 5 This is a diagram showing the real7 protocol-by-protocol time and report status in an experimental example of this invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below.

[0028] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0029] The features and performance of the present invention will be further described in detail below with reference to embodiments.

[0030] Example This invention utilizes a constrained large language model to generate candidate specifications, and through κCPN typed intermediate computation, static semantic inspection, target-aware CPN compilation, bounded state space execution, and attack path evidence recovery, it achieves security protocol vulnerability discovery, target violation detection, and auditable report generation.

[0031] Its overall process is as follows Figure 1 As shown, the input protocol description is first normalized into a constrained DSL. The parser and checker construct the ProtocolSpec and reject malformed items, type-incorrect structures, inconsistent role references, and unsupported target patterns before compilation. The compiler generates an executable CPN Tools model, target monitor, and bypass metadata. The exported trace is normalized to trace.json and reconstructed into attack path evidence using the target bypass file.

[0032] κCPN is not a complete general-purpose programming language, but rather a constrained intermediate calculus for modeling security protocols. It only exposes the structures required by the inspector and compiler: roles, initial knowledge, fresh values, message steps, security goals, and bounded parameters.

[0033] The verified and normalized protocol specification is stored in the ProtocolSpec standard data structure and is defined as follows: P=(R,K,F,M,G,Bs,Bd); where R is the set of roles, K is the initial knowledge assignment, F is the set of fresh value declarations, M is the ordered message sequence, G is the set of security targets, Bs is the session bound, and Bd is the item depth bound.

[0034] The active network attacker model employed in this invention allows the attacker to intercept, delay, replay, rearrange, and inject messages, but cannot disrupt the semantics of idealized cryptographic primitives in symbolic message algebra. In the current protocol-sensitive backend, the attacker is bounded: it operates within a finite message domain and a finite set of protocol-sensitive intrusion actions, rather than an unbounded derivation system.

[0035] Therefore, the successful generation of a state-space report by the present invention means that the bounded executable model, reachable trajectory, and reconstruction layer together produce readable evidence. Failure to generate a report does not equate to proof of protocol security; it may mean that the backend does not reveal a suitable trajectory, the target requires more extensive attacker deduction, or the protocol is beyond the current bounded exploration range.

[0036] In this embodiment of the invention, LLM uses GPT-5.4, with a temperature set to 0.0 and a maximum repair rounds (max_repair_rounds) set to 2. This setting does not rely on multiple random sampling to find accidental successful outputs, but rather aims to fix the generation process as much as possible, making parsing, static analysis, compilation, and XML validation the primary quality gates. GPT-5.4 was chosen because of its stable performance in code generation and structured information extraction.

[0037] In this embodiment of the invention, the closed-loop log records the model name, raw output, checker error code, whether a repair prompt was used, stage status, and total time for each round. Stage status includes extraction, normalization, κcpn_render, roundtrip_parse_check, static_validation, cpn_compile, and xml_validation. Only after a candidate specification passes κCPN roundtrip parsing, ProtocolSpec basic validation, source consistency check, and optional CPN XML validation does it enter the evidence recovery process.

[0038] The key interaction timing of the embodiments of the present invention is as follows: Figure 2 As shown. The input side only provides the protocol specification x; the Large Language Model (LLM) outputs candidate κCPN; the checker returns an error code e or generates a normalized P; the compiler maps P to the CPN model C and the target monitor; the CPN backend outputs the trajectory τ or Viol_* markers; the evidence layer then generates the target alignment report R. If the check or compilation fails, the system only returns the error code and local constraints to the LLM for a limited round of repair, without injecting human answers as hints.

[0039] For each accepted ProtocolSpec, the compiler generates a protocol-sensitive CPN model according to a fixed structure: the control chain library's Step_i is used to constrain the bounded honest protocol order; the role knowledge library's Know_r records local symbolic material; the shared Net library represents network-visible messages; the IK library stores bounded attacker knowledge; and local libraries such as Viol_Secrecy_*, Viol_Freshness_*, Viol_Auth_*, and Viol_Replay_* record target evidence, which is then aggregated by the Violation library.

[0040] like Figure 3 As shown, Figure 3The model illustrates the vulnerability discovery path of this invention: the left-hand m1 and m2 transitions represent the execution of the honest protocol; the middle Net and IK characterize the attacker's observation and replay of network messages; and the right-hand Leak_SECRET_Kab, LeakGoal_Kab, and Violation characterize the detection of violations of confidentiality targets. During state space execution, the compiler simultaneously exports .goals.json and .compile.json bypass files. The former records the mapping from source-level targets to the generated monitoring library, while the latter records the compiler's source, boundaries, attacker model assumptions, and state space simplification instructions. The reconstruction layer utilizes these files to reconnect the low-level CPN trajectory to the source-level security target, thereby forming a traceable chain of evidence.

[0041] Therefore, from the CPN perspective, vulnerability discovery is implemented as reachability detection of the target's local places. Taking confidentiality as an example, if an alias of a secret item enters the IK and the Leak_* monitor is triggered, a flag appears in the Violation; authentication, freshness, and replay targets trigger the corresponding Viol_* places by observing expected messages, random numbers or timestamp states, and recurring message patterns, respectively. This design ensures a one-to-one mapping between the criteria for "finding a vulnerability" and the source-level target, avoiding misinterpreting LLM-generated text interpretation as verification conclusions.

[0042] like Figure 3 As shown, the case corresponding to this diagram is the Wide-Mouthed-Frog shared key distribution protocol, derived from the protocol example in the wide_mouthed_frog literature. This protocol includes participants A, B, server S, and attacker I, where A shares a long-term key Kas with S, and B shares a long-term key Kbs with S; A freshly generates a session key Kab and a timestamp T. The protocol description input to the LLM is normalized into a two-step Alice-and-Bob style message sequence: Step 1 is A->S: pair(B,senc(pair(T,pair(B, Kab)),Kas)), Step 2 is S->B: senc(pair(T,pair(A, Kab)),Kbs); it also provides the security objective secrecy Kab and authentication AB on senc(pair(T,pair(A,Kab)),Kbs)noninjective, and sets the session bound sessions=2 and the term depth bound max_term_depth=3.

[0043] After LLM generates candidate κCPN specifications, the system sequentially performs protocol extraction, normalization, κCPN rendering, round-trip resolution check, static semantic verification, CPN compilation, and XML verification. This example passed all checks in one round of generation, did not trigger the repair process, and was ultimately generated by the compiler. Figure 3 The CPN Tools model is shown below. The model includes a protocol control chain, a network repository (Net), an attacker's knowledge base (IK), intruder action transfer mechanisms, and a target monitoring repository; the confidentiality target (secrecy Kab) is mapped to Viol_Secrecy_Kab, and the authentication target is mapped to Viol_Auth_A_B. The compiled backend is an attacker model, supporting actions such as interception, replay, injection, and tampering of bounded message fields.

[0044] CPN Tools state space analysis results show that this example generated reachable violation markers: the state space report contains 18,670 nodes and 178,966 arcs, with the upper bound of the Violation library being 2 in bounded exploration. The evidence recovery layer further reconstructs the low-level state space results into an attack path report aligned with the source-level target, secrecy Kab. The attack path report contains three nodes: m1, m2, and Violation, involving intruder actions including interception, replay, construction, leak learning, and mutation. Therefore, it is evident that... Figure 3 It not only demonstrates the automatic compilation results from κCPN to CPN Tools, but also shows how the present invention connects the source-level protocol specification, target monitor, state space violation markers, and final attack path evidence.

[0045] In this invention, for the vulnerability evidence recovery algorithm, the attack path is represented as AP=(V,E,λ,β,μ), where V is an ordered set of nodes, E is an edge set, λ maps nodes to transition labels and node types, β records the binding and protocol step context, and μ stores target alignment metadata. The specific process is as follows: Input: Protocol description x, maximum number of repair rounds q, boundaries Bs, Bd; Output: ProtocolSpec P, CPN model C, attack path report Rpt or reason for failure.

[0046] 1) Set round=0 to construct extraction hints for κCPN.

[0047] 2) while round≤q do 3) Call LLM to generate candidate κCPN reduction Pc.

[0048] 4) Perform parsing, normalization, round-trip parsing, and static semantic checks on Pc.

[0049] 5) If the check fails, then generate a repair prompt based on the error code, round = round + 1, continue.

[0050] 6) Compile PC to generate CPN model C, .goals.json and .compile.json.

[0051] 7) If XML validation or target mapping check fails, then fix according to the error code, round=round+1, continue.

[0052] 8) Execute or explore C under the bounded attacker model and derive the trajectory τ.

[0053] 9) Normalize τ to trace.json and reconstruct the attack path based on .goals.json.

[0054] 10) If Viol_* is generated and the target is alignable, then return P, C, and Rpt.

[0055] 11) else Returns "Currently bounded backend does not show a recoverable report".

[0056] 12) end while Experimental Example The protocol families used in this experimental example are from classic authentication and key distribution literature, including Needham-Schroeder, Denning-Sacco, Otway-Rees, Beller-Chang-Yacobi, SPLICE / AS, Tatebayashi-Matsuzaki-Newman, and Wide-Mouthed-Frog. These protocols have relatively clear vulnerabilities and modeling details, making them suitable as benchmark examples for verifying pipelines. Existing research on CPN-based security protocols emphasizes the research value of attack path extraction and points out that state space size control is a key issue in CPN protocol analysis.

[0057] In this experimental example, LLM uses GPT-5.4, temperature is set to 0.0, and the maximum number of repair rounds (max_repair_rounds) is set to 2.

[0058] The experiment is divided into three layers. The target type verification layer checks whether non-confidential targets such as freshness, authentication, and replay resistance are acceptable, performs static verification, and compiles them into the expected monitor. The abstract8 layer is an engineering robustness check on a controlled template. The real7 layer uses a documentary protocol family instead of a synthetic template, and therefore serves as the main effect result.

[0059] This experimental example uses the following metrics: R_loop represents the ratio of accepted protocols to input protocols; r_bar represents the average number of repair rounds for accepted protocols; R_exec represents the ratio of executable CPN models to accepted protocols; R_report represents the ratio of structured reports to executable CPN models; and R_goal_align represents the ratio of goal alignment reports to structured reports. These metrics are engineering and evidence metrics, and R_report should not be interpreted as a completeness metric in a proof-theoretic sense.

[0060] To avoid confusing LLM generation capabilities with backend verification capabilities, the experiments report R_loop, R_exec, R_report, and R_goal_align separately. R_loop and R_exec mainly reflect the stability of κCPN constraints and the compilation chain; R_report and R_goal_align reflect whether the bounded backend and evidence reconstruction layer can produce readable and target-aligned attack evidence.

[0061] Target type validation: Before reporting end-to-end performance, we first verify whether the front-end and compiler can accept non-confidential targets. As shown in Table 1, freshness, authentication, and replay resistance targets can all generate corresponding Viol_* monitoring libraries.

[0062] Table 1

[0063] Decoupled end-to-end results: This experiment reports the abstract group and the literature group separately to avoid misrepresenting engineering stability as the effectiveness of real protocol analysis. See Table 2 and... Figure 4 As shown, the split end-to-end results are given.

[0064] Table 2

[0065] Both groups achieved R_loop=R_exec=100% for the evaluated artifacts, with an average of 0 repair rounds, indicating relatively stable extraction, inspection, and compilation processes. The main decline occurred at the evidence recovery layer: real7's R_report=85.7%, because a protocol failed to generate a recoverable report under the current backend.

[0066] Real7 protocol-by-protocol analysis: The main group comprises seven literature source protocols. See Table 3 and... Figure 5 As shown, "Is the attack manifested?" is used instead of "Is an attack present?" to avoid misinterpreting the lack of VULCAN reports as a sign of protocol security.

[0067] Table 3

[0068] The time distribution is asymmetrical. The average runtime of the main group is 19.88s, while the median is only 9.08s. This is because otway_rees, nspk_original, and wide_mouthed_frog dominate the upper tail of the runtime.

[0069] Failure Example Analysis: A miss in `denning_sacco_shared_key` is not a front-end failure. This example completes GPT-5.4 extraction, κCPN round-trip parsing, static validation, CPN compilation, and XML validation, demonstrating that the front-end path from natural language to the executable model is functional. The failure occurs further back: the current bounded backend does not exhibit a path reconstruction layer capable of restoring the reported violation trajectory. See Table 4 for details.

[0070] Table 4

[0071] Therefore, this example should be written as "NOT SUR-FACED" instead of "NOATTACK". The latter could be misinterpreted as proof of security, while the former simply indicates that the current bounded evidence recovery configuration has not recovered a reportable track. The vulnerability can be verified by increasing the session boundary from 2 to 3 and expanding the attacker's timestamp derivation rules.

[0072] In summary, the experimental results support four bounded conclusions. First, using κCPN and static checks to constrain GPT-5.4 output is more suitable for security protocol modeling than directly accepting unconstrained artifact generation. Second, κCPN can serve as a formal compilation constraint between the LLM frontend and the CPN Tools backend, rather than just an engineering format conversion. Third, the CPN execution model has better interpretability when analysts require transfer-level evidence rather than just binary results. Fourth, reporting synthetic engineering tests and literature protocol tests separately avoids overstating conclusions.

[0073] The embodiments described above are some, but not all, embodiments of the present invention. The detailed description of the embodiments of the present invention is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

Claims

1. A method for discovering security protocol vulnerabilities and recovering attack evidence, characterized in that, It includes the following steps: S1: Input the informal protocol description text; S2: Invoke the large language model to generate candidate κCPN specifications based on the protocol description; S3: Perform multi-level quality gating verification on candidate κCPN specifications to generate a standard ProtocolSpec data structure; S4: Based on the ProtocolSpec standard data structure, compile and generate an executable CPN Tools XML model, and simultaneously generate a bypass file that records the target mapping relationship and compilation metadata; S5: Under the bounded attacker model, execute the CPN Tools XML model or explore the state space to monitor whether the locations representing security target violations are reachable; S6: If the violation database is detected, export the execution trajectory of the CPN and reconstruct the attack path and structured attack evidence report by combining it with the bypass file.

2. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, The κCPN is a typed intermediate calculus for security protocol modeling.

3. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, In step S3, the ProtocolSpec standard data structure is defined as P=(R,K,F,M,G,Bs,Bd); where R is the set of roles, K is the initial knowledge assignment, F is the set of fresh value declarations, M is the ordered message sequence, G is the set of security targets, Bs is the session bound, and Bd is the item depth bound.

4. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, In step S3, the multi-level quality gating verification includes: The candidate κCPN protocol specification is sequentially subjected to lexical / syntactic parsing, normalization, round-trip parsing check, and static semantic check.

5. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, In step S3, multi-level quality gating verification is performed on the candidate κCPN protocol. If the verification fails, the large language model is guided to perform a limited number of repair rounds based on the error code and local constraints. No manual corrections are injected during the repair process. A maximum number of repair rounds is set. If the verification still fails after exceeding the maximum number of rounds, the candidate κCPN protocol protocol is discarded.

6. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, In step S5, the attacker capabilities supported by the bounded attacker model include: interception, delay, replay, rearrangement, and message injection, but cannot violate the semantics of idealized cryptographic primitives in symbolic message algebra.

7. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, In step S6, the attack path is defined as AP=(V,E,λ,β,μ); where V is an ordered set of nodes, E is an edge set, λ records the transition label and node type corresponding to the node, β records the binding and protocol step context, and μ records the target alignment metadata.

8. The method for discovering security protocol vulnerabilities and recovering attack evidence according to claim 1, characterized in that, It also includes step S7: If no reachable violation site is monitored, or if an attack path and structured attack evidence report cannot be obtained, the output is expressed as "no recoverable trace / report shown", "attack not shown" or other synonyms, instead of directly outputting "no attack detected", "protocol security" or other synonyms.

9. A security protocol vulnerability discovery and attack evidence recovery system, used to implement the method as described in any one of claims 1 to 8, characterized in that, It includes: Input acquisition module: used to receive informal protocol description text; Constrained reduction generation module: used to construct κCPN-guided extraction prompts and call the large language model to generate candidate κCPN reductions; The parsing and normalization module is used to parse and normalize candidate κCPN protocol specifications and convert them into ProtocolSpec P. Static semantic inspection module: used to verify the legality of roles, ordering, message items, initial knowledge, freshness values, security goals, and boundaries; The automatic repair module is used to return error codes and local constraints to the large language model when the verification fails, guiding automatic repair in a limited number of rounds. Finite-round repair module: used to guide the automatic repair of large language models based on error codes and local constraints when verification fails; Target-aware CPN compilation module: used to compile the standard ProtocolSpec into executable CPN Tools XML models and target bypass files; CPN XML Validation Module: Used to validate the validity of the generated CPN Tools XML model; Bounded CPN Execution / State Space Analysis Module: Used to execute or explore models under a bounded attacker model; Trajectory Normalization Module: Used to perform trajectory normalization on the exported CPN; Attack path recovery module: used to reconstruct the obtained attack path; Structured report generation module: Used to generate structured attack evidence reports aligned with source-level security objectives.

Images