├── LICENSE ├── README.md ├── README_zh.md ├── dataset_example.md ├── examples ├── result_extract_custom_example.py └── result_extract_standard_example.py ├── resources ├── logo.jpg ├── logo.png ├── overview.jpg └── overview.png └── submission_example.json /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2024 CS-EVAL 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 |

2 | 3 |

4 | 🌐 Website | 🤗 Hugging Face • 🤖️ ModelScope
English | 中文 5 |

6 | CS-Eval is a comprehensive evaluation toolkit for fundamental cybersecurity models or large language models' cybersecurity ability, encompassing 11 major cybersecurity categories, 42 subdomains, featuring 4,369 assessment items across multiple-choice, true/false, and knowledge extraction questions. It delivers a balanced mix of knowledge-oriented and practice-focused evaluation tasks. The platform empowers users to conduct self-assessments and offers leaderboards across various subdomains, fostering competitive benchmarking and performance insights. 7 | 8 | 9 | 10 | 11 | 12 | ## News 13 | 14 | - **[2024.05.31]** CS-Eval has been released, and users are now able to submit evaluations on the website independently. 🎉🎉🎉 15 | - **[2024.03.29]** The CS-Eval dataset has been jointly constructed and completed. ✅✅✅ 16 | 17 | 18 | 19 | ## Table of Contents 20 | 21 | - [Leaderboard](#leaderboard) 22 | 23 | - [Data](#data) 24 | - [CS-Eval Usage Steps](#cs-eval-usage-steps) 25 | - [How to Submit](#how-to-submit) 26 | - [Licenses](#licenses) 27 | - [Citation](#citation) 28 | - [Disclaimer](#disclaimer) 29 | 30 | 31 | 32 | ## Leaderboard 33 | 34 | Here are the accuracies obtained when evaluating industry-leading models upon our initial release. Please refer to our official platform's Leaderboard for the latest community rankings and also pay attention to rankings within different subdomains. Note that subtle differences may exist in the results for the same model due to variations in its generation config. 35 | 36 | | Model | Overall Score | AI & Cybersecurity | Business Continuity & Emergency Response & Recovery | Supply Chain Security | Cryptography Techniques & Key Management | Infrastructure Security | Threat Detection & Prevention | Secure Architecture Design | Data Security & Privacy Protection | Vulnerability Management & Penetration Testing | System Security & Software Security Fundamentals | Access Control & Identity Management | Chinese Questions | English Questions | 37 | | ------------------------ | ------------- | ------------------ | --------------------------------------------------- | --------------------- | ---------------------------------------- | ----------------------- | ----------------------------- | -------------------------- | ---------------------------------- | ---------------------------------------------- | ------------------------------------------------ | ------------------------------------ | ----------------- | ----------------- | 38 | | GPT4-8K | 87.57 | 91.58 | 84.28 | 89.30 | 86.51 | 88.83 | 85.21 | 83.90 | 86.90 | 89.63 | 90.00 | 86.56 | 87.96 | 82.19 | 39 | | GPT3.5-Turbo-16K | 80.59 | 80.69 | 81.27 | 88.96 | 69.59 | 83.17 | 79.52 | 76.59 | 82.14 | 80.71 | 80.00 | 78.31 | 80.62 | 80.14 | 40 | | Qwen-14B-Chat | 79.04 | 87.13 | 78.60 | 87.63 | 68.49 | 81.33 | 79.67 | 74.15 | 76.68 | 77.80 | 77.00 | 78.89 | 79.99 | 65.41 | 41 | | Qwen1.5-14B-Chat | 76.66 | 78.71 | 70.23 | 81.27 | 76.13 | 78.00 | 77.53 | 70.73 | 77.58 | 75.77 | 75.33 | 77.59 | 76.68 | 75.68 | 42 | | Qwen1.5-MoE-A2.7B-Chat | 74.63 | 74.75 | 72.24 | 81.94 | 73.50 | 71.88 | 76.61 | 68.78 | 70.24 | 74.80 | 74.33 | 79.50 | 75.99 | 55.14 | 43 | | Baichuan2-13B-Chat | 73.92 | 76.24 | 73.91 | 80.27 | 60.09 | 76.50 | 76.94 | 71.71 | 75.69 | 70.55 | 70.67 | 73.90 | 73.79 | 75.34 | 44 | | 360Zhinao-7B-Chat-4K | 66.37 | 71.29 | 66.33 | 70.00 | 51.04 | 66.78 | 68.63 | 68.78 | 65.02 | 64.78 | 67.67 | 68.14 | 66.68 | 61.99 | 45 | | Mistral-7B-Instruct-v0.2 | 65.93 | 69.31 | 63.67 | 72.76 | 57.78 | 70.43 | 64.40 | 62.44 | 63.44 | 63.71 | 63.67 | 69.54 | 66.01 | 63.36 | 46 | | Yi-6B-Chat | 65.27 | 65.84 | 59.67 | 72.76 | 68.80 | 64.84 | 63.85 | 60.00 | 62.85 | 64.68 | 63.00 | 69.98 | 65.58 | 59.93 | 47 | | ChatGLM3-6B | 57.33 | 65.35 | 56.67 | 68.44 | 47.78 | 59.87 | 61.47 | 61.46 | 57.71 | 50.81 | 50.33 | 55.26 | 57.14 | 59.25 | 48 | | SecGPT-13B | 47.34 | 40.59 | 45.33 | 59.14 | 41.54 | 47.60 | 47.34 | 45.85 | 43.08 | 46.77 | 46.00 | 53.15 | 48.45 | 31.85 | 49 | | Llama-2-13b-chat-hf | 38.08 | 38.12 | 39.13 | 30.43 | 34.11 | 37.67 | 39.00 | 37.07 | 35.52 | 38.57 | 33.33 | 47.60 | 38.40 | 32.88 | 50 | 51 | 52 | 53 | ## Data 54 | 55 | #### Download 56 | 57 | - Method 1: Download or load on [Hugging Face](https://huggingface.co/datasets/cseval/cs-eval): 58 | 59 | - Download data directly: 60 | 61 | ``` 62 | wget https://huggingface.co/datasets/cseval/cs-eval/resolve/main/cs-eval-questions.zip 63 | ``` 64 | 65 | - Load dataset using Hugging Face datasets: 66 | 67 | ``` 68 | from datasets import load_dataset 69 | dataset=load_dataset(r"cseval/cs-eval") 70 | 71 | print(dataset['{test}'][0]) 72 | ``` 73 | 74 | - Method 2: Download on [ModelScope](https://modelscope.cn/datasets/cseval/cs-eval/summary): 75 | 76 | - Download data directly: 77 | 78 | ``` 79 | git clone https://www.modelscope.cn/datasets/cseval/cs-eval.git 80 | ``` 81 | 82 | - Load dataset using Model Scope SDK: 83 | 84 | ``` 85 | from modelscope.msdatasets import MsDataset 86 | ds = MsDataset.load('cseval/cs-eval') 87 | ``` 88 | 89 | 90 | 91 | 92 | ## CS-Eval Usage Steps 93 | 94 | 1. Download the CS-Eval evaluation data from either Hugging Face or ModelScope. 95 | 2. Adapt the model inference format. 96 | 3. Conduct model inference on the CS-Eval evaluation dataset. 97 | 4. Format the inference results according to the specified submission guidelines. 98 | 5. Submit the model results to the CS-Eval platform. 99 | 6. Obtain the evaluation results on the platform. 100 | 7. Decide whether to opt into public leaderboard. 101 | 102 | 103 | 104 | ## How to Submit 105 | 106 | You need to convert the organized model inference results into a JSON file encoded in UTF-8 and format it according to the following example. 107 | ``` 108 | ## Example 109 | [ 110 | { 111 | "question_id": "1", 112 | "answer": "A" 113 | }, 114 | { 115 | "question_id": "123", 116 | "answer": "对" 117 | }, 118 | { 119 | "question_id": "1234", 120 | "answer": "是否涉及漏洞:是\n漏洞号:CVE-2024-22891\n影响的产品及版本:Nteract v.0.28.0" 121 | } 122 | ] 123 | ``` 124 | 125 | In this example, question_id refers to the question number, and answer contains the processed model output. 126 | 127 | 128 | 129 | Please note: 130 | 131 | - For multiple-choice questions, the correct answer option(s) can typically be extracted directly from the model's generated result using regular expressions. 132 | - In the case of multiple-answer questions, regular expressions can similarly be used to extract multiple correct answer options from the model's output. 133 | - For true/false questions, if the question instructions require a specific answer format, the judgment result is usually taken from the beginning or end of the model's output. 134 | - For knowledge extraction tasks, where the question specifies a particular response format, use the raw text output from the model inference directly. 135 | 136 | 137 | 138 | When you regularize multiple-choice questions, you can quickly locate multiple-choice questions by filtering the following keywords in the dataset prompt. 139 | 140 | ``` 141 | "单选题:" 142 | "多选题:" 143 | "Single-choice question:" 144 | ``` 145 | 146 | 147 | 148 | ## Licenses 149 | 150 | [![MIT license](https://img.shields.io/badge/License-MIT-blue.svg)](https://lbesson.mit-license.org/) 151 | 152 | This project adheres to the [MIT License](https://lbesson.mit-license.org/). 153 | 154 | [![CC BY-NC-SA 4.0](https://img.shields.io/badge/License-CC%20BY--NC--SA%204.0-lightgrey.svg)](http://creativecommons.org/licenses/by-nc-sa/4.0/) 155 | 156 | The CS-Eval dataset adheres to the [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-nc-sa/4.0/). 157 | 158 | 159 | 160 | ## Citation 161 | 162 | If you utilize our dataset in your research or technical reports, please ensure proper citation. 163 | 164 | ```bibtex 165 | @inproceedings{Yu2024CSEvalAC, 166 | title={CS-Eval: A Comprehensive Large Language Model Benchmark for CyberSecurity}, 167 | author={Zhengmin Yu and Jiutian Zeng and Siyi Chen and Wenhan Xu and Dandan Xu and Xiangyu Liu and Zonghao Ying and Nan Wang and Yuan Zhang and Min Yang}, 168 | year={2024}, 169 | url={https://api.semanticscholar.org/CorpusID:274234403} 170 | } 171 | ``` 172 | 173 | 174 | 175 | ## Disclaimer 176 | 177 | Our platform and its affiliated entities consistently adhere to principles of legality, compliance, positivity, and health, dedicated to promoting the research and application of large language models in the field of cybersecurity to enhance protective capabilities. To prevent any potential misunderstanding of the content on this platform, we hereby issue the following statement: 178 | 179 | 1. Legitimate Purposes: All information, resources, tools, and services we provide are intended to facilitate lawful and beneficial activities in the cybersecurity sector, including scientific research, technological innovation, risk assessment, and the formulation of defensive strategies using large models. We firmly oppose any utilization of large language models for illegal activities, infringement, or compromising cybersecurity. 180 | 1. Non-Inducement: This platform strictly prohibits any content that incites or encourages others to engage in cyberattacks, intrusions, disruptions, or unauthorized data acquisition. We emphasize that all content related to large language model cybersecurity evaluation sets aims to advance industry development, provide cybersecurity system evaluations, and facilitate technical exchanges, devoid of any elements that induce, encourage, or imply malicious attacks. 181 | 1. Non-Malicious Attack Education: We explicitly state that our provided content does not involve teaching, demonstrating, or guiding techniques for malicious cyberattacks. All discussions involving offensive actions are strictly confined within the realms of legitimate cybersecurity drills, vulnerability research, and risk assessments, aimed at enhancing defensive capabilities rather than offensive purposes. 182 | 1. User Responsibility: Users must strictly abide by relevant laws and regulations when using our platform's services and are prohibited from utilizing platform resources for any illegal, infringing, or cybersecurity-compromising activities. In the event of user violations, our platform reserves the right to take measures including but not limited to warnings, service suspension, account banning, and the pursuit of legal responsibility. 183 | 1. Disclaimer: While we strive to ensure the accuracy, legality, and appropriateness of our platform's content, users are solely responsible for any direct or indirect losses incurred from their own actions during usage, including legal disputes, property loss, data breaches, reputational harm, etc. Neither our platform nor its affiliated entities assume any legal liability. Users should assess and bear all risks associated with using platform resources themselves. 184 | 185 | 186 | 187 | We sincerely call upon all users to jointly maintain a sound order in the cybersecurity domain, employing large model technologies and related resources legally, rationally, and responsibly. The final interpretation right of this disclaimer resides with our platform, and changes, if any, will not be separately notified. 188 | 189 | -------------------------------------------------------------------------------- /README_zh.md: -------------------------------------------------------------------------------- 1 |

2 | 3 |

4 | 🌐 评测网站 | 🤗 Hugging Face • 🤖️ ModelScope
English | 中文 5 |

6 | CS-Eval 是网络安全基础模型或大模型网络安全能力的综合评测套件,覆盖了11个网络安全大类领域、42个子类领域的4369个多项选择题、判断题、知识抽取题,提供偏知识型和偏实战型的综合评估任务。平台支持用户自主评测,并提供不同子领域的排行。 7 | 8 | 9 | 10 | ## 更新 11 | 12 | - **[2024.05.31]** CS-Eval已正式发布,用户可自主在网站提交评估。🎉🎉🎉 13 | 14 | - **[2024.03.29]** CS-Eval数据集已联合构建完成。✅✅✅ 15 | 16 | 17 | 18 | ## 目录 19 | 20 | - [排行榜](#排行榜) 21 | 22 | - [数据](#数据) 23 | - [CS-Eval使用步骤](#CS-Eval使用步骤) 24 | - [如何提交](#如何提交) 25 | - [Licenses](#licenses) 26 | - [引用](#引用) 27 | - [免责声明](#免责声明) 28 | 29 | 30 | 31 | ## 排行榜 32 | 33 | 以下是我们在初次公开发布之际,对业界一系列前沿模型所进行的精度评估数据。请持续关注CS-Eval官方平台Leaderboard,以便及时获取社区内最新的排名动态。同时,我们也详尽提供了针对各细分应用领域的专项排行榜。鉴于模型推理过程中生成参数设定的多样性,即使是同一模型,在实际运行后所产生的最终表现亦可存在微小的差异。 34 | 35 | | 模型名称 | 综合得分 | AI与网络安全 | 业务连续性与应急响应恢复 | 供应链安全 | 加密技术与密钥管理 | 基础设施安全 | 威胁检测与预防 | 安全架构设计 | 数据安全和隐私保护 | 漏洞管理与渗透测试 | 系统安全及软件安全基础 | 访问控制与身份管理 | 中文题 | 英文题 | 36 | | ------------------------ | -------- | ------------ | ------------------------ | ---------- | ------------------ | ------------ | -------------- | ------------ | ------------------ | ------------------ | ---------------------- | ------------------ | ------ | ------ | 37 | | GPT4-8K | 87.57 | 91.58 | 84.28 | 89.30 | 86.51 | 88.83 | 85.21 | 83.90 | 86.90 | 89.63 | 90.00 | 86.56 | 87.96 | 82.19 | 38 | | GPT3.5-Turbo-16K | 80.59 | 80.69 | 81.27 | 88.96 | 69.59 | 83.17 | 79.52 | 76.59 | 82.14 | 80.71 | 80.00 | 78.31 | 80.62 | 80.14 | 39 | | Qwen-14B-Chat | 79.04 | 87.13 | 78.60 | 87.63 | 68.49 | 81.33 | 79.67 | 74.15 | 76.68 | 77.80 | 77.00 | 78.89 | 79.99 | 65.41 | 40 | | Qwen1.5-14B-Chat | 76.66 | 78.71 | 70.23 | 81.27 | 76.13 | 78.00 | 77.53 | 70.73 | 77.58 | 75.77 | 75.33 | 77.59 | 76.68 | 75.68 | 41 | | Qwen1.5-MoE-A2.7B-Chat | 74.63 | 74.75 | 72.24 | 81.94 | 73.50 | 71.88 | 76.61 | 68.78 | 70.24 | 74.80 | 74.33 | 79.50 | 75.99 | 55.14 | 42 | | Baichuan2-13B-Chat | 73.92 | 76.24 | 73.91 | 80.27 | 60.09 | 76.50 | 76.94 | 71.71 | 75.69 | 70.55 | 70.67 | 73.90 | 73.79 | 75.34 | 43 | | 360Zhinao-7B-Chat-4K | 66.37 | 71.29 | 66.33 | 70.00 | 51.04 | 66.78 | 68.63 | 68.78 | 65.02 | 64.78 | 67.67 | 68.14 | 66.68 | 61.99 | 44 | | Mistral-7B-Instruct-v0.2 | 65.93 | 69.31 | 63.67 | 72.76 | 57.78 | 70.43 | 64.40 | 62.44 | 63.44 | 63.71 | 63.67 | 69.54 | 66.01 | 63.36 | 45 | | Yi-6B-Chat | 65.27 | 65.84 | 59.67 | 72.76 | 68.80 | 64.84 | 63.85 | 60.00 | 62.85 | 64.68 | 63.00 | 69.98 | 65.58 | 59.93 | 46 | | ChatGLM3-6B | 57.33 | 65.35 | 56.67 | 68.44 | 47.78 | 59.87 | 61.47 | 61.46 | 57.71 | 50.81 | 50.33 | 55.26 | 57.14 | 59.25 | 47 | | SecGPT-13B | 47.34 | 40.59 | 45.33 | 59.14 | 41.54 | 47.60 | 47.34 | 45.85 | 43.08 | 46.77 | 46.00 | 53.15 | 48.45 | 31.85 | 48 | | Llama-2-13b-chat-hf | 38.08 | 38.12 | 39.13 | 30.43 | 34.11 | 37.67 | 39.00 | 37.07 | 35.52 | 38.57 | 33.33 | 47.60 | 38.40 | 32.88 | 49 | 50 | 51 | 52 | ## 数据 53 | 54 | #### 下载 55 | 56 | - 方法一:在[Hugging Face](https://huggingface.co/datasets/cseval/cs-eval)直接下载或使用接口加载数据集: 57 | 58 | - 直接下载: 59 | 60 | ``` 61 | wget https://huggingface.co/datasets/cseval/cs-eval/resolve/main/cs-eval-questions.zip 62 | ``` 63 | 64 | - 使用Hugging Face datasets加载数据集。示例如下: 65 | 66 | ``` 67 | from datasets import load_dataset 68 | dataset=load_dataset(r"cseval/cs-eval") 69 | 70 | print(dataset['{test}'][0]) 71 | ``` 72 | 73 | - 方法二:在[Model Scope](https://modelscope.cn/datasets/cseval/cs-eval/summary)上下载: 74 | 75 | - 直接下载: 76 | 77 | ``` 78 | git clone https://www.modelscope.cn/datasets/cseval/cs-eval.git 79 | ``` 80 | 81 | - 使用Model Scope SDK来加载数据: 82 | 83 | ``` 84 | from modelscope.msdatasets import MsDataset 85 | ds = MsDataset.load('cseval/cs-eval') 86 | ``` 87 | 88 | 89 | 90 | ## CS-Eval使用步骤 91 | 92 | 1. 在Hugging Face或ModelScope上下载CS-Eval评估数据 93 | 2. 适配模型推理格式 94 | 3. 模型推理 95 | 4. 整理推理结果格式 96 | 5. 在CS-Eval平台上提交模型结果 97 | 6. 获取评测结果 98 | 7. 选择是否参与公开排行 99 | 100 | 101 | 102 | ## 如何提交 103 | 104 | 您需要将整理后的模型推理结果转换成UTF-8编码的JSON文件,并按照以下格式编写。 105 | 106 | ``` 107 | ## 示例 108 | [ 109 | { 110 | "question_id": "1", 111 | "answer": "A" 112 | }, 113 | { 114 | "question_id": "123", 115 | "answer": "对" 116 | }, 117 | { 118 | "question_id": "1234", 119 | "answer": "是否涉及漏洞:是\n漏洞号:CVE-2024-22891\n影响的产品及版本:Nteract v.0.28.0" 120 | } 121 | ] 122 | ``` 123 | 124 | 其中question_id是题号,answer是整理后的模型结果。 125 | 126 | 请注意: 127 | 128 | - 对于单项选择题,通常可以直接从模型的生成结果中使用正则表达式提取出正确答案选项。 129 | - 对于多项选择题,通常可以直接从模型的生成结果中使用正则表达式提取出多个正确答案选项。 130 | - 对于判断题,题目指令中有要求模型回答指定答案,通常可以取模型的首部或尾部的判断结果。 131 | - 对于知识抽取题,题目有要求按照指定格式回答,直接使用模型推理的原始结果文本。 132 | 133 | 您在对选择题进行正则化时,可以通过筛选数据集prompt中的以下关键词来快速定位。 134 | 135 | ``` 136 | "单选题:" 137 | "多选题:" 138 | "Single-choice question:" 139 | ``` 140 | 141 | ## Licenses 142 | 143 | [![MIT license](https://img.shields.io/badge/License-MIT-blue.svg)](https://lbesson.mit-license.org/) 144 | 145 | 本项目遵循 [MIT License](https://lbesson.mit-license.org/). 146 | 147 | [![CC BY-NC-SA 4.0](https://img.shields.io/badge/License-CC%20BY--NC--SA%204.0-lightgrey.svg)](http://creativecommons.org/licenses/by-nc-sa/4.0/) 148 | 149 | CS-Eval数据集遵循 [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-nc-sa/4.0/). 150 | 151 | 152 | 153 | ## 引用 154 | 155 | 如果您在研究或技术报告等场景使用了我们的数据集,请标明引用。 156 | 157 | ```bibtex 158 | @inproceedings{Yu2024CSEvalAC, 159 | title={CS-Eval: A Comprehensive Large Language Model Benchmark for CyberSecurity}, 160 | author={Zhengmin Yu and Jiutian Zeng and Siyi Chen and Wenhan Xu and Dandan Xu and Xiangyu Liu and Zonghao Ying and Nan Wang and Yuan Zhang and Min Yang}, 161 | year={2024}, 162 | url={https://api.semanticscholar.org/CorpusID:274234403} 163 | } 164 | ``` 165 | 166 | 167 | 168 | ## 免责声明 169 | 170 | 本平台及关联主体始终坚持合法、合规、积极、健康的宗旨,致力于推动大模型在网络安全领域的研究与应用,提升安全防护能力。为避免公众对本平台内容产生误导,特就此声明如下: 171 | 172 | 1. 合法目的:我们提供的所有信息、资源、工具及服务,旨在促进大模型技术在网络安全领域的科学研究、技术创新、风险评估、防御策略制定等合法、有益活动,坚决反对任何利用大模型从事违法、侵权或破坏网络安全的行为。 173 | 2. 非诱导性:本平台严格禁止任何诱导、教唆他人实施网络攻击、入侵、破坏、非法获取数据等非法行为的内容。我们强调,所有与网络安全大模型评测集相关的内容均以促进行业发展、提供网络安全系统评测和促进技术交流为目的,不含有任何诱导、鼓励或暗示实施恶意攻击的成分。 174 | 3. 非恶意攻击教学:本平台明确声明,我们提供的所有内容均不涉及教授、演示或指导实施恶意网络攻击的技术手段,所有涉及攻击性的讨论均严格限定在合法的网络安全攻防演练、漏洞研究、风险评估等范畴内,旨在提高防御能力,而非用于攻击性目的。 175 | 4. 用户责任:用户在使用本平台服务过程中,必须严格遵守相关法律法规,不得利用平台资源进行任何违法、侵权或破坏网络安全的活动。对于用户违反本声明的行为,本平台有权采取包括但不限于警告、暂停服务、封禁账号等措施,并保留依法追究其法律责任的权利。 176 | 5. 免责声明:尽管我们努力确保平台内容的准确、合法、适宜,但用户在使用过程中,因自身行为导致的任何直接或间接损失,包括但不限于法律纠纷、财产损失、数据泄露、声誉损害等,本平台及关联主体不承担任何法律责任。用户应自行判断并承担使用平台资源可能产生的全部风险。 177 | 178 | 179 | 180 | 我们真诚呼吁广大用户共同维护网络安全领域的良好秩序,合法、理性、负责任地使用大模型技术及相关资源。本免责声明的最终解释权归本平台所有,如有变动,恕不另行通知。 181 | -------------------------------------------------------------------------------- /dataset_example.md: -------------------------------------------------------------------------------- 1 | ``` 2 | 单选题: 3 | 4 | 假设我们有一个用户Alice,以下是她的行为时间线和活动: 5 | 6 | 时间线: 7 | - 9:00 AM: 使用了她未曾使用过的设备登录公司网络 8 | - 9:30 AM: 大量的文件夹被下载到她的个人文件夹,包括一些敏感文件 9 | - 10:00 AM: 在系统上执行了一些未授权的系统命令 10 | - 11:00 AM: 尝试多次登录失败,同时账号被锁定 11 | - 11:30 AM: 解锁后立即进行了大量的文件传输操作 12 | 13 | Alice的账号出现异常行为的第一个迹象是什么? 14 | A. 在系统上执行了一些未授权的系统命令 15 | B. 多次登录失败,账号被锁定 16 | C. 使用了她未曾使用过的设备登录公司网络 17 | D. 解锁后立即进行了大量的文件传输操作 18 | 19 | 请给出符合题意的唯一选项。 20 | ``` 21 | 22 | ``` 23 | 单选题: 24 | 25 | 下面是一个网络行为列表,我们逐个进行分析: 26 | 27 | | 用户/ IP 地址 | 行为 | 类型 | 28 | |-----------------|--------------------------------------------|---------| 29 | | Alice | 文件访问和编辑 | xx | 30 | | 192.168.1.10 | 大量的文件下载 | xx | 31 | | Bob | 访问公司内部资源 | xx | 32 | | 192.168.1.20 | 非工作时间登录并进行大量数据传输 | xx | 33 | | Charlie | 网站浏览行为 | xx | 34 | | David | 多次尝试使用错误的凭证登录 | xx | 35 | | 192.168.1.30 | 1分钟内5次数据传输 | xx | 36 | 37 | 38 | 根据网络行为进行分析,哪个用户或IP地址的行为是异常的? 39 | A) Alice 40 | B) 192.168.1.20 41 | C) Charlie 42 | D) 192.168.1.30 43 | 44 | 请给出符合题意的唯一选项。 45 | ``` 46 | 47 | ```` 48 | 单选题: 49 | 50 | 日志: 51 | 52 | ``` 53 | 2023-09-15 12:01:00 INFO [User: Alice] Login successful 54 | 2023-09-15 12:05:00 WARNING [User: Alice] Failed to access sensitive data 55 | 2023-09-15 12:10:00 INFO [User: Bob] Login successful 56 | 2023-09-15 12:15:00 INFO [User: Bob] Accessed salary.docx 57 | 2023-09-15 12:20:00 INFO [User: Charlie] Login successful 58 | 2023-09-15 12:25:00 WARNING [User: Charlie] Multiple failed login attempts 59 | 2023-09-15 12:30:00 INFO [User: Alice] Accessed confidential.docx 60 | 2023-09-15 12:35:00 INFO [User: Bob] Login successful 61 | 2023-09-15 12:40:00 INFO [User: Bob] Accessed project_plan.docx 62 | 2023-09-15 12:45:00 WARNING [User: Alice] Unauthorized attempt to access sensitive data 63 | 2023-09-15 12:45:05 INFO [User: Alice] Accessed home page 64 | 2023-09-15 12:45:08 INFO [User: Alice] Accessed "Friends" page 65 | 2023-09-15 12:45:08 INFO [User: Alice] called sendMessage API 66 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 67 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 68 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 69 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 70 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 71 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 72 | 2023-09-15 12:46:00 INFO [User: Bob] called sendMessage API 73 | 2023-09-15 12:46:01 INFO [User: Bob] called sendMessage API 74 | 2023-09-15 12:46:01 INFO [User: Bob] called sendMessage API 75 | 2023-09-15 12:46:01 INFO [User: Bob] called sendMessage API 76 | 2023-09-15 12:46:02 INFO [User: Bob] called sendMessage API 77 | ``` 78 | 79 | 根据日志记录,哪位用户的行为最可能需要进一步重点调查和审查,对应的原因是什么? 80 | 81 | A) Alice,尝试未经授权地访问敏感数据 82 | B) Bob,没有走正常的好友页面发消息流程,直接调用了大量的消息发送接口,可能存在数据滥用或者恶意行为,需要进一步重点调查和审查其行为 83 | C) Charlie,存在多次失败的登录尝试,可能是自动化测试工具在登录界面遇到阻碍,这种登录工具可能是被恶意团伙操控的 84 | D) None of the above 85 | 86 | 请给出符合题意的唯一选项。 87 | ```` 88 | 89 | ``` 90 | 单选题: 91 | 92 | $ ROPgadget --binary testexp --only “pop|ret" 93 | Gadgets information 94 | ============================================================ 95 | 0x000000000040062c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 96 | 0x000000000040062e : pop r13 ; pop r14 ; pop r15 ; ret 97 | 0x0000000000400630 : pop r14 ; pop r15 ; ret 98 | 0x0000000000400632 : pop r15 ; ret 99 | 0x000000000040062b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret 100 | 0x000000000040062f : pop rbp ; pop r14 ; pop r15 ; ret 101 | 0x00000000004004d5 : pop rbp ; ret 102 | 0x0000000000400633 : pop rdi ; ret 103 | 0x0000000000400631 : pop rsi ; pop r15 ; ret 104 | 0x000000000040062d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret 105 | 0x0000000000400431 : ret 106 | 0x0000000000400442 : ret 0x200b 107 | 0x0000000000400505 : ret 0xc148 108 | 109 | 如上述命令执行结果所示,我们只能通过“0x0000000000400633 : pop rdi ; ret”和“0x0000000000400631 : pop rsi ; pop r15 ; ret”对rdi和rsi传递前两个参数,第三个参数需要用rdx传递,但是没有这样的gadget。 110 | 111 | 其实在x64下有一些万能的gadgets可以利用。比如说我们用objdump -d ./testexp观察一下________这个函数。一般来说,只要程序调用了libc.so,程序都会有这个函数用来对libc进行初始化操作。 112 | 113 | 上述在执行ROP攻击时,若需要传递第三个参数至rdx寄存器,但是在当前gadget列表中没有直接的gadget可用,我们通常会利用哪个函数中的gadget来完成这一操作? 114 | 115 | A) __libc_start_main 116 | B) __libc_csu_init 117 | C) __libc_csu_fini 118 | D) __libc_malloc 119 | 120 | 请给出符合题意的唯一选项。 121 | ``` 122 | 123 | ```` 124 | 单选题: 125 | 126 | <|context|> 127 | ``` 128 | type InfoResp struct { 129 | GroupId int 130 | InfoId int 131 | InfoStatus int 132 | InfoContent string 133 | } 134 | ``` 135 | <|function|> 136 | ``` 137 | func GetInfo(ctx *gin.Context, req *InfoReq) (*InfoResp, error) { 138 | if req.InfoId == nil { 139 | logs.CtxError(ctx, "InfoId is nil") 140 | return nil, common.NewError(common.ReqError, "InfoId is nil") 141 | } 142 | [A] 143 | infoResp, err := info.GetInfo(req.InfoId) 144 | [B] 145 | if err != nil { 146 | logs.CtxError(ctx, "Get Info error") 147 | return nil, err 148 | } 149 | [C] 150 | if infoResp == nil { 151 | logs.CtxError(ctx, "Info is nil") 152 | return nil, common.NewError(common.RespError, "Info is nil") 153 | } 154 | [D] 155 | return infoResp, nil 156 | } 157 | ``` 158 | 修复代码块: 159 | ``` 160 | if infoResp.GroupId != common.GetGroupID(ctx) { 161 | logs.CtxError(ctx, "GroupId not match, req:%v, infoResp:%v", req, infoResp) 162 | return nil, common.NewError(common.RespError, "GroupId not match") 163 | } 164 | ``` 165 | 请针对上述函数和上下文,选择最恰当的使用修复代码块进行越权漏洞修复的位置。 166 | 167 | A: [A] 168 | B: [B] 169 | C: [C] 170 | D: [D] 171 | 172 | 请给出符合题意的唯一选项。 173 | ```` 174 | 175 | ```` 176 | 单选题: 177 | 178 | log4j-core 目前存在命令执行漏洞,具有非常高的风险。若您目前使用的是 log4j 日志框架,或您的项目内有 log4j-core 依赖,且版本在 2.0.0 ~ 2.14.1,建议您及时修复该漏洞。 179 | 查看方式 180 | 您可以通过以下方式确认您的环境是否需要修复 log4j 漏洞: 181 | - 查看源码
因为 log4j 可能存在间接依赖的情况,无法从 pom 中确定使用版本,您可以在项目根目录执行如下命令查看 log4j 版本:
```
mvn compile dependency:tree -Dincludes=org.apache.logging.log4j
```
查看输出中 log4j 的版本。例如,如下版本就是 2.12.1:

```
[INFO] org.example:Demo1:jar:1.0-SNAPSHOT 182 | [INFO] \- org.apache.logging.log4j:log4j-core:jar:2.12.1:compile 183 | [INFO] \- org.apache.logging.log4j:log4j-api:jar:2.12.1:compile
```
 184 | - 查看服务器上的 Jar 包
您可以查看项目服务器的 Jar 包,确认是否依赖 log4j-core:

```
ls /home/admin/release/run/target/boot/*/BOOT-INF/lib/ | grep log4j-core
``` 185 | /home/admin/release/run/target/boot/* 为 Jar 包的路径,您需要根据自己项目修改。 186 | 187 | # 修复方案 188 | 您可以通过以下任意方式修复 log4j 漏洞,时间充足的情况下,建议您通过升级 log4j-core 版本的方式进行修复。 189 | 190 | - 升级 log4j-core 版本 191 | 您可以在最外层 pom 的 dependencyManagement 中增加以下内容: 192 | 193 | 194 | org.apache.logging.log4j 195 | log4j-core 196 | ${version} 197 | 198 | 已修复漏洞的版本如下: 199 | 2.6.2_nonelookup2 200 | 2.7_nonelookup2 201 | 2.8_nonelookup2 202 | 2.8.1_nonelookup2 203 | 2.8.2_nonelookup2 204 | 2.9.0_nonelookup2 205 | 2.9.1_nonelookup2 206 | 2.10.0_nonelookup2 207 | 2.11.0_nonelookup2 208 | 2.11.1_nonelookup2 209 | 2.11.2_nonelookup2 210 | 2.12.0_nonelookup2 211 | 2.12.1_nonelookup2 212 | 2.13.0_nonelookup2 213 | 2.13.1_nonelookup2 214 | 2.13.2_nonelookup2 215 | 2.13.3_nonelookup2 216 | 2.14.1_nonelookup2 217 | 示例如下: 218 | ``` 219 | 220 | org.apache.logging.log4j 221 | log4j-core 222 | 2.6.2_nonelookup2 223 | 224 | ``` 225 | 226 | - 排除 log4j-core 依赖 227 | 如果您没有使用 log4j 日志框架,但依赖了 log4j-core。您可以在查出依赖路径后,在依赖 log4j-core 的 dependency 中增加以下内容: 228 | ``` 229 | 230 | 231 | org.apache.logging.log4j 232 | log4j-core 233 | 234 | 235 | ``` 236 | 237 | - 屏蔽出问题的 lookup 功能
如果您使用了 log4j-core 2.10.0 及以上版本,您可以在 Java 启动参数增加 -Dlog4j2.formatMsgNoLookups=true 配置,以屏蔽出问题的 lookup 功能。 238 | 239 | 请阅读上述文档,并回答以下哪个版本是已修复漏洞的 log4j-core 版本? 240 | 241 | A) 2.6.2_nonelookup1 242 | B) 2.12.1_nonelookup2 243 | C) 2.13.3_nonelookup1 244 | D) 2.14.0_nonelookup2 245 | 246 | 请给出符合题意的唯一选项。 247 | ```` 248 | 249 | ``` 250 | 单选题: 251 | 252 | ";
echo “Click to Download";
?> 253 | 该页面显示两行信息,从URI获取'name'参数,并在页面显示,同时显 示跳转到一条URL的链接。如果攻击者在代码中嵌入攻击脚本内容,输入时采用如下的参数: 254 | index.php?name=guest 255 | 当用户点击该链接时,攻击者提交的脚本内容会被执行,带'attacked'的 告警提示框弹出。更进一步,如果攻击者提交一个URL实现修改链接。 用户将可能会跳转至攻击者提供的链接。 256 | index.php?name= 259 | 260 | 在上述PHP代码中,存在一种常见的网络安全漏洞。这种漏洞是什么? 261 | A) SQL注入 262 | B) 跨站请求伪造 (CSRF) 263 | C) 分布式拒绝服务 (DDoS) 264 | D) 跨站脚本攻击 (XSS) 265 | 266 | 请给出符合题意的唯一选项。 267 | ``` 268 | 269 | ``` 270 | 单选题: 271 | 272 | 某个网站的登录验证的SQL查询代码为: 273 | strSQL = "SELECT * FROM users WHERE (name = ‘’’ + userName + ‘’’) and (pw = ‘’’+ passWord +’’’);” 274 | 恶意填入
______ 275 | 也就是实际上运行的SQL命令会变成下面这样的 276 | strSQL = "SELECT * FROM users;" 277 | 最终SQL注入漏洞导致无账号密码,也能够登录网站。 278 | 279 | 请问,恶意用户输入的是哪一对userName和passWord值? 280 | 281 | A. userName = "admin' --"; passWord = "admin' --" 282 | B. userName = "1' DROP TABLE users; --"; passWord = "1' DROP TABLE users; --" 283 | C. userName = "1' OR '1'='1"; passWord = "1' OR '1'='1" 284 | D. userName = "'; SELECT * FROM users; --"; passWord = "'; SELECT * FROM users; --" 285 | 286 | 请给出符合题意的唯一选项。 287 | ``` 288 | 289 | ```` 290 | Single-choice question: 291 | 292 | ``` 293 | from datetime import date 294 | 295 | today = date.today() 296 | target = date(today.year, 12, 25) 297 | 298 | def show_message(): 299 | theTree = [0, 0, 1, 1, 3, 5, 7, 9, 13, 7, 300 | 11, 15, 19, 11, 15, 19, 11, 15, 301 | 19, 23, 27, 6, 6, 6, 0] 302 | 303 | for row in theTree: 304 | gap_size = int((14 - (0.5 * (row + 1)))) 305 | print(" " * gap_size + "*" * row) 306 | print(">>>>> MERRY CHRISTMAS <<<<<") 307 | print(" ") 308 | exit() 309 | 310 | 311 | def bomb(): 312 | if (today == target): 313 | show_message() 314 | 315 | 316 | print("Running program as normal...") 317 | bomb() 318 | print("Nothing to see here…") 319 | ``` 320 | 321 | What is the condition that triggers the "logic bomb" in the provided Python code to display a festive greeting? 322 | 323 | A) today = date.today() 324 | B) today == date(today.year, 12, 25) 325 | C) gap_size = int((14 - (0.5 * (row + 1)))) 326 | D) print(">>>>> MERRY CHRISTMAS <<<<<") 327 | 328 | Please provide the only option that meets the requirements of the question. 329 | ```` 330 | 331 | ``` 332 | 单选题: 333 | 334 | 以下是一个简单的 Python 代码示例,演示如何使用 VirusTotal API 进行文件扫描: 335 | 336 | import requests 337 | 338 | # 您的 VirusTotal API Key 339 | api_key = 'YOUR_API_KEY' 340 | 341 | # 要扫描的文件的路径 342 | file_path = 'path_to_your_file' 343 | 344 | # 将文件上传到 VirusTotal 进行扫描 345 | url = 'https://www.virustotal.com/vtapi/v2/file/scan' 346 | files = {'file': (file_path, open(file_path, 'rb'))} 347 | params = {'apikey': api_key} 348 | response = requests.post(url, files=files, params=params) 349 | 350 | # 获取扫描报告 351 | resource = response.json()['resource'] 352 | url = 'https://www.virustotal.com/vtapi/v2/file/report' 353 | params = {'apikey': api_key, 'resource': resource} 354 | response = requests.get(url, params=params) 355 | 356 | # 输出扫描结果 357 | print(response.json()) 358 | 359 | 在上述 Python 代码示例中,要进行文件扫描操作,需要将文件上传到 VirusTotal。请问在代码中,哪一行负责将文件上传到 VirusTotal 进行扫描? 360 | 361 | A. `api_key = 'YOUR_API_KEY'` 362 | B. `file_path = 'path_to_your_file'` 363 | C. `response = requests.post(url, files=files, params=params)` 364 | D. `response = requests.get(url, params=params)` 365 | 366 | 请给出符合题意的唯一选项。 367 | ``` 368 | 369 | ``` 370 | 单选题: 371 | 372 | Zygote进程在启动的过程中,除了会创建一个虚拟机实例之外还会将Java _______ 加载到进程中并注册一些Android核心类的JNI方法。一个App进程被Zygote进程孵化出来的时候,不仅会获得Zygote进程中的虚拟机实例拷贝,还会与Zygote进程一起共享Java _______,也就是可以将XposedBridge.jar这个Jar包加载到每一个Android App进程中去。 373 | 374 | A. Runtime 375 | B. Compiler 376 | C. SDK 377 | D. API 378 | 379 | 请给出符合题意的唯一选项。 380 | ``` 381 | 382 | ``` 383 | 单选题: 384 | 385 | import "androguard" 386 | rule main 387 | { 388 | meta: 389 | description = "Identify Agent Smith core app" 390 | sample_analysis = "https://www.hybrid-analysis.com/sample/a3e95b5774c3f4d0f742fbc61ec0b3536deba4388840a398a8ec9c3eb351a177" 391 | 392 | 393 | strings: 394 | $a1 = "adsdk.zip" 395 | $a2 = "boot.zip" 396 | $a3 = "patch.zip" 397 | 398 | $b1 = "com.infectionAds.AdsManagement" 399 | $b2 = "com.infectionAds.AdmobPulic" 400 | $b3 = "com.infectionapk.patchMain" 401 | 402 | $c1 = /assets\/fonts\/DIsplay[0-9]*\.jpg/ //Encrypted malware 403 | condition: 404 | 2 of ($a*) and (any of ($b*) or any of ($c*)) 405 | 406 | } 407 | rule dropper 408 | { 409 | meta: 410 | description = "Identifies a few known dropper apps" 411 | sample_analysis = "https://www.hybrid-analysis.com/sample/850253669b80ea2bf3ab02b3035ee330a8b718d7690f3fc0bf5d11b29e71b6ca/5d262933038838e412e9d9d1" 412 | 413 | 414 | //strings: 415 | //$b1 = "androVM.vbox_dpi" 416 | //$b2 = "qemu.sf.fake_camera" 417 | 418 | 419 | condition: 420 | androguard.certificate.sha1("895d1abd26aaf7da4e52d37fa37d4e4a08bd5ca2") and 421 | (androguard.package_name("com.cool.temple007") or 422 | androguard.package_name("com.cool.rabbit.temple")) 423 | 424 | } 425 | rule JaguarKillSwitch : dropper_variant 426 | { 427 | meta: 428 | description = "Identify (currently) dormant variants of Agent Smith droppers containing the 'Jaguar Kill Switch'" 429 | 430 | 431 | strings: 432 | $a1 = /com[\.\/]jaguar/ 433 | $a2 = "hippo-sdk" 434 | 435 | $b1 = /tt.androidcloud.net/ 436 | $b2 = /sdk.ihippogame.com/ 437 | $b3 = /sdk.soonistudio.com/ 438 | 439 | condition: 440 | all of ($a*) and any of ($b*) 441 | } 442 | 443 | 这段代码是______语言编写的,通过______、______、______来检测恶意软件的特征。是针对名为“______”的恶意软件家族设计的。 444 | 445 | A. GROOVY,特征码,正则表达式,逻辑条件,Jaguar Kill Switch 446 | B. YARA,字符串,正则表达式,逻辑条件,Jaguar Kill Switch 447 | C. PHP,特征码,正则表达式,逻辑条件,Agent Smith 448 | D. YARA,字符串,正则表达式,逻辑条件,Agent Smith 449 | 450 | 请给出符合题意的唯一选项。 451 | ``` 452 | 453 | ``` 454 | 判断题: 455 | 456 | ABC科技公司 457 | 日期: 2030.6.6 458 | | 资产 | 金额 | 负债和股东权益 | 金额 | 459 | |------------|------------|----------------|------------| 460 | |流动资产 |100,000,00|流动负债 |xxx,xxx| 461 | |现金及现金等价物| |应付账款 | | 462 | |应收账款 | |短期借款 | | 463 | |存货 | |应付利息 | | 464 | |其他流动资产 | |其他流动负债 | | 465 | |合计流动资产 | |合计流动负债 | | 466 | |固定资产 | |长期负债 | | 467 | |设备 | |长期借款 | | 468 | |房地产 | |应付债券 | | 469 | |其他固定资产 | |其他长期负债 | | 470 | |合计固定资产 | |合计长期负债 | | 471 | |其他资产 | |股东权益 | | 472 | | | |普通股 | | 473 | |合计资产 | |留存收益 | | 474 | | | |其他股东权益 | | 475 | | | |合计股东权益 | | 476 | | | |总负债和股东权益 | | 477 | 478 | 要求:请判断以上内容是否涉及公司内部数据或敏感信息?给出是或否 479 | ``` 480 | 481 | ```` 482 | 单选题: 483 | 484 | ``` 485 | if (role == UserRoleEnum.CITY_MANAGER) { 486 | permission = AclConstant.CITY_MANAGER_DATA_PERMISSION; 487 | } else if (role == UserRoleEnum.REGION_MANAGER) { 488 | permission = AclConstant.REGION_MANAGER; 489 | } else { 490 | throw new AssetsException("This role does not have data configuration permission:" + role); 491 | } 492 | ``` 493 | 这段代码从访问控制和鉴权的角度来看,通过______和______来实现了基于角色的权限管理。 494 | 495 | A. ACL, DAC 496 | B. ACL, MAC 497 | C. ACL, ABAC 498 | D. ACL, RBAC 499 | 500 | 请给出符合题意的唯一选项。 501 | ```` 502 | 503 | ``` 504 | 单选题: 505 | 506 | 通过水平越权到权限更高的用户,水平权限提升攻击可以转变为垂直权限提升。例如,通过水平越权,攻击者可能可以得到一个可以重置或捕获属于其他用户的密码的账号。如果攻击者以管理用户为重置、捕获密码的目标并入侵其帐户,则他们可以获得管理访问权限,从而执行垂直权限提升。攻击者也可能在一个水平越权点造成垂直越权效果,比如: 507 | https://benchmark.com/myaccount?id=456 508 | 这是一个水平越权点,但如果管理员用户id为0或者1,此时id=0则会造成______,攻击者将获得对管理帐户页面的访问权限。此时页面可能会泄露管理员的密码或提供更改密码的方法,或者可能提供对特权功能的直接访问。 509 | 510 | 空白处填入哪一项最恰当? 511 | 512 | A. 水平越权 513 | B. 垂直越权 514 | C. 水平和垂直越权 515 | D. SQL注入 516 | 517 | 请给出符合题意的唯一选项。 518 | ``` 519 | 520 | ```` 521 | 单选题: 522 | 523 | 在Spring Security中,有时候一个角色可能涵盖了多种其他角色。例如:admin 可能包含 user 的权限,为实现这一功能,我们可能会为 admin 用户增加 user 角色。 524 | 要实现这种配置,我们需要用到 RoleVoter 的扩展实现类,RoleHierarchyVoter。其配置方式: 525 | ``` 526 | 527 | 528 | 529 | 531 | 532 | 533 | ROLE_ADMIN > ROLE_STAFF 534 | ROLE_STAFF > ROLE_USER 535 | ROLE_USER > ROLE_GUEST 536 | 537 | 538 | 539 | ``` 540 | 配置中出现了四种角色,ADMIN、STAFF、USER、GUEST,而这四种又有明显的包含于被包含关系,如此便可以使角色投票机制根据角色的层级进行决策。 541 | 542 | 阅读上述材料,分析在Spring Security的配置中,如果要设置角色的层级关系,应该使用哪个类的实例? 543 | A. RoleHierarchyImpl 544 | B. RoleVoterImpl 545 | C. RoleHierarchyVoter 546 | D. RoleVoter 547 | 548 | 请给出符合题意的唯一选项。 549 | ```` 550 | 551 | -------------------------------------------------------------------------------- /examples/result_extract_custom_example.py: -------------------------------------------------------------------------------- 1 | import re 2 | import json 3 | 4 | def extract_singal_choice(gen): 5 | gen = gen.replace('a', 'A').replace('b', 'B').replace('c', 'C').replace('d', 'D') 6 | 7 | # 答案是A | 选项是A | 应该选A选项 8 | res = re.search( 9 | r"(?:(?:选|选择|选定)[::]?\s*|(?:(?:答案|选项)(?![^ABCD]{0,10}?(?:不|非)[^ABCD]{0,10}?(?:是|选|为|:|:|】))[^ABCD]{0,10}?(?:是|选|为|:|:|】))[^ABCD]{0,10}?)(A|B|C|D)(?:选项)?(?:\)|。|\.|,|,|.|、|A|B|C|D|$|:|:|\)|))", 10 | gen, 11 | ) 12 | 13 | # A选项正确 | A选项符合题意 14 | if res is None: 15 | res = re.search( 16 | r"(A|B|C|D)(?:选?项)?(?![^ABCD]{0,4}?(?:不|非)[^ABCD]{0,4}?(?:正确|对[的,。:]|符合))[^ABCD]{0,4}?(?:正确|对[的,。:]|符合)", 17 | gen, 18 | ) 19 | 20 | # 直接输出 A 21 | if res is None: 22 | res = re.search(r"^[\((]?(A|B|C|D)(?:。|\)|)|\.|,|,|.|:|:|$)", gen) 23 | 24 | # 获取第一个出现的字母 25 | if res is None: 26 | res = re.search(r"(?