Vulnerability identification method and apparatus based on large language model, and storage medium

Abstract

Provided in the present invention are a vulnerability identification method and apparatus based on a large language model, and a storage medium. The method comprises: acquiring metadata of a device, and vulnerability descriptions; using a large language model to extract key features from the metadata, and using the large language model to extract related vulnerability information from the vulnerability descriptions; using the large language model to match fields of the key features with fields of the related vulnerability information, so as to obtain mapping relationships between the key features and the related vulnerability information; on the basis of the mapping relationships, using the large language model to identify a vulnerability description matching the metadata; and on the basis of the vulnerability description matching the metadata, using the large language model to generate a visualized result. By means of the technical solution in the embodiments of the present invention, the metadata of the device can be effectively analyzed, and the metadata is associated with a vulnerability library, thereby effectively enhancing the passive vulnerability detection and reducing the requirements for intrusive active scanning technology.

Description

A vulnerability identification method, device and storage medium based on large language model Technical Field

[0001] The present invention relates to the fields of data security and vulnerability detection, and in particular to a vulnerability identification method, device and storage medium based on a large language model. Background Art

[0002] OT stands for operational technology, and broadly speaking, it essentially refers to digital technologies used for industrial control. OT assets are digital devices that are part of the OT infrastructure. Devices can be physical or virtual.

[0003] A significant challenge for security operators is identifying OT system vulnerabilities without using active scanning techniques, which can be disruptive and potentially damaging to target systems, impacting performance, availability, and potentially triggering defense mechanisms.

[0004] To address this issue, security operators can employ passive vulnerability detection methods, which include monitoring network traffic and analyzing system logs to identify patterns that may indicate a vulnerability. These techniques rely on observing network communications and device behavior rather than directly interacting with the target system.

[0005] Many devices store critical metadata in different fields and formats, complicating the process of streamlining this information for passive vulnerability detection. For example, some devices may embed their software version in a specific header field, while others may include it in proprietary tags or configuration files. Similarly, identifying details such as operating systems, firmware, and hardware components may be scattered across different metadata fields, making it difficult to effectively consolidate and analyze this information. To effectively detect vulnerabilities, it is crucial to develop methods that can adapt to these inconsistencies and accurately parse relevant metadata from a variety of devices.

[0006] Summary of the Invention

[0007] To solve the above problems, the present invention proposes a vulnerability identification method, device and storage medium based on a large language model to enhance passive vulnerability detection and reduce the need for invasive active scanning technology.

[0008] A vulnerability identification method based on a large language model is proposed in an embodiment of the present invention. The method includes: obtaining raw information, including obtaining device metadata and obtaining vulnerability descriptions from a vulnerability library; extracting key information, including extracting key features from the metadata using a large language model, and extracting relevant vulnerability information from the vulnerability description using the large language model; field matching, including matching the fields of the key features with the fields of the relevant vulnerability information using the large language model to obtain a mapping relationship between the key features and the relevant vulnerability information; vulnerability identification, including identifying the vulnerability description that matches the metadata using the large language model based on the mapping relationship; and report generation, including generating a visualization result based on the vulnerability description that matches the metadata using the large language model. This method implements semantic analysis, decomposition, and matching of different types of metadata and vulnerability libraries, improving compatibility between different data types, establishing more accurate associations between device metadata and known vulnerabilities, and effectively analyzing device metadata to accurately generate vulnerability identification and detection results.

[0009] In one embodiment, vulnerability identification further includes: creating a similarity scoring system based on a large language model; and scoring and ranking the similarities between the metadata and vulnerability descriptions based on the similarity scoring system. The large language model enables semantic analysis of different data, more accurately analyzing the correlations between different data descriptions and accurately matching metadata with vulnerability databases.

[0010] In one embodiment, the method further includes: updating the large language model based on newly acquired metadata and vulnerability descriptions. This enables model learning and updating, enabling more timely and accurate vulnerability identification and detection, and ensuring that detection capabilities remain relevant over time.

[0011] In an embodiment of the present invention, a vulnerability identification device based on a large language model is proposed, comprising: an original information acquisition module configured to obtain device metadata and vulnerability descriptions from a vulnerability library; a key information extraction module configured to extract key features from the metadata using a large language model and extract relevant vulnerability information from the vulnerability description using the large language model; a field matching module configured to match the fields of the key features with the fields of the relevant vulnerability information using the large language model to obtain a mapping relationship between the key features and the relevant vulnerability information; a vulnerability identification module configured to identify the vulnerability description that matches the metadata using the large language model based on the mapping relationship; and a report generation module configured to generate a visualization result based on the vulnerability description that matches the metadata using the large language model. This device implements semantic analysis, decomposition, and matching of different types of metadata and vulnerability libraries, improving the compatibility between different data types, establishing more accurate associations between device metadata and known vulnerabilities, and effectively analyzing device metadata to accurately generate vulnerability identification and detection results.

[0012] In one embodiment, the vulnerability identification module is further configured to: create a similarity scoring system based on a large language model; and use this similarity scoring system to score and rank the similarities between the metadata and vulnerability descriptions. This large language model enables semantic analysis of different data, more accurately analyzing the correlations between different data descriptions and accurately matching metadata with vulnerability databases.

[0013] In one embodiment, the apparatus further includes a model update module configured to update the large language model based on newly acquired metadata and vulnerability descriptions. This enables model learning and updating, enabling more timely and accurate vulnerability identification and detection, and ensuring that detection capabilities remain relevant over time.

[0014] An electronic device proposed in an embodiment of the present invention includes: at least one processor; and a memory coupled to the at least one processor, wherein the memory is used to store instructions, and when the instructions are executed by the at least one processor, the processor executes the method described above.

[0015] An embodiment of the present invention provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed, the method described in any of the above embodiments is executed.

[0016] A computer program product provided in an embodiment of the present invention includes a computer program. When the computer program is executed by a processor, the method described in any one of the above embodiments is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The following drawings are only intended to illustrate and explain the present invention, and do not limit the scope of the present invention.

[0018] FIG1 is a flow chart of a vulnerability identification method based on a large language model according to an embodiment of the present invention.

[0019] FIG2 is a schematic structural diagram of a vulnerability identification device based on a large language model according to an embodiment of the present invention.

[0020] FIG3 is a schematic diagram of an electronic device according to an embodiment of the present invention.

[0021] The following are the descriptions of the reference numerals: DETAILED DESCRIPTION

[0022] In order to have a clearer understanding of the technical features, purposes and effects of the present invention, specific embodiments of the present invention are now described with reference to the accompanying drawings.

[0023] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0024] As used in this application and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not intended to refer to the singular but may include the plural. Generally speaking, the terms "comprises" and "include" only indicate the inclusion of the steps and elements specifically identified, and these steps and elements do not constitute an exclusive list. A method or apparatus may also include other steps or elements.

[0025] Common passive vulnerability detection methods include: Deep packet inspection: Analyzes the contents of network packets for evidence of vulnerable software, misconfigurations, or known attack patterns. Log analysis: Examines system and application logs for signs of suspicious activity or indicators of potential vulnerabilities. Network behavioral analysis: Monitors network traffic patterns to detect anomalies that could indicate a security breach or an ongoing attack. Threat intelligence feeds: Integrates information from external sources, such as vulnerability databases and threat intelligence platforms, to identify potential risks associated with specific devices, software, or configurations.

[0026] By leveraging these passive detection methods, security operators can gain insight into potential vulnerabilities while minimizing the impact on target systems and reducing the risk of triggering defensive countermeasures.

[0027] However, one of the main obstacles facing passive vulnerability detection is reconciling the discrepancy between device-specific, self-describing information and the standardized vulnerability data provided by the National Institute of Standards and Technology (NIST). Devices often report their configurations, software versions, and other identifying details in unique ways, making it difficult to seamlessly match them with vulnerability information in NIST databases such as the National Vulnerability Database (NVD). This gap in data compatibility hinders the accuracy and efficiency of vulnerability detection efforts, necessitating the development of advanced algorithms and technologies to bridge this gap and strengthen cybersecurity defenses.

[0028] Therefore, the embodiment of the present invention provides a more optimized vulnerability identification method, device and storage medium based on a large language model. Among them, the method includes: original information acquisition, including: obtaining metadata of the device, and obtaining vulnerability descriptions of the vulnerability library from the vulnerability library; key information extraction, including: using a large language model to extract key features in the metadata, and using the large language model to extract relevant vulnerability information in the vulnerability description; field matching, using the large language model to match the fields of the key features and the fields of the relevant vulnerability information to obtain a mapping relationship between the key features and the relevant vulnerability information; vulnerability identification, based on the mapping relationship, using the large language model to identify the vulnerability description that matches the metadata; report generation, using the large language model to generate a visualization result based on the vulnerability description that matches the metadata. The technical solution in the embodiment of the present invention can effectively analyze the metadata of the device and associate it with the vulnerability library, effectively enhancing passive vulnerability detection and reducing the need for invasive active scanning technology.

[0029] Figure 1 is a flow chart of a vulnerability identification method based on a large language model according to an embodiment of the present invention. As shown in Figure 1 , the method may include:

[0030] Step S101, original information acquisition, includes: acquiring metadata of the device, and acquiring vulnerability descriptions from the vulnerability library.

[0031] Among them, the vulnerability database can come from the National Vulnerability Database (NVD) and the like.

[0032] The metadata may be in the following forms:

[0033] The vulnerability description can be in the following form:

[0034] In one embodiment, the original information acquisition further includes: preprocessing the metadata and the vulnerability description; the preprocessing includes: cleaning and converting the metadata and the vulnerability description into a format suitable for the large language model.

[0035] Step S102, extracting key information, includes using a large language model to extract key features from the metadata and extracting relevant vulnerability information from the vulnerability description. The large language model performs semantic analysis and decomposition on the metadata and vulnerability description to obtain a combination of features and information encompassing multiple fields.

[0036] Among them, key features can be: software version, operating system, hardware components, etc., and related vulnerability information can be: affected software, version number and known vulnerabilities.

[0037] In one embodiment, key information extraction further includes: marking the key features and the related vulnerability information, converting them into a format suitable for the large language model; removing stop words, punctuation marks, and other irrelevant elements from the key features and the related vulnerability information; and normalizing the key features and the related vulnerability information to standard case and stems. This further normalization of the data enables it to be further recognized and processed by the large language model.

[0038] Step S103 , field matching, uses the large language model to match the fields of the key features and the fields of the relevant vulnerability information to obtain a mapping relationship between the key features and the relevant vulnerability information.

[0039] Among them, the key features and the field names in the relevant vulnerability information are not completely consistent. The two fields with related connotations are matched through the large language model. For example, the affected software in the relevant vulnerability information and the device type in the key features should match each other.

[0040] Step S104 , vulnerability identification, identifying the vulnerability description matching the metadata using the large language model based on the mapping relationship.

[0041] Among them, a large language model is used to match the vulnerability description that best matches the metadata.

[0042] In one embodiment, vulnerability identification further includes: creating a similarity scoring system based on a large language model; and scoring and ranking the similarities between the metadata and vulnerability descriptions based on the similarity scoring system. The large language model analyzes different fields one by one to obtain an evaluation of the relevance between the metadata and each vulnerability description, thereby identifying the vulnerability description that best matches the metadata.

[0043] Step S105 , report generation, using the large language model to generate a visualization result based on the vulnerability description that matches the metadata.

[0044] Among them, a large language model is used to generate natural language reports that can be read by security operators, summarizing the identified vulnerabilities and their potential impacts.

[0045] In one embodiment, the method further includes: step S106, model updating, updating the large language model based on the newly acquired metadata and vulnerability description.

[0046] The large language model is trained and updated using the latest vulnerability descriptions and metadata, enabling it to adapt and improve its relevance over time, ensuring it stays synchronized with the latest vulnerability information.

[0047] FIG2 is a schematic diagram of the structure of a vulnerability identification device based on a large language model according to an embodiment of the present invention. As shown in FIG2 , the device may include:

[0048] The original information acquisition 201 is configured to: acquire metadata of the device and acquire vulnerability descriptions from the vulnerability library.

[0049] Among them, the vulnerability database can come from the National Vulnerability Database (NVD) and the like.

[0050] The metadata may be in the following forms:

[0051] The vulnerability description can be in the following form:

[0052] In one embodiment, the original information module is further configured to: pre-process the metadata and the vulnerability description; the pre-processing includes: cleaning and converting the metadata and the vulnerability description into a format suitable for the large language model.

[0053] Key Information Extraction Module 202 is configured to use a large language model to extract key features from the metadata and to use the large language model to extract relevant vulnerability information from the vulnerability description. The large language model performs semantic analysis and decomposition on the metadata and vulnerability description to obtain a combination of features and information encompassing multiple fields.

[0054] Among them, key features can be: software version, operating system, hardware components, etc., and related vulnerability information can be: affected software, version number and known vulnerabilities.

[0055] In one embodiment, the key information extraction module is further configured to: mark the key features and the related vulnerability information, convert them into a format suitable for the large language model; remove stop words, punctuation marks, and other irrelevant elements from the key features and the related vulnerability information; and normalize the key features and the related vulnerability information to standard case and stems. This further normalization of the data enables it to be further recognized and processed by the large language model.

[0056] The field matching module 203 is configured to use the large language model to match the fields of the key features with the fields of the relevant vulnerability information to obtain a mapping relationship between the key features and the relevant vulnerability information.

[0057] Among them, the key features and the field names in the relevant vulnerability information are not completely consistent. The two fields with related connotations are matched through the large language model. For example, the affected software in the relevant vulnerability information and the device type in the key features should match each other.

[0058] The vulnerability identification module 204 is configured to: identify the vulnerability description matching the metadata using the large language model based on the mapping relationship.

[0059] Among them, a large language model is used to match the vulnerability description that best matches the metadata.

[0060] In one embodiment, the vulnerability identification module is further configured to: create a similarity scoring system based on a large language model; and score and rank the similarities between the metadata and vulnerability descriptions based on the similarity scoring system. By analyzing different fields one by one through the large language model, an evaluation of the relevance between the metadata and each vulnerability description is obtained, thereby identifying the vulnerability description that best matches the metadata.

[0061] The report generation module 205 is configured to generate a visualization result based on the vulnerability description that matches the metadata using the large language model.

[0062] Among them, a large language model is used to generate natural language reports that can be read by security operators, summarizing the identified vulnerabilities and their potential impacts.

[0063] In one embodiment, the apparatus further includes a model updating module 206 configured to update the large language model based on newly acquired metadata and vulnerability descriptions.

[0064] The large language model is trained and updated using the latest vulnerability descriptions and metadata, enabling it to adapt and improve its relevance over time, ensuring it stays synchronized with the latest vulnerability information.

[0065] The present invention also provides an electronic device 300. FIG3 is a schematic diagram of an electronic device 300 according to an embodiment of the present invention. As shown in FIG3 , the electronic device 300 includes a processor 310 and a memory 320. The memory 320 stores instructions, wherein the instructions, when executed by the processor 310, implement the method 100 described above.

[0066] The present invention further provides a computer-readable storage medium having computer instructions stored thereon. When the computer instructions are executed, the method described above is executed.

[0067] The present invention also provides a computer program product, comprising a computer program, which implements the above-mentioned method when executed by a processor.

[0068] Some aspects of the methods and apparatus of the present invention may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may be referred to as "data blocks," "modules," "engines," "units," "components," or "systems." The processor may be one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DAPDs), programmable logic devices (PLCs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, or combinations thereof. In addition, various aspects of the present invention may be embodied as computer products in one or more computer-readable media, the product including computer-readable program code. For example, computer-readable media may include, but are not limited to, magnetic storage devices (e.g., hard disks, floppy disks, tapes, etc.), optical disks (e.g., compact disks (CDs), digital versatile disks (DVDs), etc.), smart cards, and flash memory devices (e.g., cards, sticks, key drives, etc.).

[0069] Flowcharts are used herein to illustrate the operations performed by the methods according to the embodiments of the present application. It should be understood that the preceding operations are not necessarily performed in exact order. Instead, the various steps may be performed in reverse order or simultaneously. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.

[0070] It should be understood that although this specification is described according to various embodiments, not every embodiment contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

[0071] The above description is only an illustrative embodiment of the present invention and is not intended to limit the scope of the present invention. Any equivalent changes, modifications and combinations made by those skilled in the art without departing from the concept and principle of the present invention shall fall within the scope of protection of the present invention.

Claims

1. A vulnerability identification method (100) based on a large language model, characterized in that: The method comprises: Original information acquisition (S101), including: acquiring metadata of the device and acquiring vulnerability description from a vulnerability library; Extracting key information (S102), including: extracting key features in the metadata using a large language model, and extracting relevant vulnerability information in the vulnerability description using the large language model; Field matching (S103), using the large language model to match the field of the key feature with the field of the relevant vulnerability information to obtain a mapping relationship between the key feature and the relevant vulnerability information; Vulnerability identification (S104), identifying the vulnerability description matching the metadata using the large language model based on the mapping relationship; Report generation (S105), using the large language model to generate a visualization result based on the vulnerability description that matches the metadata.

2. The method according to claim 1, characterized in that The original information acquisition further includes: Preprocessing the metadata and the vulnerability description; The preprocessing includes: cleaning and converting the metadata and the vulnerability description into a format suitable for the large language model.

3. The method according to claim 1, characterized in that The key information extraction further includes: Marking the key features and the related vulnerability information, and converting them into a format suitable for the large language model; Deleting stop words, punctuation marks and other irrelevant elements in the key features and the related vulnerability information; Standardize the key features and related vulnerability information to standard case and word stems.

4. The method according to claim 1, characterized in that The vulnerability identification further includes: Create a similarity scoring system based on a large language model; The similarities between the metadata and the vulnerability descriptions are scored and ranked based on the similarity scoring system.

5. The method according to claim 1, characterized in that The method further comprises: Model updating (S106), updating the large language model based on the newly acquired metadata and vulnerability description.

6. A vulnerability identification device (200) based on a large language model, characterized in that: The device comprises: The original information acquisition module (201) is configured to: acquire metadata of the device and acquire vulnerability descriptions of the vulnerability library from the vulnerability library; A key information extraction module (202) is configured to: extract key features from the metadata using a large language model, and extract relevant vulnerability information from the vulnerability description using the large language model; The field matching module (203) is configured to: use the large language model to match the fields of the key features and the Matching the fields of the relevant vulnerability information to obtain a mapping relationship between the key feature and the relevant vulnerability information; A vulnerability identification module (204) is configured to: identify the vulnerability description matching the metadata using the large language model based on the mapping relationship; The report generation module (205) is configured to: generate a visualization result based on the vulnerability description matched with the metadata using the large language model.

7. The device according to claim 6, characterized in that The original information acquisition module is further configured as follows: Preprocessing the metadata and the vulnerability description; The preprocessing includes: cleaning and converting the metadata and the vulnerability description into a format suitable for the large language model.

8. The device according to claim 6, characterized in that The key information extraction module is further configured to: Marking the key features and the related vulnerability information, and converting them into a format suitable for the large language model; Deleting stop words, punctuation marks and other irrelevant elements in the key features and the related vulnerability information; Standardize the key features and related vulnerability information to standard case and word stems.

9. The device according to claim 6, characterized in that The vulnerability identification module is further configured to: Create a similarity scoring system based on a large language model; The similarities between the metadata and the vulnerability descriptions are scored and ranked based on the similarity scoring system.

10. The device according to claim 6, characterized in that The device further comprises: The model updating module (206) is configured to update the large language model based on the newly acquired metadata and vulnerability description.

11. An electronic device (300), comprising: at least one processor (310); as well as A memory (320) coupled to the at least one processor (310), the memory (320) being used to store instructions, which, when executed by the at least one processor (310), causes the processor (310) to perform the method according to any one of claims 1 to 5.

12. A computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed, execute the method according to any one of claims 1 to 5.

13. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 5 when being executed by a processor.

Images