Method and related apparatus for generating security test payload optimization based on search enhancement

Abstract

The application discloses a security test load optimization method based on retrieval enhancement generation and a related device, and belongs to the technical field of network security; the method constructs a vector database containing a security test experience document; receives a test instruction, retrieves a knowledge segment related to the test instruction from the vector database; combines the knowledge segment and the test instruction to form an enhanced prompt word; and inputs the enhanced prompt word into a large language model to generate an optimized security test load. The application aims at the problems of knowledge staticization, insufficient context perception ability and difficulty in reuse of experience knowledge in existing security tests, and proposes a security test load optimization method based on retrieval enhancement generation to improve the pertinence and bypass success rate of the security test load.

Description

Technical Field

[0001] This invention belongs to the field of network security technology and relates to a method and related apparatus for optimizing security test payloads based on retrieval enhancement. Background Technology

[0002] With the continuous evolution of cyberattack methods, cybersecurity testing has become a crucial link in ensuring the security of information systems. In security assessment work such as penetration testing and vulnerability discovery, security testers (such as white-hat hackers and penetration test engineers) need to construct and send data with specific malicious intent—the "security test payload"—to target systems (such as web applications) to detect and verify potential security vulnerabilities, such as SQL injection, cross-site scripting, and command injection. Efficiently and accurately generating payloads capable of bypassing various defense mechanisms is key to improving testing efficiency and success rates.

[0003] Traditional security test payload generation heavily relies on the personal experience and manual construction of security experts. Experts typically record penetration techniques, vulnerability exploitation methods, and bypass techniques for specific web application firewalls in experience documents (such as Markdown manuals, internal wikis, and case reports). However, with the continuous expansion of knowledge bases and the dynamic changes in attack and defense environments, this model based on manual review and reuse has revealed significant limitations: knowledge retrieval efficiency is low, it is difficult to quickly locate the most relevant techniques in complex real-world scenarios, and it is highly dependent on the testers' personal experience level, failing to achieve large-scale, automated knowledge application.

[0004] In recent years, artificial intelligence technologies, represented by large language models, have made groundbreaking progress and demonstrated powerful capabilities in various fields such as natural language processing and code generation. In the field of cybersecurity, researchers have begun to explore leveraging the powerful generative capabilities of large language models to automatically assist in the generation of security test payloads. The basic idea of ​​this approach is to directly input test commands into a general-purpose large language model, which then outputs corresponding attack code or test statements based on the massive amounts of publicly available knowledge learned during its pre-training phase. However, this existing end-to-end generation method based on general-purpose large language models faces severe technical bottlenecks in real-world cybersecurity testing scenarios, resulting in generated payloads that are often not highly targeted and have poor practical effectiveness, specifically manifested in the following aspects.

[0005] First, there's the issue of static knowledge: the reasoning ability of general-purpose large models is limited by the publicly available knowledge learned during their pre-training phase. They struggle to access or dynamically integrate continuously updated domain knowledge, such as internal enterprise penetration experience and bypass techniques for specific environments, resulting in generated test payloads lacking specificity and practical value. Essentially, existing solutions lack a dynamic retrieval mechanism, failing to inject external experiential knowledge into the generation process in real time. Second, there's insufficient context awareness: when facing targets with deployed Web Application Firewalls (WAFs) or Intrusion Prevention Systems (IPSs), existing models often only generate standardized test payloads. These payloads are easily blocked by rule bases and lack adaptive mutation capabilities for specific defense strategies, leading to low test success rates. The root cause is that the model cannot access private adversarial techniques and experiential knowledge related to the defense mechanism during generation, lacking a retrieval enhancement stage to provide necessary contextual support. Third, the reuse of experiential knowledge is difficult: security teams accumulate a large amount of experience-based documentation in their daily work, such as Markdown-formatted penetration testing manuals, vulnerability exploitation memos, and WAF bypass cases. However, these static documents are mostly stored in unstructured form, making them difficult for automated tools to directly parse and access. This results in valuable practical experience not being able to effectively assist AI in decision-making optimization. Existing technologies lack methods to connect static documents with dynamic AI, i.e., methods to transform unstructured text into searchable and callable vectorized knowledge bases.

[0006] In summary, existing technical solutions have significant shortcomings in terms of real-time knowledge provision, scenario relevance, and experience reusability, resulting in low-quality security test payloads generated by AI, which are insufficient to meet the actual needs of automated penetration testing in highly adversarial environments. Therefore, how to transform static experience documents into dynamic skills that can be invoked by AI in real time to improve the relevance and bypass success rate of security test payloads has become a key technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] The purpose of this invention is to provide a method and related apparatus for optimizing security test loads based on retrieval enhancement, so as to solve the technical problems of lagging knowledge updates, insufficient context awareness and difficulty in reusing experience in AI security testing in the prior art.

[0008] To achieve the above objectives, the present invention employs the following technical solution: In a first aspect, the present invention provides a method for optimizing security test payloads based on retrieval enhancement, comprising the following steps: Collect and preprocess experience documents related to security testing to build a vector database. Establish a two-level index in the vector database, which includes a vulnerability type index and an adversarial environment feature index. Receive a test instruction and retrieve knowledge fragments related to the test instruction from the vector database; The knowledge fragments, test instructions, and preset prompt word templates are combined to form enhanced prompt words; The enhanced prompts are input into a pre-trained large language model to generate an optimized security test payload.

[0009] Furthermore, the step of collecting and preprocessing experience documents related to security testing to construct a vector database specifically includes: Collect experience documents related to security testing, perform structured parsing and semantic segmentation on the experience documents to obtain several knowledge fragments; The knowledge fragments are input into the embedding model to generate corresponding vector representations; The vector representations and their corresponding knowledge fragments are stored in a vector database, and a two-layer index is established. The first layer of the dual-layer index is a vulnerability type index, and the second layer is an adversarial environment feature index.

[0010] Furthermore, the adversarial environment characteristics include one or more of the following: WAF vendor, middleware type, database type, and operating system version.

[0011] Furthermore, the step of receiving the test instruction and retrieving knowledge fragments related to the test instruction from the vector database specifically includes: Receive security test instructions input by the user and parse the instructions to extract key semantic features; Based on the key semantic features, a similarity search is performed in the vector database to recall knowledge fragments related to the current test scenario. The search adopts a hybrid search strategy, including vector similarity search and keyword search, and introduces hypothetical document embedding technology.

[0012] Furthermore, the enhanced prompt includes adversarial constraint instructions, which instruct the large language model to refuse to generate a payload and indicate knowledge deficiency when the recalled knowledge fragment does not contain relevant information about the target environment.

[0013] Furthermore, the method also includes: applying the generated security test payload to the target system for testing; if the test is successful, feeding back the successful cases and their corresponding payloads to the vector database for subsequent retrieval and optimization.

[0014] Furthermore, the method also includes caching and reusing search results for the same test target or similar contexts to reduce the overhead of repeated searches.

[0015] Secondly, the present invention provides a security test load optimization system based on retrieval enhancement generation, comprising: The database construction module is used to collect and preprocess experience documents related to security testing, thereby building a vector database. A two-level index is established in the vector database, which includes a vulnerability type index and an adversarial environment feature index. The instruction parsing and retrieval module is used to receive test instructions and retrieve knowledge fragments related to the test instructions from the vector database. The prompt enhancement module is used to combine the knowledge fragments, test instructions, and preset prompt templates to form enhanced prompts; The payload generation module is used to input the enhanced prompt words into a pre-trained large language model to generate an optimized security test payload.

[0016] Thirdly, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the security test load optimization method based on retrieval enhancement generation as described in any one of claims 1-7.

[0017] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for optimizing a security test payload based on retrieval enhancement generation.

[0018] Compared with the prior art, the present invention has the following beneficial effects: This invention discloses a method and related apparatus for optimizing security test payloads based on retrieval-enhanced generation (RAG). By constructing a vector database, the method retrieves the most relevant knowledge fragments to the current test command in real time and injects these specific, professional domain knowledge as contextual clues. This accurately guides a large language model to generate optimized payloads with high scenario adaptability and practical value. The retrieval, enhancement, and generation processes constitute the core of the retrieval-enhanced generation (RAG) framework. This RAG retrieval mechanism transforms static penetration testing manuals into a real-time searchable vector database, enabling the AI ​​model to instantly acquire the latest private experience when generating payloads. This breaks the limitations of static knowledge in traditional models, truly realizing the transformation from static documents to dynamic skills. Furthermore, the RAG framework is not limited to specific vulnerability types and can be extended to various scenarios such as SQL injection, XSS, command injection, and SSRF, demonstrating good versatility.

[0019] Furthermore, the retrieval phase in the RAG framework of this invention ensures that the recall techniques are highly matched with the target environment (such as a specific WAF or database type) through a two-layer index and metadata filtering; the enhancement phase incorporates these experiences into the prompt words, guiding the generation phase to output payloads with bypass capabilities, significantly improving the test success rate.

[0020] Furthermore, successful cases of this invention can be automatically fed back to the knowledge base, forming a RAG closed loop of "retrieval-enhancement-generation-feedback", enabling the system to have the ability to continuously evolve and constantly enrich the dynamic skill base.

[0021] Furthermore, this invention reduces redundant computation overhead and improves the real-time response speed of the RAG system through caching mechanisms and HyDE retrieval optimization, thereby meeting the timeliness requirements of actual penetration testing. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a security test load optimization method based on retrieval enhancement according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the security test load optimization system based on retrieval enhancement generation according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a two-layer index structure of a vector database provided in a security test load optimization method based on retrieval enhancement according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] It should be understood that in the embodiments of this application, "at least one" means one or more, and "more than one" means two or more. "And / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. The character " / " generally indicates that the related objects before and after it are in an "or" relationship. "Contains A, B and / or C" means containing any one, two, or three of A, B, and C.

[0027] It should be understood that in the embodiments of this application, "B corresponding to A", "B corresponding to A", "A corresponds to B", or "B corresponds to A" means that B is associated with A, and B can be determined based on A. Determining B based on A does not mean that B is determined solely based on A; B can also be determined based on A and / or other information.

[0028] This invention provides a method for optimizing security test payloads based on search enhancement, which can be executed by an electronic device, such as a terminal or a server. The terminal can be a smartphone, tablet, laptop, or other similar device. The server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. It is understood that this invention does not limit the specific entity executing this method for optimizing security test payloads based on search enhancement.

[0029] The technical solution of this application will be described in detail below through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments described below are used to explain the technical solution of this application and are not intended to limit actual use.

[0030] This invention discloses a method for optimizing security test payloads based on retrieval enhancement, comprising the following steps: S1. Collect and preprocess experience documents related to security testing to build a vector database. Establish a two-level index in the vector database, which includes a vulnerability type index and an adversarial environment feature index. Collect and preprocess security testing-related experience documents, including but not limited to Markdown-formatted penetration testing manuals, WAF bypass memos, exploit code examples for specific vulnerabilities, and internal penetration testing reports. Perform structured parsing and segmentation on these experience documents to obtain several semantically complete knowledge fragments. Input these knowledge fragments into an embedding model to generate corresponding vector representations, which are then stored in a vector database. Simultaneously, establish a two-layer index: the first layer index represents vulnerability types, and the second layer index represents adversarial environment characteristics. These adversarial environment characteristics include one or more of the following: WAF vendor, middleware type, database type, and operating system version.

[0031] S2, receive the test command, and retrieve knowledge fragments related to the test command from the vector database; The system receives a security test command input by the user, which includes target information and test intent. It then parses the command, extracts key semantic features, and performs a similarity search in the vector database based on these features to recall the knowledge fragments most relevant to the current test scenario. Simultaneously, it filters the search results using target environment metadata to select knowledge fragments suitable for the current target. This step is the "retrieval" phase in the RAG framework. The retrieval employs a hybrid strategy, including vector similarity retrieval and keyword retrieval, and introduces hypothetical document embedding technology. This involves first generating an ideal payload based on the test command, and then using the vector of this hypothetical payload for similarity recall.

[0032] S3, combine the knowledge fragments, test instructions and preset prompt word templates to form enhanced prompt words; The recalled knowledge fragments are used as a reference context and concatenated with the original test instructions and preset prompt word templates to form enhanced prompt words. These enhanced prompt words include adversarial constraint instructions, instructing the large language model to refuse to generate payloads and indicate knowledge deficiency when the recalled knowledge fragments do not contain relevant information about the target environment. This guides the model to strictly generate payloads based on the reference knowledge. This step corresponds to the "enhancement" stage in RAG, injecting external knowledge into the model input.

[0033] S4, input the enhanced prompt words into the pre-trained large language model to generate an optimized security test load.

[0034] The enhanced prompts are input into a pre-trained large language model, which leverages its generation capabilities and integrates retrieved domain knowledge to generate a highly targeted and bypassable security test payload specific to the current test objective. This payload includes, but is not limited to, SQL injection payloads, cross-site scripting payloads, and command injection payloads. This step corresponds to the "Generation" stage in the RAG framework.

[0035] S5: Perform test and feedback loop.

[0036] The generated payloads are applied to the target system for security testing, and the test results are collected. If the test is successful, the successful cases and their corresponding payloads are fed back to the vector database for subsequent optimization. If the test fails, the retrieval strategy is adjusted or the payloads are regenerated based on the reason for the failure, thus forming a closed-loop optimization.

[0037] Preferably, search results for the same test target or similar context are cached and reused to reduce the overhead of duplicate searches.

[0038] See Figure 2 This invention discloses a security test payload optimization system based on retrieval enhancement generation. The system uses RAG architecture and includes a database construction module, an instruction parsing and retrieval module, a prompt word enhancement module, and a payload generation module. Details are as follows: The database construction module collects and preprocesses security testing-related experience documents to build a vector database. A two-layer index is established within this database, comprising a vulnerability type index and an adversarial environment feature index. This module integrates a document parser, text slicer, vectorization model (such as all-MiniLM-L6-v2), and vector database interface, and is responsible for building and maintaining a searchable knowledge source. See also... Figure 3 , Figure 3The document details the two-layer indexing mechanism in the vector database, explaining how to organize knowledge fragments by vulnerability type and adversarial environment to improve retrieval accuracy. The vector database organizes knowledge fragments by first-layer vulnerability type (e.g., SQL injection) and second-layer adversarial environment characteristics (e.g., WAF vendor, database type), enabling multi-dimensional refined retrieval and ensuring a high degree of match between recalled content and test scenarios.

[0039] The instruction parsing and retrieval module is used to receive test instructions, retrieve knowledge fragments related to the test instructions from the vector database, extract test intentions using an intent recognition model, call the approximate nearest neighbor retrieval API of the vector database, and combine metadata filtering to realize the RAG retrieval function.

[0040] The prompt enhancement module is used to combine the knowledge fragments, test instructions, and preset prompt templates to form enhanced prompts. This module maintains a prompt template library and dynamically fills in the templates according to the search results to complete the RAG enhancement process.

[0041] The payload generation module is used to input the enhanced prompts into a pre-trained large language model to generate optimized security test payloads. It encapsulates an LLM API (such as the OpenAI API or a locally deployed LLaMA model) and is responsible for the RAG generation phase.

[0042] Preferably, the system further includes a test execution and feedback module: used to apply the payload to the target system, collect test results, and trigger updates to the knowledge base or adjustments to the retrieval strategy. This module integrates an HTTP request library and a response analyzer, and feeds the results back to the knowledge base's update queue, supporting continuous optimization of the RAG system.

[0043] Example: See Figure 1 This invention discloses a method for optimizing security test payloads based on retrieval enhancement, comprising the following steps: Step S101: Construct a vectorized domain knowledge base We collected Markdown-formatted penetration testing manuals accumulated by the security team, including documents such as "SQL Injection Bypass Techniques Summary.md" and "XX Cloud WAF Bypass Practical Record.md". We used natural language processing tools to parse the documents, identifying titles, paragraphs, and code blocks, and segmented them according to semantic integrity, with each segment's length controlled within 512 tokens. The segments were then input into a pre-trained Sentence-BERT model to generate 768-dimensional vectors, which were stored in the Milvus vector database. Simultaneously, we created an index for each segment: the first-level index was the vulnerability type (e.g., "SQL Injection"), and the second-level index was the adversarial environment (e.g., "Security Dog WAF", "MySQL 5.7").

[0044] Step S102: Receive test instructions and perform real-time retrieval (RAG retrieval phase) The user inputs the command: "Perform an SQL injection test on the target http: / / test.com / login.php and attempt to bypass the possible ModSecurity WAF." The system parses the command and extracts the key semantics "SQL injection" and "ModSecurity". The system performs a search in the vector database: First, it uses HyDE technology to have the LLM generate a hypothetical bypass payload (such as "1' ANDSLEEP(5)--"), and uses the vector of this payload for similarity recall; at the same time, it combines the keyword "ModSecurity" for filtering, and finally recalls the three most relevant knowledge fragments, including a technique about "ModSecurity bypass by annotation obfuscation".

[0045] Step S103: Enhanced prompt word construction (RAG enhancement stage) The retrieved technique fragments are concatenated with the original instructions to form an enhanced prompt: "Refer to the following internal technique: <Technique content>. Based on this technique, generate a time-based blind injection payload that can bypass ModSecurity for the target URL. If the technique is not applicable, reject the generation." This prompt injects the retrieved experiential knowledge into the model input, providing accurate context for subsequent generation.

[0046] Step S104: Generate optimized load (RAG generation stage) The enhanced prompt is input into models such as GPT-5. The model generates a payload based on the technique of "using inline comments / ! / to bypass the rule": http: / / test.com / login.php?user=admin' / *!&* / AND / ** / SLEEP(5)---. This payload uses MySQL inline comments ( / *!...* / ) to replace spaces, which can bypass the detection of spaces under the default rule set of the target ModSecurity.

[0047] Step S105: Execute the test and feedback loop The automated testing tool executed the payload and detected a 5-second response delay, confirming the vulnerability. The system recorded the successful payload and its context in the knowledge base as a new piece of experience for subsequent use, forming a RAG closed loop.

[0048] In one embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a security test load optimization method based on retrieval enhancement generation.

[0049] This invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the security test payload optimization method based on retrieval enhancement generation in the above embodiments.

[0050] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0051] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0052] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for optimizing security test loads based on retrieval enhancement, characterized in that, Includes the following steps: Collect and preprocess experience documents related to security testing to build a vector database. Establish a two-level index in the vector database, which includes a vulnerability type index and an adversarial environment feature index. Receive a test instruction and retrieve knowledge fragments related to the test instruction from the vector database; The knowledge fragments, test instructions, and preset prompt word templates are combined to form enhanced prompt words; The enhanced prompts are input into a pre-trained large language model to generate an optimized security test payload.

2. The method for optimizing a security test load based on retrieval enhancement as described in claim 1, characterized in that, The step of collecting and preprocessing security testing-related experience documents to build a vector database specifically includes: Collect experience documents related to security testing, perform structured parsing and semantic segmentation on the experience documents to obtain several knowledge fragments; The knowledge fragments are input into the embedding model to generate corresponding vector representations; The vector representations and their corresponding knowledge fragments are stored in a vector database, and a two-layer index is established. The first layer of the dual-layer index is a vulnerability type index, and the second layer is an adversarial environment feature index.

3. The method for optimizing security test loads based on retrieval enhancement generation according to claim 2, characterized in that, The adversarial environment features include one or more of the following: WAF vendor, middleware type, database type, and operating system version.

4. The method for optimizing security test loads based on retrieval enhancement as described in claim 1, characterized in that, The step of receiving the test instruction and retrieving knowledge fragments related to the test instruction from the vector database specifically includes: Receive security test instructions input by the user and parse the instructions to extract key semantic features; Based on the key semantic features, a similarity search is performed in the vector database to recall knowledge fragments related to the current test scenario. The search adopts a hybrid search strategy, including vector similarity search and keyword search, and introduces hypothetical document embedding technology.

5. The method for optimizing a security test load based on retrieval enhancement as described in claim 1, characterized in that, The enhanced prompts include adversarial constraint instructions, which instruct the large language model to refuse to generate payloads and indicate knowledge deficiency when the recalled knowledge fragments do not contain information related to the target environment.

6. The method for optimizing security test loads based on retrieval enhancement generation according to claim 1, characterized in that, Also includes: The generated security test payload is applied to the target system for testing. If the test is successful, the successful cases and their corresponding payloads are fed back to the vector database for subsequent retrieval and optimization.

7. The method for optimizing security test loads based on retrieval enhancement as described in claim 1, characterized in that, Also includes: Cache and reuse search results for the same test target or similar context to reduce the overhead of repeated searches.

8. A security test load optimization system based on retrieval enhancement generation, characterized in that, include: The database construction module is used to collect and preprocess experience documents related to security testing, thereby building a vector database. A two-level index is established in the vector database, which includes a vulnerability type index and an adversarial environment feature index. The instruction parsing and retrieval module is used to receive test instructions and retrieve knowledge fragments related to the test instructions from the vector database. The prompt enhancement module is used to combine the knowledge fragments, test instructions, and preset prompt templates to form enhanced prompts; The payload generation module is used to input the enhanced prompt words into a pre-trained large language model to generate an optimized security test payload.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the security test load optimization method based on retrieval enhancement as described in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the security test load optimization method based on retrieval enhancement as described in any one of claims 1-7.

Images