How ICBC Uses DeepSeek for Security Testing: A Practical Walkthrough

Background

Facing increasingly severe external security threats, the Industrial and Commercial Bank of China (ICBC) recognized gaps in security design, testing capabilities, and tool scanning accuracy. To address these challenges, ICBC adopted the DeepSeek large model to build an intelligent security testing framework.

DeepSeek‑Powered Security Design Analysis

ICBC created a tool that combines the DeepSeek model with an expert rule knowledge base to perform comprehensive, fine‑grained analysis of system security designs, automatically identifying omissions and suggesting concrete improvements.

Process flow (Figure 1)

Key steps:

Knowledge‑base construction and management : Collect high‑quality security design rules, expand them with the model, clean and annotate the data, and maintain an expert knowledge repository.

Model‑driven analysis : Input design documents or code into DeepSeek, which, together with the knowledge base, scans for design issues.

Keyword‑assisted judgment : A predefined keyword list matches design content to guide the model, improving accuracy.

Verification of non‑security factors : An intelligent review checks designer feedback that a item is “not security‑related” to ensure correctness.

Results showed the model‑enhanced tool raised security analysis accuracy above 90%, broadened coverage, and increased efficiency while reducing manual effort and cost.

DeepSeek‑Powered Vulnerability Intelligent Analysis

ICBC also tackled high false‑positive rates of traditional vulnerability scanners, which can exceed 90% for some systems. By building a large‑model‑augmented vulnerability knowledge base and applying DeepSeek, the bank filtered out false positives and prioritized real issues.

Process flow (Figure 2)

Key steps:

Build vulnerability knowledge base : Collect historical scan results, de‑duplicate, classify by type, impact, and severity, and label them for model training.

Model‑driven analysis : Standardize scan reports, preprocess data, then use DeepSeek to compare each reported vulnerability against the knowledge base, filtering out false positives and ranking true issues into high, medium, and low risk.

Generate analysis reports : Produce detailed documents containing vulnerability name, description, impact, trigger conditions, attack path, and remediation guidance derived from both expert rules and the model.

Continuous optimization : Regularly update the knowledge base with new rules and fixes, automatically evaluate model performance, and iterate the tool to meet evolving security needs.

Practices demonstrated that integrating DeepSeek raised vulnerability identification accuracy, reduced false‑positive rates by over 80%, and provided precise remediation suggestions, significantly lowering manual review costs.

Future Outlook

ICBC plans to further deepen AI applications in finance, continuously refining the large‑model‑driven security testing platform to support digital transformation and innovation across the banking sector.