A vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework
Patent Information
- Application Number
- CN202611178405.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-05
- Publication Date
- 2026-10-30
AI Technical Summary
然而，通用大模型对于漏洞利用领域的专业知识的储备往往存在不足，在处理漏洞类型、漏洞利用条件等专业知识时，容易理解错误而生成无效的利用方案
[0021]（1）本发明提供的一种基于混合检索增强框架的漏洞利用方案生成方法，通过构建综合性漏洞知识库，为大模型实时补充漏洞利用领域的专业知识，有效避免了通用大模型因知识储备不足而生成无效利用方案的问题，提高了漏洞利用方案的准确性和实用性；
Smart Images
Figure CN123020171A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and more specifically, to a method for generating vulnerability exploitation schemes based on a hybrid retrieval enhancement framework. Background Technology
[0002] In today's era of accelerated digital transformation, cyberspace has become an indispensable part of national critical infrastructure operation, economic and social development, and people's daily lives. However, this has brought with it increasingly severe and complex cybersecurity threats. According to authoritative statistics, the number of cyberattacks worldwide is growing exponentially, and attack methods are becoming increasingly diversified and intelligent, ranging from traditional viruses and Trojans to advanced persistent threats (APTs) and ransomware, posing a serious threat to the information security of enterprises and individuals. Against this backdrop, penetration testing, as a crucial means of proactively discovering and patching system security vulnerabilities, is becoming increasingly important. The generation of vulnerability exploitation schemes is a key step in the penetration testing process, directly affecting the effectiveness and efficiency of the test.
[0003] Traditional exploit generation heavily relies on the experience of professionals, requiring manual tasks such as target environment analysis, vulnerability discovery and matching, and exploit generation. In today's increasingly complex network environment with an explosive growth in the number of vulnerabilities, manual exploitation is becoming increasingly inefficient, with rising time and manpower costs, and struggling to cope with large-scale, complex, and ever-changing network environments. While the emergence of Large Language Models (LLMs) has provided new ideas for exploit generation and significantly reduced reliance on human experience, general-purpose LLMs often lack sufficient expertise in the exploitation domain. They are prone to misunderstandings when dealing with vulnerability types and exploitation conditions, leading to invalid exploits. Furthermore, the knowledge updates of LLMs are often lagging, failing to adapt to new exploit requirements in a timely manner. Therefore, generated exploits may lose their application value due to a lack of new knowledge. Summary of the Invention
[0004] The purpose of this invention is to provide a vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework, which can dynamically supplement the model with professional knowledge related to vulnerability exploitation, the latest vulnerability intelligence and typical cases by searching external authoritative knowledge bases in real time.
[0005] The technical solution of this invention is as follows:
[0006] This application provides a method for generating vulnerability exploitation schemes based on a hybrid retrieval enhancement framework, which includes the following steps:
[0007] S1. Obtain multi-source heterogeneous vulnerability knowledge data, extract and integrate the multi-source heterogeneous vulnerability knowledge data, and build a vulnerability knowledge base based on the integration results using the Neo4j graph database.
[0008] S2. Vector embedding of natural language query content to transform it into structured query vectors, and at the same time, transformation of data in the vulnerability knowledge base into query vectors that can be queried.
[0009] S3. Calculate the distance between vectors to compare similarity, construct a hybrid retrieval enhancement mechanism based on the similarity comparison results, and use the hybrid retrieval enhancement mechanism to comprehensively evaluate the retrieved knowledge in order to output the corresponding knowledge and the best graph node;
[0010] S4. Using an intelligent agent framework and a local deployment model, the corresponding knowledge output in step S3 is expanded to obtain the optimal proximity relationship of the graph nodes, a retrieval-enhanced intelligent agent framework is constructed, and a vulnerability exploitation scheme is generated.
[0011] Furthermore, the aforementioned multi-source heterogeneous vulnerability knowledge data includes five types of data sources: ATT&CK, CAPEC, CVE, CWE, and Exploit-DB.
[0012] Furthermore, the above-mentioned extraction and integration of multi-source heterogeneous vulnerability knowledge data includes: building data extraction programs for five types of data sources, extracting 12 types of entities and 17 types of relationships, and storing them in a unified format using the "entity-attribute-relationship structure".
[0013] Furthermore, the above entities include entity types and corresponding entity IDs, the above attributes contain a detailed description of the stored entity, and the above relationship structure is defined as a "start point-relationship-end point" structure.
[0014] Further, step S3 includes:
[0015] Similarity scores are obtained by calculating the distance between vectors, and the similarity scores are logarithmically converted and normalized using an inverse proportional normalization formula.
[0016] Similarity comparison is performed based on the normalization results. Based on the similarity comparison results and the importance of the candidate graph nodes in the graph, a hybrid retrieval mechanism of "hypothetical document embedding + semantic similarity + graph node importance + RAG re-ranking" is constructed.
[0017] The hybrid retrieval enhancement mechanism comprehensively evaluates the retrieval results to output relevant knowledge and optimal graph nodes.
[0018] Furthermore, step S3 also includes: optimizing the search results using hypothetical document embedding technology and RAG reordering technology; wherein, the hypothetical document embedding technology includes: for relatively short queries with few keywords, using a general LLM to generate an answer as a "hypothetical document", and using this hypothetical document as a new query to match the real document; the RAG reordering technology includes: performing a secondary sorting on the initially retrieved candidate content through a reordering model, and selecting high-value nodes based on the secondary sorting results.
[0019] Furthermore, in step S4, the aforementioned agent framework is the lightweight agent framework Smolagents; the aforementioned local deployment model is the Qwen3.5-35B-A3B model.
[0020] Compared with the prior art, the present invention has at least the following advantages or beneficial effects:
[0021] (1) The present invention provides a vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework. By constructing a comprehensive vulnerability knowledge base, it provides real-time supplementation of professional knowledge in the field of vulnerability exploitation for large models, effectively avoiding the problem of generating invalid exploitation schemes due to insufficient knowledge reserves in general large models, and improving the accuracy and practicality of vulnerability exploitation schemes.
[0022] (2) This invention effectively integrates vulnerability knowledge scattered across multiple data sources such as ATT&CK, CAPEC, CVE, CWE, and Exploit-DB, and constructs a unified vulnerability knowledge graph, which solves the problem of scattered and inconsistent formats of existing vulnerability exploitation knowledge and provides high-quality knowledge support for the generation of vulnerability exploitation schemes.
[0023] (3) The present invention adopts a hybrid retrieval mechanism of “hypothesis document embedding + semantic similarity + graph node importance + RAG reordering”, which can comprehensively measure the retrieved knowledge, select the most valuable graph nodes, significantly improve the accuracy and efficiency of retrieval, and provide a reliable data foundation for intelligent agents to generate high-quality vulnerability exploitation schemes;
[0024] (4) The invention adopts the lightweight intelligent agent framework of Smolagents and the high-performance model of Qwen3.5-35B-A3B with a small number of parameters. While ensuring the system performance, it reduces the hardware requirements for system deployment and operation, enabling the invention to run on consumer-grade devices and has a wider range of application prospects.
[0025] (5) Through graph relationship extension technology, a complete vulnerability generation scheme can be constructed starting from the retrieved nodes, which not only improves the comprehensiveness and systematicness of the scheme, but also provides more guiding operational suggestions for penetration testers. Attached Figure Description
[0026] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.
[0027] Figure 1 This is a flowchart illustrating the steps of a vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework according to the present invention.
[0028] Figure 2 This is a schematic structural block diagram of a vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework according to the present invention. Detailed Implementation
[0029] Terminology Explanation:
[0030] ATT&CK (Adversarial Tactics Techniques and Common Knowledge) is a systematic knowledge base of cyberattack behaviors developed by MITRE Corporation in 2013.
[0031] CAPEC (Common Attack Pattern Enumeration and Classification) is a knowledge base of attack patterns initiated by the U.S. Department of Homeland Security and maintained by MITRE.
[0032] CVE (Common Vulnerabilities and Exposures) is a globally unified vulnerability numbering standard system initiated by MITRE Corporation in 1999.
[0033] CWE (Common Weakness Enumeration) is a software and hardware security vulnerability classification system maintained by the MITRE organization.
[0034] Exploit-DB (Exploit Database) is the world's largest publicly available exploit code repository, maintained by Offensive Security (the company that founded the OSCP certification).
[0035] HyDE (Hypothetical Document Embeddings) is an innovative technology that enhances the performance of Retrieval Augmentation (RAG) systems. Its core idea is to optimize the retrieval process by generating hypothetical documents that represent the "ideal answer".
[0036] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.
[0037] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.
[0038] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.
[0039] It should be noted that, in this document, the term "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0040] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the various embodiments and features described below can be combined with each other.
[0041] Example
[0042] Please see Figure 1-2 This application provides a method for generating vulnerability exploitation schemes based on a hybrid retrieval enhancement framework, comprising the following steps:
[0043] S1. Obtain multi-source heterogeneous vulnerability knowledge data, extract and integrate the multi-source heterogeneous vulnerability knowledge data, and build a vulnerability knowledge base based on the integration results using the Neo4j graph database.
[0044] S2. Vector embedding of natural language query content to transform it into structured query vectors, and at the same time, transformation of data in the vulnerability knowledge base into query vectors that can be queried.
[0045] S3. Calculate the distance between vectors to compare similarity, construct a hybrid retrieval enhancement mechanism based on the similarity comparison results, and use the hybrid retrieval enhancement mechanism to comprehensively evaluate the retrieved knowledge in order to output the corresponding knowledge and the best graph node;
[0046] S4. Using an intelligent agent framework and a local deployment model, the corresponding knowledge output in step S3 is expanded to obtain the optimal proximity relationship of the graph nodes, a retrieval-enhanced intelligent agent framework is constructed, and a vulnerability exploitation scheme is generated.
[0047] As a preferred implementation method, multi-source heterogeneous vulnerability knowledge data includes five types of data sources: ATT&CK, CAPEC, CVE, CWE, and Exploit-DB.
[0048] As a preferred implementation method, the extraction and integration of multi-source heterogeneous vulnerability knowledge data includes: building data extraction programs for five types of data sources, extracting 12 types of entities and 17 types of relationships, and storing them in a unified format using an "entity-attribute-relationship structure".
[0049] It should be noted that currently, publicly available knowledge in the field of vulnerability exploitation is scattered across multiple vulnerability knowledge data sources such as ATT&CK, CAPEC, CVE, CWE, and Exploit-DB. The vulnerability entities and file formats described by different frameworks vary considerably, necessitating the effective integration of this multi-source heterogeneous knowledge. In the embodiments of this invention, data extraction programs are constructed for each of the five types of data sources, and 12 types of entities (such as Vulnerability, Weakness, Exploit, etc.) and 17 types of relationships (such as HAS_WEAKNESS, HAS_EXPLOIT, etc.) are extracted from them. In actual storage, a unified entity-attribute-relation structure is used for storage to ensure format alignment. Entities only contain the entity type and the corresponding entity ID (such as CVE number, Exploit number, etc.), while relationships are defined as a head-relation-tail structure (such as CVE-2017-0144, HAS_EXPLOIT, Exploit-41891). Attributes are used to store detailed descriptions of entities, such as detailed descriptions of CVEs. Based on this, the previously multi-source heterogeneous data is unified, and an integrated vulnerability knowledge architecture is constructed. The Neo4j graph database is used for vulnerability knowledge base storage, and all extracted entities and relationships are imported into the Neo4j graph database using the py2neo library.
[0050] In a preferred implementation, the entity includes the entity type and the corresponding entity ID, the attribute contains a detailed description of the stored entity, and the relation structure is defined as a "start point-relationship-end point" structure.
[0051] It should be noted that the vulnerability graph database constructed in step S1 belongs to structured knowledge, while queries initiated by humans are often in natural language, belonging to unstructured knowledge. Therefore, the first step is to embed the query content into vectors, transforming it into structured query vectors. Correspondingly, the vulnerability knowledge base constructed earlier should also be transformed into a queryable vector form. To this end, the entity and relation content is first formatted to adapt to the subsequent vector embedding process. Specifically, we define entities as:
[0052] [ENTITY] ID: <id>Name: <name>Type: <type>Description: <description>...
[0053] The relationship is defined as follows:
[0054] [RELATION](<head_type> )—[ <rel> ]→ <tail>(tail_type)
[0055] The vector embedding process employs the Sentence-BERT (SBERT) model, which efficiently maps text data into fixed-dimensional semantic vectors through a Siamese network structure. Specifically, this embodiment of the invention uses the lightweight and efficient all-MiniLM-L6-v2 model from the SBERT series, which maps the input text into a 384-dimensional vector space, suitable for tasks such as semantic search and text similarity calculation. Furthermore, this invention uses the FAISS (Facebook AI SimilaritySearch) vector database to store a large amount of vector data in the knowledge base; the indexing method uses the IndexFlatL2 index.
[0056] In a preferred embodiment, step S3 includes:
[0057] Similarity scores are obtained by calculating the distance between vectors, and the similarity scores are logarithmically converted and normalized using an inverse proportional normalization formula.
[0058] Similarity comparison is performed based on the normalization results. Based on the similarity comparison results and the importance of the candidate graph nodes in the graph, a hybrid retrieval mechanism of "hypothetical document embedding + semantic similarity + graph node importance + RAG re-ranking" is constructed.
[0059] The hybrid retrieval enhancement mechanism comprehensively evaluates the retrieval results to output relevant knowledge and optimal graph nodes.
[0060] Here, the L2 distance (Euclidean distance) between vectors is calculated to characterize the similarity between vectors. sum vector The specific formula for the L2 distance between them is:
[0061]
[0062] Obviously, The smaller the value, the more similar the two vectors are. The larger the vector size, the greater the semantic difference between the two vectors. Based on this, a FAISS index file for storing knowledge base vectors was successfully constructed for subsequent query processes. After constructing the vector index, a formal query was initiated, and the query text content was also converted into a 384-dimensional vector using SBERT. Then, L2 distance was used for similarity comparison. Since the range of L2 distance is... In order to better characterize the similarity score It needs to be normalized using an inverse proportional normalization formula, as follows:
[0063]
[0064] Besides using vector similarity to determine valuable information, the importance of different nodes in the graph can also be considered. A higher node importance in the graph indicates a higher universality of the vulnerability exploitation knowledge it represents, meaning it is likely to have higher value as retrieved information. Therefore, based on vector similarity calculations, the PageRank value of graph nodes is calculated to measure their importance. In this invention, the PageRank algorithm specifically means that an entity pointed to by multiple important nodes will have increased importance. In practice, PageRank values can be automatically calculated using the Graph Data Science (GDS) library in Neo4j. This calculation is offline, allowing the PageRank values of vulnerability knowledge base nodes to be calculated and saved before initiating a query for online use. Furthermore, since the range of PageRank values automatically calculated by GDS fluctuates significantly, data normalization is performed: first, the scores are logarithmically converted to handle extremely imbalanced data; then, a min-max normalization method is used, with the specific formula as follows:
[0065]
[0066] in, and This represents the maximum and minimum values in a set of data.
[0067] Finally, we can weight the two scores (similarity) above to obtain the final comprehensive evaluation score. For the query vector... and node vectors Similarity between and the PageRank score of nodes in the graph Then, the vector of each node can be calculated using the following formula. Regarding query vectors Overall rating:
[0068]
[0069] in, This is the weight parameter, with a default value of 0. .
[0070] As a preferred implementation, step S3 further includes: optimizing the search results using hypothetical document embedding technology and RAG reordering technology; wherein, hypothetical document embedding technology includes: for relatively short queries with few keywords, using a general LLM to generate an answer as a "hypothetical document", and using this hypothetical document as a new query to match the real document; RAG reordering technology includes: performing a secondary sorting on the initially retrieved candidate content through a reordering model, and selecting high-value nodes based on the secondary sorting results.
[0071] It should be noted that HyDE, the hypothetical document embedding technique, is a pre-retrieval enhancement strategy. For relatively short queries with few keywords, it uses a general LLM to generate an answer as a "hypothetical document." The content of this document may not be entirely accurate, but it can appropriately expand the short query. Using this hypothetical document as a new query, it matches the actual document, thus achieving better retrieval results. The core of RAG reranking technology lies in re-ranking the initially retrieved candidate content using a reranking model, achieving a more refined ranking. In this invention, this means further re-ranking the nodes with the highest combined scores of vector similarity and graph node importance obtained earlier using a reranking model. Specifically, this invention uses the open-source model BGE-reranker, which re-ranks 50 candidate nodes to obtain the 10 nodes with the highest value after refined ranking.
[0072] As a preferred implementation, in step S4, the agent framework is the lightweight agent framework Smolagents; the local deployment model is the Qwen3.5-35B-A3B model.
[0073] It should be noted that the lightweight agent framework smolagents is an agent development library officially launched by HuggingFace, which is simple to implement and highly applicable; the Qwen3.5-35B-A3B model significantly improves running speed and efficiency with its lower number of activation parameters (3 billion parameters) and surpasses the previous generation's flagship model of 235 billion parameters.
[0074] As a preferred implementation, in step S4, in order to further enhance the effect of RAG retrieval, after the agent successfully retrieves the corresponding knowledge (in the form of nodes), it is necessary to expand the graph relationship to obtain the neighbor relationship of the node. For example, for the searched CVE node, HAS_REFERENCE can greatly enrich the content of RAG retrieval.
[0075] It is understood that the structure shown in the figure is for illustrative purposes only. A vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework may include more or fewer components than those shown in the figure, or have a different configuration. The components shown in the figure can be implemented in hardware, software, or a combination thereof.
[0076] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.
[0077] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within this application. No reference numerals in the claims should be construed as limiting the scope of the claims.< / tail> < / rel> < / description> < / type> < / name> < / id>
Claims
1. A method for generating vulnerability exploitation schemes based on a hybrid retrieval enhancement framework, characterized in that, Includes the following steps: S1. Obtain multi-source heterogeneous vulnerability knowledge data, extract and integrate the multi-source heterogeneous vulnerability knowledge data, and build a vulnerability knowledge base based on the integration results using the Neo4j graph database. S2. Vector embedding of natural language query content to transform it into structured query vectors, and at the same time, transformation of data in the vulnerability knowledge base into query vectors that can be queried. S3. Calculate the distance between vectors to compare similarity, construct a hybrid retrieval enhancement mechanism based on the similarity comparison results, and use the hybrid retrieval enhancement mechanism to comprehensively evaluate the retrieved knowledge in order to output the corresponding knowledge and the best graph node; S4. Using an intelligent agent framework and a local deployment model, the corresponding knowledge output in step S3 is expanded to obtain the optimal proximity relationship of the graph nodes, a retrieval-enhanced intelligent agent framework is constructed, and a vulnerability exploitation scheme is generated.
2. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 1, characterized in that, The multi-source heterogeneous vulnerability knowledge data includes five types of data sources: ATT&CK, CAPEC, CVE, CWE, and Exploit-DB.
3. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 2, characterized in that, The extraction and integration of multi-source heterogeneous vulnerability knowledge data includes: building data extraction programs for five types of data sources, extracting entities and relationships from them, and storing them in a unified format using an "entity-attribute-relationship structure".
4. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 3, characterized in that, The entity includes the entity type and the corresponding entity ID, the attribute contains a detailed description of the stored entity, and the relationship structure is defined as a "start point-relationship-end point" structure.
5. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 4, characterized in that, Step S3 includes: Similarity scores are obtained by calculating the distance between vectors, and the similarity scores are logarithmically converted and normalized using an inverse proportional normalization formula. Similarity comparison is performed based on the normalization results. Based on the similarity comparison results and the importance of the candidate graph nodes in the graph, a hybrid retrieval mechanism of "hypothetical document embedding + semantic similarity + graph node importance + RAG re-ranking" is constructed. The hybrid retrieval enhancement mechanism comprehensively evaluates the retrieval results to output relevant knowledge and optimal graph nodes.
6. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 5, characterized in that, It also includes: optimizing the search results using hypothetical document embedding technology and RAG reordering technology; wherein, the hypothetical document embedding technology includes: for relatively short queries with few keywords, using a general LLM to generate an answer as a "hypothetical document", and using this hypothetical document as a new query to match the real document; the RAG reordering technology includes: performing a secondary sorting on the initially retrieved candidate content through a reordering model, and selecting high-value nodes based on the secondary sorting results.
7. The vulnerability exploitation scheme generation method based on a hybrid retrieval enhancement framework as described in claim 1, characterized in that, In step S4, the agent framework is the lightweight agent framework Smolagents; the local deployment model is the Qwen3.5-35B-A3B model.