Electric power honeypot construction method and system based on large language model

Abstract

The invention provides an electric power honeypot construction method and system based on a large language model, and relates to the technical field of network security, and the method comprises the steps: constructing a virtual web server on an original web server, analyzing the request information of a user through a camouflage agent and a request filtering strategy, and dividing the user into a normal user and an attack user; extracting key semantic information according to inquiry information input by an attack user; performing association mapping on the key semantic information and an electric power knowledge graph to obtain an attack intention; according to the attack intention and the request information, virtual power service information is constructed through a large language model and fed back to the attack user, and attack behavior information is obtained; the attack type and the risk level of the attacking user are evaluated, the power deception strategy of the large language model is formulated based on the attack type and the risk level, and the virtual power service information is adjusted, and the technical problem that the defense security is reduced due to the static performance of the honeypot technology in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for constructing an electric power honeypot based on a large language model. Background Art

[0002] With the advancement of the global energy internet, the power system is undergoing a profound transformation from traditional power grids to smart grids. Emerging technologies such as cloud computing, big data, the Internet of Things, and 5G are deeply integrated with the power system. A large number of power devices, such as smart meters, distributed power sources, and substation automation systems, are now connected to the network, making the power system's network architecture increasingly complex. Web servers, as the core carriers for remote monitoring, data exchange, and user management in the power system, play a critical role. However, this digital transformation also brings unprecedented cybersecurity risks. A cyberattack on the power system could lead to power outages and equipment damage.

[0003] Honeypot technology is a proactive defense measure in network security. Its basic principle is to set up fake network resources within the network, simulating the behavior and characteristics of real systems to attract attackers. By monitoring and analyzing attackers' behavior within the honeypot, security personnel can obtain important information such as attack methods and intent, providing a basis for defense. However, honeypot technology has some limitations. First, honeypots are static and easily detected by advanced attackers. Furthermore, honeypot technology relies on prior knowledge and a rule base, which can lead to false positives and false negatives for unknown attacks. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to provide a method and system for constructing an electric power honeypot based on a large language model, so as to solve the problem that the static performance of the honeypot technology in the background technology reduces the defense security.

[0005] In one aspect, the present invention provides a method for constructing an electric power honeypot based on a large language model, the method comprising: Build a virtual web server on the original web server, analyze user request information through camouflage proxy and request filtering strategy, and divide users into normal users and attack users; Extracting key semantic information through a bidirectional long short-term memory network based on query information input by the attacking user in the virtual web server; Correlate and map the key semantic information with the information in the preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; According to the attack intention and request information in the interaction process, a large language model is used to build virtual power business information in the virtual web server and feed it back to the attack user interaction to obtain attack behavior information; According to the attack behavior information, the attack type and risk level of the attacking user are evaluated, and based on the attack type and risk level, the power deception strategy of the large language model is formulated and the virtual power business information is adjusted.

[0006] Compared with the existing technology, the beneficial effect of the present invention is that: through the supervised fine-tuning of the large language model and reinforcement learning optimization of the power knowledge graph, the honeypot technology can realize intelligent interaction with the attacking user, accurately identify the attack behavior information of the attacking user, and dynamically adjust the power deception strategy to enhance the deceptiveness of the honeypot technology, thereby solving the technical problem that the static performance of the honeypot technology reduces the defense security.

[0007] According to one aspect of the above technical solution, a virtual web server is constructed on the original web server, and the user's request information is analyzed through a disguised proxy and request filtering strategy, and the users are divided into normal users and attacking users. The steps specifically include: A virtual web server is built on the original web server. Through camouflage proxy and request filtering strategy, the user's request information is analyzed and the users are divided into normal users and attack users. The request information includes the request source, behavior pattern and request characteristics. Forward the normal user agent to the original web server and guide the attacking user to access the virtual web server.

[0008] According to one aspect of the above technical solution, based on the attack intention and request information during the interaction process, the steps of constructing virtual power business information in the virtual web server through a large language model and feeding it back to the attacking user interaction to obtain the attack behavior information specifically include: The large language model is combined with historical power data based on time information, climate information, attack intent and request information, and fine-tuned through supervision by the physical constraint function in the power knowledge graph to construct virtual power business information feedback to the attack user interaction; Extract semantic features from text data during the interaction process through a large language model; Extract network traffic features from network traffic data during the interaction process through a large language model; The semantic features and the network traffic features are fused to obtain attack behavior information.

[0009] According to one aspect of the above technical solution, the method further includes: Calculate the minimum distance between each sample in the attack behavior information and the attack cluster in the historical behavior information in the attack database; Determining whether the minimum distance is less than a distance threshold; If yes, assign the sample to the attack cluster and update the attack database; If not, perform unsupervised clustering calculation on the sample to generate a potential new attack cluster, review the potential new attack cluster, and update the potential new attack cluster to the attack database through the incremental learning network.

[0010] According to one aspect of the above technical solution, after performing unsupervised clustering calculation on the samples to generate potential new attack clusters, reviewing the potential new attack clusters, and updating the potential new attack clusters into the attack database through an incremental learning network, the method further includes: Performing semantic analysis on the text information in the potential new attack cluster using a large language model, performing correlation analysis on the text information with the semantic features in the attack cluster to obtain a correlation value, and determining whether the correlation value reaches a correlation threshold; If so, it is defined as a variant, and the potential new attack cluster is marked as a related cluster; If not, it is defined as unrelated, and the potential new attack cluster is marked as a new attack cluster.

[0011] According to one aspect of the above technical solution, the step of evaluating the attack type and risk level of the attacking user based on the attack behavior information specifically includes: Obtaining an attack weight vector and a factor scoring function based on the attack behavior information, wherein the attack behavior information includes an attack type, an attack factor, and corresponding factor data; Calculate the score of each attack factor based on the corresponding factor data and factor scoring function; Calculate the risk score based on the score of each attack factor and the attack weight vector; Risk levels are divided according to the risk scores.

[0012] According to one aspect of the above technical solution, the method further includes: A reinforcement learning algorithm is introduced into the large language model. The state space is used as the base value, and the effect of defending against attacks during the interaction process is used as the reward signal to iteratively optimize the power deception strategy of the large language model. The state space includes the current security status of the virtual web server, the current behavior pattern of the attacking user, and the current power deception strategy. The defense attack effect includes the information richness of the attacking user, the effect of guiding the attacking user to expose information, the loss reduction degree of defense, and the risk of security vulnerability attack caused by defense.

[0013] According to one aspect of the above technical solution, a reinforcement learning algorithm is introduced into the large language model, and the steps of iteratively optimizing the power deception strategy of the large language model are performed using the state space as the basic value and the effect of defending against attacks during the interaction as the reward signal. Specifically, the steps include: According to the state space, an initialized state function is established to obtain the effect of the initialized defense attack; According to the effect of the initial defense attack, use -greedy algorithm selects the next electricity cheating strategy; Execute the next step of the power deception strategy to interact with the attacking user to obtain a new state space and the effect of defending against the attack; Based on the new state space and the effectiveness of the defensive attack, the state function is updated using the Q-learning or DQN formula until iterative optimization converges.

[0014] According to one aspect of the above technical solution, the method further includes: According to the attacking user's behavior pattern, the fault type is obtained based on the power knowledge graph, and the fault feature description text corresponding to the fault type is obtained. According to the fault parameters adjusted by the attacking user, the current operating data and the fault feature description text, a structured text prompt is constructed; Based on the structured text prompt, generating abnormal data on a virtual web server through a large language model; The rationality of abnormal data is verified through the physical constraint function in the power knowledge graph; A corresponding digital signal is generated according to the fault duration and characteristics in the abnormal data.

[0015] Another aspect of the present invention provides a system for constructing a power honeypot based on a large language model, the system being configured to execute the above-mentioned method for constructing a power honeypot based on a large language model, the system comprising: The virtual server construction module is used to build a virtual web server on the original web server. It analyzes user request information through camouflage proxy and request filtering strategy, and divides users into normal users and attack users. A key semantic extraction module, configured to extract key semantic information through a bidirectional long short-term memory network based on query information input by an attacking user into the virtual web server; An association mapping module is used to associate and map the key semantic information with information in a preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; The attack behavior acquisition module is used to construct virtual power business information in the virtual web server through a large language model based on the attack intention and request information during the interaction process and feedback it to the attack user interaction to obtain attack behavior information; A deception strategy formulation module is used to evaluate the attack type and risk level of the attacking user according to the attack behavior information, and based on the attack type and risk level, formulate the power deception strategy of the large language model and adjust the virtual power business information. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a flow chart of a method for constructing a power honeypot based on a large language model in Example 1 of the present invention; Figure 2 This is a block diagram of the system structure for constructing a power honeypot based on a large language model in the second embodiment of the present invention; Component symbol description: Virtual server construction module 100, key semantic extraction module 200, association mapping module 300, attack behavior acquisition module 400, deception strategy formulation module 500; The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0017] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate several embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.

[0018] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0019] Example 1 See also Figure 1 , shown is a method for constructing a power honeypot based on a large language model in the first embodiment of the present invention, including steps S10 to S14.

[0020] Step S10: construct a virtual web server on the original web server, analyze user request information through camouflage proxy and request filtering strategy, and divide users into normal users and attack users; Specifically, a virtual web server is built on the original web server. Through camouflage proxy and request filtering strategy, the user's request information is analyzed and the users are divided into normal users and attacking users. The request information includes the request source, behavior pattern and request characteristics. Forward the normal user agent to the original web server and guide the attacking user to access the virtual web server.

[0021] It should be noted that through the use of camouflage proxy and request filtering strategies, it is possible to effectively avoid interference of fake Web servers on real access, while at the same time protecting the system from attacks to the greatest extent possible.

[0022] As an example, not a limitation, using a large language model to generate a virtual web server can quickly create a seemingly complete virtual web server by simulating both the frontend and backend. The backend uses a framework like Flask to create a fake API interface, processing frontend requests and returning pre-set fake data (such as login verification, payment processing, user information, etc.). The frontend, on the other hand, uses HTML, CSS, and JavaScript to build a simple interface. After the user enters data, a fetch request is sent to the backend, which then displays the fake response.

[0023] Among them, Flask: a lightweight web framework of Python, used to quickly build web applications; API (Application Programming Interface): application programming interface; HTML (HyperText Markup Language): hypertext markup language, used to build the structure of web pages; CSS (Cascading Style Sheets): cascading style sheets, responsible for beautifying web pages; JavaScript: a programming language for web page interaction logic, allowing pages to respond to user operations; fetch: an API in JavaScript used to initiate network requests, allowing the front end to send requests to the back end (such as the API written in Flask) and receive responses.

[0024] Step S11, extracting key semantic information through a bidirectional long short-term memory network based on the query information input by the attacking user in the virtual web server; Specifically, the bidirectional long short-term memory network (BiLSTM) is combined with the attention mechanism to perform word segmentation, part-of-speech tagging and key semantic extraction on the input query information, quickly locate core vocabulary and semantic focus, and extract key semantic information.

[0025] Step S12: Correlate and map the key semantic information with information in a preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; This involves constructing a power knowledge graph encompassing multi-dimensional knowledge, including power equipment types, equipment parameter relationships, business operation processes, and safety regulations. When an attacking user performs operations or inquiries on a fake web server, semantic parsing is performed using the power knowledge graph. For example, when an attacking user attempts to modify equipment parameters, the system can use the power knowledge graph to determine whether the operation complies with equipment parameter constraints, business process specifications, and so on. Furthermore, the power knowledge graph provides more precise semantic information support for interactions within the large language model, assisting it in understanding the attacking user's intent, making interactions more aligned with the actual power business, and enhancing the authenticity and credibility of the large language model's simulation environment and data.

[0026] As an example, rather than a limitation, for the question "How to troubleshoot a substation communication outage?", we can identify key semantic units such as "troubleshoot" and "substation communication." Then, using power knowledge graph embedding technology, we correlate and map the extracted semantic information with knowledge within the power knowledge graph, including power equipment relationships, business processes, and fault handling logic. This allows us to deeply understand the true intent and potential attack motivations of the attacker's question and determine whether the question represents a legitimate business inquiry or a veiled attempt to explore system vulnerabilities under the guise of troubleshooting.

[0027] Step S13, based on the attack intention and request information during the interaction process, a large language model is used to construct virtual power business information in the virtual web server and feed it back to the attacking user interaction to obtain attack behavior information; Specifically, the large language model is combined with historical power data based on time information, climate information, attack intent, and request information. It is fine-tuned through supervision using the physical constraint function in the power knowledge graph to construct virtual power business information that is fed back to the attack user interaction. For example, time information includes time periods (peak and off-peak periods) and seasons. Climate information includes temperature, humidity, wind speed, etc. Historical power data includes historical grid load information and equipment operating status, helping to understand and predict load fluctuation patterns, generator output, transformer load, and the status of grid equipment.

[0028] It's important to note that when constructing virtual power business information, the large language model comprehensively considers multiple factors to generate grid load data, equipment voltage and current data, and other data that conforms to actual correlation logic. For example, during hot weather and peak electricity demand periods, the large language model will generate higher load data and adjust related data such as generator output and line loss accordingly to ensure data rationality and consistency.

[0029] Furthermore, the operational scenarios of virtual power business information change dynamically over time, and the large language model can dynamically adjust its generation strategy based on real-time or simulated scenario information. During the transition period from low to high load on the power grid, the large language model automatically generates rising load curve data and corresponding equipment operating parameter adjustment data. In scenarios with large-scale renewable energy integration, the large language model incorporates the volatility of renewable energy generation to generate power data including changes in wind and photovoltaic output, while also adjusting grid dispatch-related data to ensure that the generated data accurately reflects the operational status under different scenarios.

[0030] Specifically, key features are extracted from the current scenario information, such as the key features of load scenarios, new energy scenarios, equipment scenarios, etc. The large language model generates load curves, new energy output, equipment parameters and other data based on the key features, and supervised fine-tuning is performed based on the physical constraint functions in the power knowledge graph to constitute dynamic adjustment of virtual power business information.

[0031] Furthermore, semantic features are extracted from the text data during the interaction process through a large language model; Extract network traffic features from network traffic data during the interaction process through a large language model; The semantic features and the network traffic features are fused to obtain attack behavior information.

[0032] In addition, the method further comprises: According to the attacking user's behavior pattern, the fault type is obtained based on the power knowledge graph, and the fault feature description text corresponding to the fault type is obtained. According to the fault parameters adjusted by the attacking user, the current operating data and the fault feature description text, a structured text prompt is constructed; Based on the structured text prompt, generating abnormal data on a virtual web server through a large language model; The rationality of abnormal data is verified through the physical constraint function in the power knowledge graph; A corresponding digital signal is generated according to the fault duration and characteristics in the abnormal data.

[0033] Step S14: evaluating the attack type and risk level of the attacking user according to the attack behavior information, formulating the power fraud strategy of the large language model based on the attack type and risk level, and adjusting the virtual power business information.

[0034] Specifically, an attack weight vector and a factor scoring function are obtained according to the attack behavior information, wherein the attack behavior information includes the attack type, the attack factor, and the corresponding factor data; Calculate the score of each attack factor based on the corresponding factor data and factor scoring function; Calculate the risk score based on the score of each attack factor and the attack weight vector; Risk levels are divided according to the risk scores.

[0035] For example, when it is judged that attacking a user carries a higher risk, information disclosure can be reduced and a more cautious feedback approach can be adopted (power deception strategy).

[0036] Update on electricity cheating tactics: The reinforcement learning algorithm is introduced into the large language model, taking the state space as the basic value and the effect of defending against attacks during the interaction as the reward signal, to iteratively optimize the power deception strategy of the large language model. Among them, the state space includes the current security status of the virtual web server, the current behavior pattern of the attacking user, and the current power fraud strategy. The defense attack effect includes the information richness of the attacking user, the effect of guiding the attacking user to expose information, the loss reduction degree of defense, and the risk degree of security vulnerability attack caused by defense.

[0037] Specifically, according to the state space, an initialized state function is established to obtain the effect of the initialized defense attack; According to the effect of the initial defense attack, use -greedy algorithm selects the next electricity cheating strategy; Execute the next step of the power deception strategy to interact with the attacking user to obtain a new state space and the effect of defending against the attack; Based on the new state space and the effectiveness of the defensive attack, the state function is updated using the Q-learning or DQN formula until iterative optimization converges.

[0038] In addition, the method further comprises: Calculate the minimum distance between each sample in the attack behavior information and the attack cluster in the historical behavior information in the attack database; Determining whether the minimum distance is less than a distance threshold; If yes, assign the sample to the attack cluster and update the attack database; If not, perform unsupervised clustering calculation on the sample to generate a potential new attack cluster, review the potential new attack cluster, and update the potential new attack cluster to the attack database through the incremental learning network.

[0039] Performing semantic analysis on the text information in the potential new attack cluster using a large language model, performing correlation analysis on the text information with the semantic features in the attack cluster to obtain a correlation value, and determining whether the correlation value reaches a correlation threshold; If so, it is defined as a variant, and the potential new attack cluster is marked as a related cluster; If not, it is defined as unrelated, and the potential new attack cluster is marked as a new attack cluster.

[0040] Furthermore, by learning from the power knowledge graph or power industrial control protocols, the large language model can deeply understand the semantics of various commands and data fields within the protocols. When receiving external protocol requests, it can accurately parse their attack intent, identifying not only the superficial command format but also the underlying business logic and potential needs. For example, for a device status query command in the IEC61850 protocol, the large language model can associate device operating knowledge with the power knowledge graph or power industrial control protocols, determine the attack behavior information of the query, and generate corresponding power deception strategies based on this understanding.

[0041] The reasoning capabilities of the large language model enable dynamic protocol interaction simulation. Based on the context of the protocol operation (such as the current device status and historical communication records), the model flexibly adjusts the protocol's power deception strategy. As can be understood, when simulating communication between power system devices, if a device is in a faulty state, the large language model will generate a response message containing a fault code, fault description, and other information in accordance with the protocol specifications and fault handling logic. If an attacking user attempts to perform an abnormal protocol operation, such as sending a malformed or unauthorized command, the large language model can identify the anomaly and, based on security policies, generate an error message that complies with protocol rules or implement a defensive response, simulating the response mechanisms of a real system.

[0042] The large language model integrates known vulnerability knowledge and attack patterns from the power industry knowledge graph or power industrial control protocols to simulate vulnerability scenarios. During the simulation, it proactively releases simulated vulnerability characteristics to attract attackers to exploit these vulnerabilities and launch attacks. When attackers attempt to exploit these simulated vulnerabilities, they capture attack behavior information, providing data support for security research and defense strategy development. For example, it simulates an authentication vulnerability in the IEC61850 protocol within the power industry control protocol, luring attackers into attempting illegal authentication and thereby capturing attack behavior information.

[0043] The attack database utilizes a hybrid storage architecture that combines relational databases (such as the column-based analytical database ClickHouse and the object-relational database PostgreSQL) with non-relational databases (such as the document-based non-relational database MongoDB and the in-memory key-value storage database Redis). This architecture provides differentiated storage based on the characteristics of different data types. For structured data such as attack logs, device operation records, and user interaction statistics, the powerful structured query and transaction processing capabilities of relational databases are leveraged to achieve efficient storage and retrieval. For example, ClickHouse's column-based storage and parallel computing features enable rapid processing of aggregate queries and analysis tasks on large-scale structured data. For unstructured raw network traffic data, interactive text content, image files, and other such data, the flexible data models and high scalability of non-relational databases are leveraged, using MongoDB's document storage structure or Redis's key-value storage to achieve fast write and read times. An indexing mechanism is also established to improve data access efficiency.

[0044] In summary, the power honeypot construction method based on the large language model in the above-mentioned embodiment of the present invention, through the supervised fine-tuning of the large language model by the power knowledge graph and the reinforcement learning optimization, enables the honeypot technology to realize intelligent interaction with the attacking user, accurately identify the attack behavior information of the attacking user, and dynamically adjust the power deception strategy to enhance the deceptiveness of the honeypot technology, thereby solving the technical problem that the static performance of the honeypot technology reduces the defense security.

[0045] Example 2 See also Figure 2 , which shows a power honeypot construction system based on a large language model in a second embodiment of the present invention, the system includes: The virtual server construction module 100 is used to construct a virtual web server on the original web server, analyze user request information through camouflage proxy and request filtering strategy, and classify users into normal users and attack users; A key semantic extraction module 200 is configured to extract key semantic information through a bidirectional long short-term memory network based on query information input by an attacking user into the virtual web server; The association mapping module 300 is used to associate and map the key semantic information with the information in the preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; Attack behavior acquisition module 400, which is used to construct virtual power business information in the virtual web server through a large language model based on the attack intention and request information during the interaction process and feedback it to the attack user interaction to obtain attack behavior information; The deception strategy formulation module 500 is used to evaluate the attack type and risk level of the attacking user according to the attack behavior information, and formulate the power deception strategy of the large language model based on the attack type and risk level, and adjust the virtual power business information.

[0046] In summary, the power honeypot construction system based on the large language model in the above-mentioned embodiment of the present invention, through the supervised fine-tuning of the large language model by the power knowledge graph and the reinforcement learning optimization, enables the honeypot technology to realize intelligent interaction with the attacking user, accurately identify the attack behavior information of the attacking user, and dynamically adjust the power deception strategy to enhance the deceptiveness of the honeypot technology, thereby solving the technical problem that the static performance of the honeypot technology reduces the defense security.

[0047] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0048] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A method for constructing a power honeypot based on a large language model, characterized in that: The method comprises: Build a virtual web server on the original web server, analyze user request information through camouflage proxy and request filtering strategy, and divide users into normal users and attack users; Extracting key semantic information through a bidirectional long short-term memory network based on query information input by the attacking user in the virtual web server; Correlate and map the key semantic information with the information in the preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; According to the attack intention and request information in the interaction process, a large language model is used to build virtual power business information in the virtual web server and feed it back to the attack user interaction to obtain attack behavior information; According to the attack behavior information, the attack type and risk level of the attacking user are evaluated, and based on the attack type and risk level, the power deception strategy of the large language model is formulated and the virtual power business information is adjusted.

2. The method for constructing a power honeypot based on a large language model according to claim 1, characterized in that: The steps to build a virtual web server on the original web server, analyze user request information through camouflage proxy and request filtering strategy, and classify users into normal users and attack users include: A virtual web server is built on the original web server. Through camouflage proxy and request filtering strategy, the user's request information is analyzed and the users are divided into normal users and attack users. The request information includes the request source, behavior pattern and request characteristics. Forward the normal user agent to the original web server and guide the attacking user to access the virtual web server.

3. The method for constructing a power honeypot based on a large language model according to claim 1, characterized in that: Based on the attack intent and request information during the interaction process, a large language model is used to construct virtual power business information in a virtual web server and feed it back to the attacking user interaction to obtain attack behavior information. Specifically, the steps include: The large language model is combined with historical power data based on time information, climate information, attack intent and request information, and fine-tuned through supervision by the physical constraint function in the power knowledge graph to construct virtual power business information feedback to the attack user interaction; Extract semantic features from text data during the interaction process through a large language model; Extract network traffic features from network traffic data during the interaction process through a large language model; The semantic features and the network traffic features are fused to obtain attack behavior information.

4. The method for constructing a power honeypot based on a large language model according to claim 3 is characterized in that: The method further comprises: Calculate the minimum distance between each sample in the attack behavior information and the attack cluster in the historical behavior information in the attack database; Determining whether the minimum distance is less than a distance threshold; If yes, assign the sample to the attack cluster and update the attack database; If not, perform unsupervised clustering calculation on the sample to generate a potential new attack cluster, review the potential new attack cluster, and update the potential new attack cluster to the attack database through the incremental learning network.

5. The method for constructing a power honeypot based on a large language model according to claim 4 is characterized in that: After performing unsupervised clustering calculation on the samples to generate potential new attack clusters, reviewing the potential new attack clusters, and updating the potential new attack clusters into the attack database through an incremental learning network, the method further includes: Performing semantic analysis on the text information in the potential new attack cluster using a large language model, performing correlation analysis on the text information with the semantic features in the attack cluster to obtain a correlation value, and determining whether the correlation value reaches a correlation threshold; If so, it is defined as a variant, and the potential new attack cluster is marked as a related cluster; If not, it is defined as unrelated, and the potential new attack cluster is marked as a new attack cluster.

6. The method for constructing a power honeypot based on a large language model according to claim 1, characterized in that: The step of evaluating the attack type and risk level of the attacking user based on the attack behavior information specifically includes: Obtaining an attack weight vector and a factor scoring function based on the attack behavior information, wherein the attack behavior information includes an attack type, an attack factor, and corresponding factor data; Calculate the score of each attack factor based on the corresponding factor data and factor scoring function; Calculate the risk score based on the score of each attack factor and the attack weight vector; Risk levels are divided according to the risk scores.

7. The method for constructing a power honeypot based on a large language model according to claim 6, characterized in that: The method further comprises: A reinforcement learning algorithm is introduced into the large language model. The state space is used as the base value, and the effect of defending against attacks during the interaction process is used as the reward signal to iteratively optimize the power deception strategy of the large language model. The state space includes the current security status of the virtual web server, the current behavior pattern of the attacking user, and the current power deception strategy. The defense attack effect includes the information richness of the attacking user, the effect of guiding the attacking user to expose information, the loss reduction degree of defense, and the risk of security vulnerability attack caused by defense.

8. The method for constructing a power honeypot based on a large language model according to claim 7, characterized in that: The steps of introducing a reinforcement learning algorithm into the large language model, taking the state space as the base value and the effect of defending against attacks during the interaction as the reward signal, and iteratively optimizing the power deception strategy of the large language model include: According to the state space, an initialized state function is established to obtain the effect of the initialized defense attack; According to the effect of the initial defense attack, use -greedy algorithm selects the next electricity cheating strategy; Execute the next step of the power deception strategy to interact with the attacking user to obtain a new state space and the effect of defending against the attack; Based on the new state space and the effectiveness of the defensive attack, the state function is updated using the Q-learning or DQN formula until iterative optimization converges.

9. The method for constructing a power honeypot based on a large language model according to claim 1, characterized in that: The method further comprises: According to the attacking user's behavior pattern, the fault type is obtained based on the power knowledge graph, and the fault feature description text corresponding to the fault type is obtained. According to the fault parameters adjusted by the attacking user, the current operating data and the fault feature description text, a structured text prompt is constructed; Based on the structured text prompt, generating abnormal data on a virtual web server through a large language model; The rationality of abnormal data is verified through the physical constraint function in the power knowledge graph; A corresponding digital signal is generated according to the fault duration and characteristics in the abnormal data.

10. A power honeypot construction system based on a large language model, characterized in that: The system is used to execute the method for constructing a power honeypot based on a large language model according to any one of claims 1 to 9, and the system includes: The virtual server construction module is used to build a virtual web server on the original web server. It analyzes user request information through camouflage proxy and request filtering strategy, and divides users into normal users and attack users. A key semantic extraction module, configured to extract key semantic information through a bidirectional long short-term memory network based on query information input by an attacking user into the virtual web server; An association mapping module is used to associate and map the key semantic information with information in a preset power knowledge graph to obtain the attack intention of the attacking user during the interaction process; The attack behavior acquisition module is used to construct virtual power business information in the virtual web server through a large language model based on the attack intention and request information during the interaction process and feedback it to the attack user interaction to obtain attack behavior information; A deception strategy formulation module is used to evaluate the attack type and risk level of the attacking user according to the attack behavior information, and based on the attack type and risk level, formulate the power deception strategy of the large language model and adjust the virtual power business information.

Images