A method for threat intelligence aggregation and attack anomaly feature intelligent generation based on large language model

Abstract

The present invention discloses a method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model, including obtaining network security intelligence of an open source threat intelligence community platform in real time; optimizing the prompt words of the large language model according to predefined multidimensional feature attributes, and extracting multidimensional feature attributes of threat intelligence from network security intelligence; constructing a mesh graph relationship structure database of threat intelligence according to the extracted multidimensional feature attributes of threat intelligence; constructing a threat intelligence knowledge graph according to the mesh graph relationship structure database; querying the threat intelligence knowledge graph, marking attack behavior features, connecting attack behavior feature points, and generating an attack behavior feature subgraph. The method of the present invention enables the security team to quickly respond to emerging threats and improves the ability to respond to network security threats.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to a method for aggregating threat intelligence and intelligently generating attack anomaly features based on a large language model. Background Art

[0002] In the digital age, the importance of network security has become increasingly prominent, especially in the face of increasingly complex cyber attacks and data leakage threats. Large language models (LLMs) technology is developing rapidly, and its application in the field of network security has shown great potential, but it also brings new research topics and challenges.

[0003] First, the complexity and diversity of cybersecurity threats require us to adopt more advanced technologies for the collection, analysis and response of threat intelligence. Traditional security protection measures are often difficult to cope with rapidly changing attack patterns, so more advanced technologies are needed to improve the accuracy and efficiency of threat detection. Large language models such as ChatGPT and BERT, through deep learning and natural language processing technology, can understand and generate complex text information, which gives them significant advantages in processing and analyzing large amounts of cybersecurity data. For example, by analyzing network traffic and system logs, large language models can identify abnormal behaviors and predict potential security threats, thereby improving the intelligence level of network security defense.

[0004] In practical applications, large language models have been used to build threat detection systems, such as identifying abnormal behaviors by analyzing network traffic and system logs. These systems can automatically extract threat features and generate threat intelligence, thereby improving the efficiency and accuracy of network security defense. For example, threat detection systems based on large language models can identify security threats such as malware, phishing attacks, and advanced persistent threats (APT). Future research will continue to explore the application of large language models in the field of network security, including improving the security, privacy protection capabilities, and interpretability of the model. At the same time, researchers will also focus on how to combine large language models with other network security technologies to build a more comprehensive and powerful network security defense system.

[0005] However, with the rapid development of the Internet and information technology, cyber attacks have become more frequent and complex. Advanced persistent threats such as APT attacks are more targeted, covert, and adversarial, and manual analysis of threat behaviors for detection, attribution, and response is challenging. At the same time, the threat intelligence data format lacks standardization, which not only restricts the sharing of intelligence, but also restricts the integration and intelligent evolution of threat intelligence in the enterprise security protection system. In addition, there is a lack of targeted products and services on the market that cannot meet the security needs of specific industries or scenarios. Therefore, the research community focuses on intelligent defense methods and is committed to analyzing APT attacks and improving defense capabilities through knowledge graphs and deep learning methods. Intelligent threat analysis uses artificial intelligence technology to automatically analyze the threat behavior of APT attacks, and reduces the difficulty of threat behavior mining by improving the fusion representation capabilities of multi-source heterogeneous security data. Summary of the invention

[0006] In order to solve the problems existing in the prior art, the present invention proposes a method for threat intelligence aggregation and intelligent generation of attack anomaly features based on a large language model.

[0007] The technical solution of the present invention is as follows:

[0008] A method for aggregating threat intelligence and intelligently generating attack anomaly features based on a large language model includes the following specific steps:

[0009] Step 1) Obtaining network security intelligence from the open source threat intelligence community platform in real time, the network security intelligence including network security situation, organizational attack behavior and vulnerability summary;

[0010] Step 2) optimizing the prompt words of the large language model according to the predefined multi-dimensional feature attributes, and extracting the multi-dimensional feature attributes of the threat intelligence from the network security intelligence;

[0011] Step 3) constructing a network graph relational structure database of threat intelligence based on the multidimensional characteristic attributes of the extracted threat intelligence; each characteristic intelligence attribute in the relational structure database has a multidimensional attribute pointer for associating other threat intelligence;

[0012] Step 4) constructing a threat intelligence knowledge graph based on the mesh graph relationship structure database;

[0013] Step 5) querying the threat intelligence knowledge graph, marking attack behavior features, connecting attack behavior feature points, and generating an attack behavior feature subgraph.

[0014] Furthermore, the specific steps of step 2) include:

[0015] Step 2-1) Define the multi-dimensional characteristic attributes of threat intelligence corresponding to different threat intelligence subjects;

[0016] Step 2-2) Design the initial prompt words of the large prediction model based on the defined multi-dimensional feature attributes;

[0017] Step 2-3) Call the large language model interface, extract cases according to the initial prompt word settings, and store the cases in Chat-History;

[0018] Step 2-4) Input cybersecurity intelligence, design backward content feedback logic, and optimize prompt words until the extracted multi-dimensional feature attribute definition meets the expected requirements;

[0019] Step 2-5) Based on the network security intelligence collected in real time, the multi-dimensional characteristic attributes of the corresponding threat intelligence are output in real time.

[0020] Furthermore, the specific steps of step 3) include:

[0021] According to the multi-dimensional characteristic attributes of the extracted threat intelligence, the operation interface of the mesh graph relational structure database is called to construct graph nodes of corresponding attributes; the node characteristic values ​​are set according to the attribute requirements; and finally the mesh graph relational structure database of the threat intelligence is output.

[0022] Furthermore, the specific steps of step 4) include:

[0023] Step 4-1) Match the multidimensional attribute node pointed to by the pointer and associate the relevant threat intelligence; if any attribute pointer of the multidimensional attribute node of the threat intelligence does not point to it, mark the threat intelligence as threat intelligence to be associated;

[0024] Step 4-2) Output all related threat intelligence connectivity graphs and build a threat intelligence knowledge graph.

[0025] Furthermore, the specific steps of step 5) include:

[0026] Step 5-1) Based on the attack type attributes, query the threat intelligence knowledge graph and mark the attack behavior characteristics and its victims;

[0027] Step 5-2) Concatenate attack behaviors and output abnormal attack behavior characteristics.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The present invention provides a method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model. This method ensures the timeliness of threat data by collecting the latest network security intelligence information from the open source threat intelligence community platform in real time. At the same time, it not only focuses on network security trends and organizational attack behaviors, but also covers key information such as vulnerability summaries, thereby providing a comprehensive network security perspective. This combination of comprehensiveness and real-time performance enables security teams to respond quickly to emerging threats and improves their ability to respond to network security threats.

[0030] 2. The method of the present invention uses a large language model to pre-define multi-dimensional features to fine-tune prompts. This method can intelligently extract key information from a large amount of unstructured threat intelligence. By designing multi-dimensional feature attributes for different threat intelligence subjects, such as attack organizations, attack types, etc., this method can deeply analyze the intelligence content and convert this information into structured multi-dimensional attributes, providing a rich data foundation for the subsequent knowledge graph construction.

[0031] 3. The method of the present invention not only stores the multidimensional attributes of threat intelligence by building a multidimensional relational database and knowledge graph, but also reveals the associations and patterns between different threats through intelligent query and analysis. This method enables security analysts to identify and understand complex attack behavior characteristics and their interrelationships, thereby more effectively predicting and defending against potential network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The flow chart of the method of the present invention in the embodiment is arranged;

[0033] Figure 2 A structural block diagram of extracting multi-dimensional feature attributes using a large language model in an embodiment;

[0034] Figure 3 A structural block diagram of abnormal attack behavior features constructed by constructing a knowledge graph in an embodiment. DETAILED DESCRIPTION

[0035] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent modifications of the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0036] Example

[0037] The present invention proposes a method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model. First, the latest network security intelligence from multiple open source threat intelligence community platforms, including network security situation, organizational attack behavior and vulnerability information, is monitored and collected in real time. The collected intelligence is extracted using a large language model, and fine-tuned and optimized according to predefined multidimensional features (such as attack organization, attack type, victim group, etc.) to extract key information. Then, graph database technologies such as Neo4j are used to construct a mesh graph relationship structure database based on the extracted multidimensional feature attributes. Each intelligence attribute is associated with other intelligence information through a multidimensional pointer. By connecting the multidimensional pointer attributes in series, isolated threat intelligence nodes are connected to form a complete knowledge graph, which reveals the internal connections and patterns between threats. Finally, the technology can intelligently generate abnormal features of attack behaviors, provide powerful intelligence support for network security defense, reduce the attack surface from APT organizations, and establish a continuous threat monitoring system.

[0038] Specifically, the present invention provides a method for aggregating threat intelligence and intelligently generating attack anomaly features based on a large language model, such as Figure 1~Figure 3 As shown, the specific steps are as follows:

[0039] Step 1) Information collection: obtaining cybersecurity intelligence from the open source threat intelligence community platform in real time. Cybersecurity intelligence includes cybersecurity situation, organizational attack behavior, and vulnerability summary.

[0040] Furthermore, the specific steps of step 1) include:

[0041] Step 1-1) Choose a reliable open source threat intelligence community platform that provides comprehensive network security intelligence query tools and supports IP, domain name, hash, URL, Email, vulnerability, and keyword query functions;

[0042] Step 1-2) Use customized information collection technology for different threat intelligence community platforms, and design a sleep collection mechanism to synchronize relevant information based on different intelligence interfaces.

[0043] Step 2) Feature attribute extraction: optimize the prompt words (Prompt) of the large language model according to the predefined multi-dimensional feature attributes, and extract the multi-dimensional feature attributes of threat intelligence for network security intelligence;

[0044] Furthermore, if Figure 2 As shown, the specific steps of step 2) include:

[0045] Step 2-1) Define the multi-dimensional characteristic attributes of threat intelligence for different threat intelligence subjects, such as the attack organization, attack type, victim group, vulnerability exploitation, sample hash, and event impact involved;

[0046] Step 2-2) Design the initial prompt word (Prompt) of the large prediction model based on the defined multi-dimensional feature attributes;

[0047] Step 2-3) Call the large language model interface, extract cases according to the initial prompt word settings, and store the cases in Chat-History;

[0048] Step 2-4) Input cybersecurity intelligence, design backward content feedback logic, and fine-tune and optimize prompt words until the extracted multi-dimensional feature attribute definitions meet the expected requirements;

[0049] Step 2-5) Based on the network security intelligence collected in real time, the multi-dimensional characteristic attributes of the corresponding threat intelligence are output in real time.

[0050] Step 3) constructing a network graph relational structure database of threat intelligence based on the multi-dimensional characteristic attributes of the extracted threat intelligence; each characteristic intelligence attribute in the relational structure database has a multi-dimensional attribute pointer for associating other threat intelligence;

[0051] Furthermore, if Figure 3 As shown, the specific steps of step 3) include:

[0052] According to the multi-dimensional characteristic attributes of the extracted threat intelligence, the operation interface of the mesh graph relational structure database is called to build the graph nodes of the corresponding attributes; the relational database can use the Neo4j relational database. The node characteristic values ​​are set according to the attribute requirements, such as the organization name involved in the attack organization node, the historical attack behavior pointer, etc.; finally, the mesh graph relational structure database of the threat intelligence is output.

[0053] Step 4) Construct a threat intelligence knowledge graph based on the mesh graph relational structure database;

[0054] Furthermore, if Figure 3 As shown, the specific steps of step 4) include:

[0055] Step 4-1) Match the multidimensional attribute node pointed to by the pointer and associate the relevant threat intelligence; if any attribute pointer of the multidimensional attribute node of the threat intelligence does not point to it, mark the threat intelligence as threat intelligence to be associated;

[0056] Step 4-2) Output all related threat intelligence connectivity graphs, and construct a threat intelligence knowledge graph by connecting the intelligence.

[0057] Step 5) Query the threat intelligence knowledge graph, mark the attack behavior characteristics, connect the attack behavior feature points, and generate the attack behavior feature subgraph.

[0058] Furthermore, the specific steps of step 5) include:

[0059] Step 5-1) Based on the attack type attributes, query the threat intelligence knowledge graph and mark the attack behavior characteristics and its victims;

[0060] Step 5-2) Concatenate attack behaviors and output abnormal attack behavior characteristics.

[0061] The present invention uses a large language model to extract multi-dimensional attributes of the collected threat intelligence, which can quickly and efficiently update the knowledge graph to output the latest abnormal attack behavior characteristics, thereby increasing the company's alertness to new attack threats.

[0062] The above description is only a specific implementation of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a technician familiar with the technical field within the technical scope disclosed by the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for aggregating threat intelligence and intelligently generating attack anomaly features based on a large language model, characterized in that: The specific steps include: Step 1) Obtaining network security intelligence from the open source threat intelligence community platform in real time, the network security intelligence including network security situation, organizational attack behavior and vulnerability summary; Step 2) optimizing the prompt words of the large language model according to predefined multidimensional feature attributes, and extracting multidimensional feature attributes of threat intelligence from the network security intelligence; the predefined multidimensional feature attributes include attack organizations, attack types, and victim groups; The specific steps of step 2) include: Step 2-1) Define corresponding threat intelligence multi-dimensional feature attributes for different threat intelligence subjects; Step 2-2) Design the initial prompt words of the large prediction model based on the defined multi-dimensional feature attributes; Step 2-3) Call the large language model interface, extract cases according to the initial prompt word settings, and store the cases in Chat-History; Step 2-4) Input cybersecurity intelligence, design backward content feedback logic, and fine-tune and optimize prompt words until the extracted multi-dimensional feature attribute definitions meet the expected requirements; Step 2-5) Based on the network security intelligence collected in real time, output the multi-dimensional characteristic attributes of the corresponding threat intelligence in real time; Step 3) constructing a network graph relational structure database of threat intelligence based on the multidimensional characteristic attributes of the extracted threat intelligence; each characteristic intelligence attribute in the relational structure database has a multidimensional attribute pointer for associating other threat intelligence; Step 4) constructing a threat intelligence knowledge graph based on the mesh graph relationship structure database; Step 5) querying the threat intelligence knowledge graph, marking attack behavior features, connecting attack behavior feature points, and generating an attack behavior feature subgraph.

2. The method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model according to claim 1 is characterized in that: The specific steps of step 3) include: According to the multi-dimensional characteristic attributes of the extracted threat intelligence, the operation interface of the relational database is called to construct the graph nodes of the corresponding attributes; the node characteristic values ​​are set according to the attribute requirements; and finally the mesh graph relational structure database of the threat intelligence is output.

3. The method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model according to claim 2 is characterized in that: The specific steps of step 4) include: Step 4-1) Match the multidimensional attribute node pointed to by the pointer and associate the relevant threat intelligence; if any attribute pointer of the multidimensional attribute node of the threat intelligence does not point to it, mark the threat intelligence as threat intelligence to be associated; Step 4-2) Output all related threat intelligence connectivity graphs and build a threat intelligence knowledge graph.

4. The method for intelligently generating threat intelligence aggregation and attack anomaly features based on a large language model according to claim 3 is characterized in that: The specific steps of step 5) include: Step 5-1) Based on the attack type attributes, query the threat intelligence knowledge graph and mark the attack behavior characteristics and its victims; Step 5-2: Concatenate attack behaviors and output abnormal attack behavior characteristics.

Images