Network risk assessment method and system based on multi-modal data pre-training model

Abstract

The invention relates to a network risk assessment method and system based on a multi-modal data pre-training model. The method comprises the following steps: firstly, collecting multi-source network security data, identifying threat event objects in the multi-source network security data, connecting the threat event objects in series into attack chains, and analyzing to obtain feature information and main attack nodes of each attack chain; risk level information of the attack chain is evaluated and generated; integrating the information, and generating and continuously recording a network security situation report; pre-constructing a network security situation knowledge base; and finally, matching and comparing the feature information of the attack chain with attack chain data in the network security situation knowledge base, predicting potential threat influence, and generating early warning information and protection strategy suggestions. Compared with the prior art, the method has the advantages that the method does not depend on predefined rules, is more suitable for complicated network scenes, and improves the reliability and accuracy of network security situation awareness.

Description

Technical Field

[0001] The present invention relates to the technical field of network security risk assessment, and in particular to a network risk assessment method and system based on a multimodal data pre-training model. Background Art

[0002] At present, in the field of network security situation awareness and risk assessment, existing methods that rely on rule detection and traditional machine learning are inefficient when processing multi-source, multi-modal data (such as logs, network traffic, and user behavior data), and it is difficult to achieve a comprehensive analysis of events and threats. In addition, traditional methods mainly rely on known attack patterns or preset rules and have poor adaptability to new threats (such as zero-day attacks), which makes it difficult to maintain efficient protection capabilities in a dynamic network environment.

[0003] In the security maintenance scenario of network systems, improving the accuracy of security situation awareness and risk assessment for new threats is the key to enhancing the protection capabilities of network systems. However, the existing methods have significant deficiencies in adaptability, real-time and scalability, which makes it difficult to effectively deal with complex and large-scale new threats. Existing network security situation awareness methods have great limitations in dealing with complex threats in new network systems. Although rule-based and signature-based detection technologies can quickly identify known threats, they are highly dependent on predefined rules and feature signatures, have poor adaptability to zero-day attacks and variant attacks, and have high maintenance costs for rules and feature libraries. Although machine learning methods can learn attack patterns from historical data, they are usually only applicable to structured data and are difficult to process a large amount of unstructured or semi-structured security data emerging in new network systems. In addition, machine learning models rely on a large amount of high-quality annotated data, which is expensive to obtain and has limited generalization capabilities. Although deep learning methods can recognize complex patterns to a certain extent, their limitations, such as high computational requirements for data and poor interpretability caused by the "black box" characteristics of the model, also limit their application in complex scenarios.

[0004] The invention patent with the publication number CN117978545B discloses a network security risk assessment method based on a large model. This method collects the original data of network security risk assessment to obtain the basic network security data set; sets data labels for the data set to obtain the risk assessment data label library; performs feature engineering analysis of network security risk assessment elements to obtain the risk assessment feature data set; determines the functional relationship between risk and risk results, constructs a large network security risk assessment model and conducts supervised training, verification analysis and model optimization; conducts network security risk assessment on the actual network system to obtain the network security risk assessment results; establishes a linkage mechanism between the assessment results and the protection strategy, continuously conducts network security risk assessment and strategy linkage, and optimizes the network security risk assessment results. However, this method still has the problem of poor adaptability to zero-day attacks and variant attacks, and high maintenance costs of rules and feature libraries. Summary of the invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and to provide a network risk assessment method and system based on a multimodal data pre-training model.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] According to one aspect of the present invention, a network risk assessment method based on a multimodal data pre-training model is provided. The method is based on a pre-trained and fine-tuned network security vertical model, and integrates association analysis technology with retrieval-augmented generation (RAG) technology to perform network risk assessment. The method steps include:

[0008] S1. Collect multi-source network security data, pre-process and semantically process it, and establish correlations between events in the network security data;

[0009] S2. Based on the network security vertical model, identify threat event objects in network security data, and based on the established association relationships, connect the threat event objects in series into multiple complete attack chains, and further analyze them to extract the feature information and main attack nodes of each attack chain;

[0010] S3. Based on the characteristic information of each attack chain, the risk level information of the attack chain is evaluated and generated based on the network security vertical model;

[0011] S4. Integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report;

[0012] S5. Based on historical attack chain data and known threat behaviors, a network security situation knowledge base covering different attack chain modes, development paths and protection strategies is pre-built;

[0013] S6. Based on the network security vertical model, match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict the potential threat impact, and generate early warning information and protection strategy recommendations.

[0014] As a preferred technical solution, the pre-training of the security vertical large model is to train the InternLM2.5-7B base large language model with network security related corpus, and the fine-tuning is to use network security related questions and answers to fine-tune the pre-trained large model to enable it to have the reasoning ability to answer network security questions.

[0015] As a preferred technical solution, the sources of the multi-source network security data in S1 include network logs, traffic data and user behavior records, and the preprocessing includes cleaning, denoising and format conversion of the multi-source network security data.

[0016] As a preferred technical solution, establishing associations between events in network security data in S1 specifically includes: establishing associations between events in network security data according to source, category, time sequence and logical relationship.

[0017] As a preferred technical solution, S2 identifies the threat event object to extract key threat elements, which are then converted into a standard JSON format event object; the key threat elements include event ID, timestamp, threat source, threat type, impact scope, event description and confidence.

[0018] As a preferred technical solution, the characteristic information in S2 includes the length of the attack chain, the node attack content, the attack complexity and the asset value of the attack target.

[0019] As a preferred technical solution, the specific steps of evaluating and generating the risk level information of the attack chain in S3 are: using a large network security vertical model based on pre-training and fine-tuning, according to the characteristic information of each attack chain, the corresponding attack chain is risk evaluated, and the risk level evaluation result is given to help the security team respond to high-risk events in priority;

[0020] The risk level assessment results include four levels: low, medium, high and very high.

[0021] As a preferred technical solution, the protection strategy in S5 includes: the effective protection strategy proposed by network security experts based on the existing attack chain and the protection strategy for related attack behaviors in the existing network security knowledge base.

[0022] As a preferred technical solution, S6 specifically uses RAG technology to match and compare the attack chain in the current report with the attack chain in the network security situation knowledge base.

[0023] According to another aspect of the present invention, a network risk assessment system based on a multimodal data pre-training model is provided, the system is applied to work by a network risk assessment method based on a multimodal data pre-training model as described above, the system includes a data collection and preprocessing module, a risk assessment module, a situation report and knowledge base construction module and an early warning and strategy recommendation module;

[0024] The data collection and preprocessing module is used to collect multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects therein;

[0025] The attack chain building module is used to establish associations between threat event objects, so as to connect them in series into multiple complete attack chains, and analyze and obtain characteristic information and main attack nodes of each attack chain;

[0026] The risk assessment module is used to assess and generate the risk level of each attack chain according to the characteristic information of the attack chain;

[0027] The situation report and knowledge base construction module is used to integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report; and based on the historical attack chain data and known threat behaviors, pre-build a network security situation knowledge base covering different attack chain modes, development paths and protection strategies; the early warning and strategy recommendation module is used to match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict potential threat impacts, and generate early warning information and protection strategy recommendations.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. The network risk assessment method in the present invention is based on a pre-trained and fine-tuned network security vertical model, and integrates association analysis with RAG technology to perform network risk assessment. The method collects multi-source network security data, pre-processes and semantically processes it, and identifies the threat event objects therein based on the network security vertical model, and connects them into attack chains, and analyzes to obtain the characteristic information and main attack nodes of each attack chain; then, based on the characteristic information of each attack chain, the risk level information of the attack chain is evaluated and generated based on the network security vertical model; then, the characteristic information, main attack nodes and their risk level information of the attack chain are integrated to generate and continuously record the network security situation report; based on historical attack chain data and known threat behaviors, a network security situation knowledge base covering different attack chain modes, development paths and protection strategies is pre-constructed; finally, the characteristic information of the attack chain is matched and compared with the attack chain data in the network security situation knowledge base to predict potential threat impacts and generate early warning information and protection strategy recommendations. This method does not rely on predefined rules. Instead, it automatically learns the deep features and semantic associations of attacks through pre-training on massive multimodal data, capturing the potential patterns and associations of attack behaviors in complex scenarios. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavioral characteristics or abnormal log information, and further provide corresponding explainable decisions, thereby improving the reliability of network security situation awareness.

[0030] 2. The network security vertical model used in the present invention is based on pre-trained and fine-tuned large model. The pre-training is to train the InternLM2.5-7B base language model with network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model with network security related questions and answers, so that it has the reasoning ability to answer network security questions. It has a strong ability to process multimodal data, automatic threat factor identification and dynamic event association, which can effectively make up for the shortcomings of traditional network security situation awareness and risk assessment methods. Its powerful context understanding, semantic analysis and logical reasoning capabilities make it more accurate for network security situation awareness and risk assessment tasks.

[0031] 3. The sources of multi-source network security data in the present invention include network logs, traffic data and user behavior records, and associations are established between threat event objects according to threat event sources, threat event categories, time sequence and logical relationships. The network system's ability to integrate and analyze large-scale, multi-source threat data is significantly improved, and a structured attack chain and network security situation report is generated through semantic data processing and association analysis of homologous or similar event objects.

[0032] 4. The present invention combines the content of the security situation knowledge base, matches and compares the attack chain in the current report with the attack chain in the network security situation knowledge base, and uses RAG technology to accurately predict future potential attack behaviors and automatically generate early warning and protection strategies, effectively improving the network security protection capabilities. It has significant advantages in improving the breadth and depth of network system situation awareness, and provides innovative solutions for dealing with new and complex network threats.

[0033] 5. After identifying the threat event object, the present invention converts the threat event object into a standard JSON format event object, and uses a structured JSON format to clearly express each data feature information, further effectively integrating the information, giving the data features contextual meaning, and making the correlation and overall trend between different data features more obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A method flow chart of a network risk assessment method based on a multimodal data pre-training model in the present invention;

[0035] Figure 2 This is a code example diagram for semantic processing of power network data in an embodiment;

[0036] Figure 3 This is a code example diagram for converting events in standard JSON format in the embodiment;

[0037] Figure 4 This is a code example diagram of the threat event object after integration in the embodiment;

[0038] Figure 5 This is a code example diagram of a power network security situation report in an embodiment;

[0039] Figure 6 This is a code example diagram for the output of the power network security situation prediction in the embodiment. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] At present, in the field of network security situation awareness and risk assessment, existing methods that rely on rule detection and traditional machine learning are inefficient when processing multi-source, multi-modal data (such as logs, network traffic, and user behavior data), and it is difficult to achieve a comprehensive analysis of events and threats. In addition, traditional methods mainly rely on known attack patterns or preset rules and have poor adaptability to new threats (such as zero-day attacks), which makes it difficult to maintain efficient protection capabilities in a dynamic network environment.

[0042] The rapid development of large language models has provided a new idea for network security situational awareness. Through pre-training and fine-tuning on multimodal data, large language models have greatly improved the basic ability to process and analyze heterogeneous data such as text logs, network traffic, and user behavior. At the same time, its excellent contextual understanding and semantic reasoning capabilities enable it to effectively analyze complex attack chains from related events, thereby realizing automated attack chain generation and risk analysis, which helps to capture complex new threats. In addition, with the help of external knowledge bases and reasoning capabilities, large language models can automatically generate effective and reliable security strategies and response measures based on risk levels, further improving the automation and intelligence level of network system security situational awareness.

[0043] In the security maintenance scenario of network systems, improving the accuracy of security situation awareness and risk assessment for new threats is the key to enhancing the protection capabilities of network systems. However, the existing methods have significant deficiencies in adaptability, real-time and scalability, which makes it difficult to effectively deal with complex and large-scale new threats. Through investigation and analysis of the current research status at home and abroad, it is found that the existing network security situation awareness methods have great limitations in dealing with complex threats in new network systems. Although rule-based and signature-based detection technology can quickly identify known threats, it is highly dependent on predefined rules and feature signatures, has poor adaptability to zero-day attacks and variant attacks, and has high maintenance costs for rule and feature libraries.

[0044] The method based on pre-training large models with multimodal data does not rely on predefined rules. Instead, it automatically learns the deep-level features and semantic associations of attacks through pre-training on massive multimodal data, capturing the potential patterns and associations of attack behaviors in complex scenarios. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavioral characteristics or abnormal log information, and further provide corresponding explainable decisions.

[0045] Example 1

[0046] In this embodiment, a network risk assessment method based on a multimodal data pre-training model is applied. The process framework of the method is as follows: Figure 1As shown in the figure, based on the pre-trained and fine-tuned network security vertical model, association analysis and RAG technology are integrated to perform network risk assessment. The method steps include:

[0047] S1. Collect multi-source network security data, pre-process and semantically process it, and establish correlations between events in the network security data;

[0048] S2. Based on the network security vertical model, identify threat event objects in network security data, and based on the established association relationships, connect the threat event objects in series into multiple complete attack chains, and further analyze them to extract the feature information and main attack nodes of each attack chain;

[0049] S3. Based on the characteristic information of each attack chain, the risk level information of the attack chain is evaluated and generated based on the network security vertical model;

[0050] S4. Integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report;

[0051] S5. Based on historical attack chain data and known threat behaviors, a network security situation knowledge base covering different attack chain modes, development paths and protection strategies is pre-built;

[0052] S6. Based on the network security vertical model, match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict the potential threat impact, and generate early warning information and protection strategy recommendations.

[0053] In this solution, a pre-trained and fine-tuned network security vertical category large language model is selected to realize the element perception, situation understanding and situation prediction of power network security. The pre-trained and fine-tuned network security vertical category large model is based on the open source InternLM2.5-7B base large language model trained with a large amount of network security related corpus, and the fine-tuning is to use network security related question and answer pairs to fine-tune the pre-trained large model, so that it has the reasoning ability to answer network security questions.

[0054] In this embodiment, firstly, multi-source collection, processing and semantic processing of power network security data and automatic identification of threat elements in the data are performed. The original data of power network security is collected using network logs, traffic data and user behavior data as data sources, and the collected original data is further cleaned, denoised and format converted. Specifically, data cleaning and denoising algorithms are used to delete missing values, duplicate values ​​and abnormally fluctuating data, such as filtering noise peaks in the data through the triple exponential smoothing method. Secondly, semantic processing of power network data is achieved by designing corresponding text description templates for different data sources, that is, using structured JSON format to store data features to enhance the contextual information of the features, and also lay the foundation for the subsequent identification of threat elements by large vertical models of network security. Among them, the semantic template of power network traffic data includes timestamp, source IP, destination IP, request method, response code, traffic peak, and average delay fields, while the semantic template fields of user behavior data include timestamp, user ID, behavior type, access frequency, session duration, and peak access period. An example of the semantic result of power network data is as follows: Figure 2 shown.

[0055] Secondly, the pre-trained and fine-tuned network security vertical language model is used to automatically identify the threat event objects in the semanticized multi-source data. At the same time, the key threat elements of the threat event objects need to be further extracted, including event ID, timestamp, threat source, threat type, impact range, description and confidence. The identified threat event objects and their threat elements need to be further converted into standard JSON format event objects to facilitate the subsequent perception and prediction of the overall security situation of the power network by the network security vertical model. The code example is as follows: Figure 3 shown.

[0056] In this embodiment, the specific process of analyzing and constructing the attack chain and generating the power network security situation and risk assessment report is as follows: based on the above analysis, the algorithm is first used to automatically generate and embed the association relationship between attacks, that is, the identified events of the same source (multiple attacks initiated by the same IP or source) and the same type (different sources but with similar attack modes) are classified and integrated, and the causal relationship and time sequence relationship structure fields (such as "previous_event_id" and "next_event_id") are embedded in the integrated event objects of the same source or the same type to achieve the association of the internal time sequence relationship or logical relationship of the events of the same source or the same type. The code example of the integrated event object is as follows: Figure 4 shown.

[0057] Subsequently, based on the threat event objects that have been integrated and embedded in the relationship structure, the network security vertical model is used to conduct an in-depth analysis of the timing information and potential causal relationships of homologous or similar event objects, automatically generate a complete attack chain, and accurately describe the association and evolution path between events. At the same time, in the process of generating the attack chain, the network security vertical model further conducts a risk assessment of the entire chain based on the length of the attack chain, the complexity of the attack, the value of the target asset and its potential impact, and provides risk level assessment results at four levels: low, medium, high and extremely high, to help the security team prioritize responding to high-risk events. Based on the above analysis results, the network security vertical model automatically generates a structured network security situation report according to instructions, which includes a detailed description of the attack chain, key nodes, potential threat impacts and risk levels, to help the security team quickly understand the overall security situation and risk status of the network. The code example of the power network security situation report is as follows: Figure 5 shown.

[0058] In this embodiment, the specific process of generating power network security situation prediction and protection strategy recommendations is as follows: First, based on historical attack chain data and known threat behaviors, a security situation knowledge base containing different types of attack chain patterns, development paths, and protection strategies is constructed, and the knowledge base content is continuously updated as new attack patterns emerge to ensure that it can provide accurate knowledge support for the large model. Subsequently, the network security vertical model matches the current attack chain with the attack pattern in the knowledge base through RAG technology based on the situation report content generated in step 2, and combines the matched knowledge base content for contextual understanding and reasoning analysis to predict the potential development direction of the attack chain and possible next actions.

[0059] In this embodiment, the protection strategies include: effective protection strategies proposed by network security experts based on existing attack chains and protection strategies for related attack behaviors in the existing network security knowledge base.

[0060] On this basis, the network security vertical model will further automatically generate warning information and corresponding protection suggestions based on the protection strategies in the knowledge base, such as enabling multi-factor authentication, strengthening sensitive data access monitoring, and restricting specific IP access. The above warning information and strategy suggestions are output in a structured JSON format to ensure content standardization and easy integration, thereby helping the security team to respond to potential threats more efficiently and improve protection effects. The code example of the output of the network security vertical model for power network security situation prediction is as follows: Figure 6 shown.

[0061] For the power network security situation awareness and risk assessment tasks, some mixed data sets containing normal operations and abnormal behaviors were collected from the network traffic data, system logs and user behavior data in the actual operating environment of the power network system to evaluate the effectiveness of the method. Considering that the large model not only needs to accurately identify the attack event chain in the power network security situation awareness and risk assessment tasks, but also needs to propose correct countermeasures for potential attack behaviors, we use accuracy and cosine similarity as indicators for evaluation. Cosine similarity is mainly used to evaluate the similarity between the countermeasures proposed by the network security large model for attack behaviors and the standard countermeasures, thereby reflecting the correctness of the countermeasures proposed by the large model. The evaluation results are shown in Table 1. The accuracy of the network security vertical large model + correlation analysis + RAG method has been significantly improved. The comparison results of cosine similarity also show that the present invention can propose more correct countermeasures for attack behaviors identified from the network system.

[0062] Table 1 Evaluation of power network security situation awareness and risk assessment tasks

[0063]

[0064] In summary, this method does not rely on predefined rules, but captures the potential patterns and associations of attack behaviors in complex scenarios by automatically learning the deep-level features and semantic associations of attacks through pre-training on massive multimodal data. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavioral characteristics or abnormal log information, and further provide corresponding explainable decisions, thereby improving the reliability of network security situation awareness.

[0065] Example 2

[0066] In this embodiment, a network risk assessment system based on a multimodal data pre-training model is applied, which includes a data collection and pre-processing module, a risk assessment module, a situation reporting and knowledge base construction module, and an early warning and strategy recommendation module;

[0067] The data collection and preprocessing module is used to collect multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects;

[0068] The attack chain building module is used to establish associations between threat event objects, connect them in series into multiple complete attack chains, and analyze the characteristic information and main attack nodes of each attack chain;

[0069] The risk assessment module is used to assess and generate the risk level of each attack chain based on the characteristic information of the attack chain;

[0070] The situation report and knowledge base construction module is used to integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report; and based on the historical attack chain data and known threat behaviors, pre-build a network security situation knowledge base covering different attack chain modes, development paths and protection strategies;

[0071] The early warning and strategy recommendation module is used to match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict the potential threat impact, and generate early warning information and protection strategy recommendations.

[0072] In this solution, a pre-trained and fine-tuned network security vertical category large language model is selected to realize the element perception, situation understanding and situation prediction of power network security. The pre-trained and fine-tuned network security vertical category large model is based on the open source InternLM2.5-7B base large language model trained with a large amount of network security related corpus, and the fine-tuning is to use network security related question and answer pairs to fine-tune the pre-trained large model, so that it has the reasoning ability to answer network security questions.

[0073] In this embodiment, firstly, multi-source collection, processing and semantic processing of power network security data and automatic identification of threat elements in the data are performed. The original data of power network security is collected using network logs, traffic data and user behavior data as data sources, and the collected original data is further cleaned, denoised and format converted. Specifically, data cleaning and denoising algorithms are used to delete missing values, duplicate values ​​and abnormally fluctuating data, such as filtering noise peaks in the data through the triple exponential smoothing method. Secondly, semantic processing of power network data is achieved by designing corresponding text description templates for different data sources, that is, using structured JSON format to store data features to enhance the contextual information of the features, and also lay the foundation for the subsequent identification of threat elements by large vertical models of network security. Among them, the semantic template of power network traffic data includes timestamp, source IP, destination IP, request method, response code, traffic peak, and average delay fields, while the semantic template fields of user behavior data include timestamp, user ID, behavior type, access frequency, session duration, and peak access period. An example of the semantic result of power network data is as follows: Figure 2 shown.

[0074] Secondly, the pre-trained and fine-tuned network security vertical language model is used to automatically identify the threat event objects in the semanticized multi-source data. At the same time, the key threat elements of the threat event objects need to be further extracted, including event ID, timestamp, threat source, threat type, impact range, description and confidence. The identified threat event objects and their threat elements need to be further converted into standard JSON format event objects to facilitate the subsequent perception and prediction of the overall security situation of the power network by the network security vertical model. The code example is as follows: Figure 3 shown.

[0075] In this embodiment, the specific process of analyzing and constructing the attack chain and generating the power network security situation and risk assessment report is as follows: based on the above analysis, the algorithm is first used to automatically generate and embed the association relationship between attacks, that is, the identified events of the same source (multiple attacks initiated by the same IP or source) and the same type (different sources but with similar attack modes) are classified and integrated, and the causal relationship and time sequence relationship structure fields (such as "previous_event_id" and "next_event_id") are embedded in the integrated event objects of the same source or the same type to achieve the association of the internal time sequence relationship or logical relationship of the events of the same source or the same type. The code example of the integrated event object is as follows: Figure 4 shown.

[0076] Subsequently, based on the threat event objects that have been integrated and embedded in the relationship structure, the network security vertical model is used to conduct an in-depth analysis of the timing information and potential causal relationships of homologous or similar event objects, automatically generate a complete attack chain, and accurately describe the association and evolution path between events. At the same time, in the process of generating the attack chain, the network security vertical model further conducts a risk assessment of the entire chain based on the length of the attack chain, the complexity of the attack, the value of the target asset and its potential impact, and provides risk level assessment results at four levels: low, medium, high and extremely high, to help the security team prioritize responding to high-risk events. Based on the above analysis results, the network security vertical model automatically generates a structured network security situation report according to instructions, which includes a detailed description of the attack chain, key nodes, potential threat impacts and risk levels, to help the security team quickly understand the overall security situation and risk status of the network. The code example of the power network security situation report is as follows: Figure 5 shown.

[0077] In this embodiment, the specific process of generating power network security situation prediction and protection strategy recommendations is as follows: First, based on historical attack chain data and known threat behaviors, a security situation knowledge base containing different types of attack chain patterns, development paths, and protection strategies is constructed, and the knowledge base content is continuously updated as new attack patterns emerge to ensure that it can provide accurate knowledge support for the large model. Subsequently, the network security vertical model matches the current attack chain with the attack pattern in the knowledge base through RAG technology based on the situation report content generated in step 2, and combines the matched knowledge base content for contextual understanding and reasoning analysis to predict the potential development direction of the attack chain and possible next actions.

[0078] In this embodiment, the protection strategies include: effective protection strategies proposed by network security experts based on existing attack chains and protection strategies for related attack behaviors in the existing network security knowledge base.

[0079] On this basis, the network security vertical model will further automatically generate warning information and corresponding protection suggestions based on the protection strategies in the knowledge base, such as enabling multi-factor authentication, strengthening sensitive data access monitoring, and restricting specific IP access. The above warning information and strategy suggestions are output in a structured JSON format to ensure content standardization and easy integration, thereby helping the security team to respond to potential threats more efficiently and improve protection effects. The code example of the output of the network security vertical model for power network security situation prediction is as follows: Figure 6 shown.

[0080] For the power network security situation awareness and risk assessment tasks, some mixed data sets containing normal operations and abnormal behaviors were collected from the network traffic data, system logs and user behavior data in the actual operating environment of the power network system to evaluate the effectiveness of the method. Considering that the large model not only needs to accurately identify the attack event chain in the power network security situation awareness and risk assessment tasks, but also needs to propose correct countermeasures for potential attack behaviors, we use accuracy and cosine similarity as indicators for evaluation. Cosine similarity is mainly used to evaluate the similarity between the countermeasures proposed by the network security large model for attack behaviors and the standard countermeasures, thereby reflecting the correctness of the countermeasures proposed by the large model. The evaluation results are shown in Table 1. The accuracy of the network security vertical large model + correlation analysis + RAG method has been significantly improved. The comparison results of cosine similarity also show that the present invention can propose more correct countermeasures for attack behaviors identified from the network system.

[0081] Table 1 Evaluation of power network security situation awareness and risk assessment tasks

[0082]

[0083] In summary, this method does not rely on predefined rules, but captures the potential patterns and associations of attack behaviors in complex scenarios by automatically learning the deep-level features and semantic associations of attacks through pre-training on massive multimodal data. Therefore, even if zero-day attacks or variant attacks do not appear in the training data, the model can still infer whether there is a potential threat based on similar behavioral characteristics or abnormal log information, and further provide corresponding explainable decisions, thereby improving the reliability of network security situation awareness.

[0084] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network risk assessment method based on a multimodal data pre-training model, characterized in that: This method is based on a pre-trained and fine-tuned network security vertical model, and combines association analysis technology with RAG technology to perform network risk assessment. The method steps include: S1. Collect multi-source network security data, pre-process and semantically process it, and establish correlations between events in the network security data; S2. Based on the network security vertical model, identify threat event objects in network security data, and based on the established association relationships, connect the threat event objects in series into multiple complete attack chains, and further analyze them to extract the feature information and main attack nodes of each attack chain; S3. Based on the characteristic information of each attack chain, the risk level information of the attack chain is evaluated and generated based on the network security vertical model; S4. Integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report; S5. Based on historical attack chain data and known threat behaviors, a network security situation knowledge base covering different attack chain modes, development paths and protection strategies is pre-built; S6. Based on the network security vertical model, match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict the potential threat impact, and generate early warning information and protection strategy recommendations.

2. According to claim 1, a network risk assessment method based on a multimodal data pre-training model is characterized in that: The described large model of the network security vertical category that has been pre-trained and fine-tuned, the pre-training is to train the InternLM2.5-7B base large language model with network security related corpus, and the fine-tuning is to fine-tune the pre-trained large model with network security related questions and answers, so that it has the reasoning ability to answer network security questions.

3. The network risk assessment method based on a multimodal data pre-training model according to claim 1 is characterized in that: The sources of the multi-source network security data in S1 include network logs, traffic data and user behavior records, and the preprocessing includes cleaning, denoising and format conversion of the multi-source network security data.

4. According to claim 1, a network risk assessment method based on a multimodal data pre-training model is characterized in that: The establishment of association relationships between events in the network security data in S1 specifically includes: establishing associations between events in the network security data according to source, category, time sequence and logical relationship.

5. The network risk assessment method based on a multimodal data pre-training model according to claim 1 is characterized in that: The threat event object is identified in S2 to extract key threat elements, which are then converted into a standard JSON format event object; the key threat elements include event ID, timestamp, threat source, threat type, impact scope, event description and confidence.

6. The network risk assessment method based on a multimodal data pre-training model according to claim 1 is characterized in that: The characteristic information in S2 includes the length of the attack chain, the node attack content, the attack complexity and the asset value of the attack target.

7. The network risk assessment method based on a multimodal data pre-training model according to claim 1 is characterized in that: The specific steps of evaluating and generating the risk level information of the attack chain in S3 are: using a pre-trained and fine-tuned network security vertical model, according to the characteristic information of each attack chain, performing risk assessment on the corresponding attack chain, and providing a risk level assessment result to help the security team prioritize responding to high-risk events; The risk level assessment results include four levels: low, medium, high and very high.

8. The network risk assessment method based on a multimodal data pre-training model according to claim 1 is characterized in that: The protection strategies in S5 include: effective protection strategies proposed by network security experts based on existing attack chains and protection strategies for related attack behaviors in the existing network security knowledge base.

9. The network risk assessment method based on a multimodal data pre-training model according to claim 1, characterized in that: The S6 specifically uses the RAG technology to match and compare the attack chain in the current report with the attack chain in the network security situation knowledge base.

10. A network risk assessment system based on a multimodal data pre-training model, characterized in that: The system is applied to work by a network risk assessment method based on a multimodal data pre-training model as described in any one of claims 1 to 9, the system comprising a data acquisition and pre-processing module, a risk assessment module, a situation report and knowledge base construction module, and an early warning and strategy recommendation module; The data collection and preprocessing module is used to collect multi-source network security data, perform data preprocessing and semantic processing, and identify threat event objects therein; The attack chain building module is used to establish associations between threat event objects, so as to connect them in series into multiple complete attack chains, and analyze and obtain characteristic information and main attack nodes of each attack chain; The risk assessment module is used to assess and generate the risk level of each attack chain according to the characteristic information of the attack chain; The situation report and knowledge base construction module is used to integrate the characteristic information of the attack chain, the main attack nodes and their risk level information, generate and continuously record the network security situation report; and based on the historical attack chain data and known threat behaviors, pre-build a network security situation knowledge base covering different attack chain modes, development paths and protection strategies; The warning and strategy recommendation module is used to match and compare the characteristic information of the attack chain with the attack chain data in the network security situation knowledge base, predict the potential threat impact, and generate warning information and protection strategy recommendations.

Images